Attorney General Bonta: Essential Legislation to Protect Children’s Data Privacy Passes Assembly

SACRAMENTO — California Attorney General Rob Bonta issued the following statement after Assembly Bill 1949 (AB 1949), the California Children’s Data Privacy Act, passed the Assembly. AB 1949, sponsored by Attorney General Bonta and authored by Assemblymember Buffy Wicks (D-Oakland), would provide more robust protections for kids’ data privacy. This marks an important continuation of Attorney General Bonta’s commitment to improving child safety online. 

"AB 1949 closes a gap in California’s privacy laws that currently allows giant social media companies to exploit our children’s data,” said Attorney General Bonta. “This puts our kids at risk, leaving them vulnerable to having their location and other personal data tracked, shared, and sold online. We must act swiftly to create a safer online space for children to learn, explore, and play.”

AB 1949 strengthens privacy protections for children under the California Consumer Privacy Act (CCPA). CCPA secures increased privacy rights for California consumers, including the right to know what personal information businesses collect and sell, and the right to stop those sales to third parties. As it stands, CCPA does not effectively protect 17-year-olds, or limit businesses from collecting or exploiting the data of young users, so long as they do not sell it. This gap has allowed companies like Google and Meta to collect, exploit, and monetize young users’ data on a massive scale. Despite businesses’ awareness that children use their services, businesses currently design their online services to include features that may be harmful to children, including manipulative techniques to prod them to spend hours on end online or provide personal information beyond what is expected or necessary. 

Accordingly, AB 1949 establishes stronger data privacy protections for children under the CCPA to help keep children under age 18 and their data from being collected and exploited without parental consent. The bill seeks to prohibit businesses from collecting, using, sharing, or selling personal data of anyone under the age of 18, unless they receive informed consent. For users under 13, this informed consent must come from a parent.