California lawmakers plan to introduce a bill, with bipartisan support, protecting the online data of children, similar to the UK's age appropriate design code
Context & Ripple Effects
This February 2022 report is the origin point of what became California's most-copied piece of tech regulation: a bipartisan plan, explicitly modeled on the UK's age appropriate design code, to force online services to build child safety into their products by default rather than bolt it on after complaints.
The arc since then validates the story's importance — the proposal cleared the legislature that summer and Governor Newsom signed it into law in September, putting limits on data collected on minors with an effective date of July 2024 (Newsom signs the online safety bill). The same design code has since spawned a second front: a 2025 Assembly bill shifting age checks upstream to device makers and app stores, backed by Google and Meta but opposed by the MPA (the app-store age verification bill).
First-order effects
- Online services used by under-18s face a compliance deadline of July 2024 to rework default settings and data collection for minors, with enforcement falling on any company touching the California market.
- Bipartisan sponsorship removes the usual legislative escape hatch — privacy-for-children becomes one of the few issues where tech companies cannot rely on partisan gridlock in Sacramento.
Second-order effects
- Critics immediately flagged the law's hidden cost: verifying who is a minor may require invasive methods like face-scanning (critics warn of invasive age verification), turning a privacy bill into an identity-checking mandate.
- The 2025 follow-on shows where the burden lands next — by requiring device makers and app stores to verify ages, the state forces Apple and Google to become gatekeepers, which is why Google and Meta back it while content-industry groups like the MPA oppose it.
Third-order effects
- If the pattern holds, California functions as de facto national regulator: companies build to the strictest state's child-data standard rather than maintain fifty versions, replicating how the UK code set global product defaults.
- Age assurance is becoming a structural layer of the internet itself — moving from optional parental controls to mandatory infrastructure at the OS and app-store level, with the attendant trade-off between child protection and anonymous browsing still unresolved.
The trend: US states are importing the UK's age-appropriate-design model, with California as the template-setter and age verification migrating from websites down into device and app-store infrastructure.