Children's data and design codes laws by state

Bills that moved most recently

The 25 open children's data and design codes bills with the latest action. The Children's Online Safety Tracker follows all 78.

• 1 October 2026

  New Jersey S 4661: Prohibits sale of minor's personal data; requires controllers and processors to provide mechanism for requesting deletion of certain personal data.

  What it would do: Prohibits controllers and processors from selling personal data of consumers known to be under 18 years old. Requires controllers and processors to provide a mechanism for minors or their parents to request deletion of the minor's personal data.

  In committee

• 25 August 2026

  Illinois SB 3241: Age-appropriate design code

  What it would do: Requires covered entities processing children's data to act in children's best interests, complete data protection impact assessments for online services reasonably likely accessed by children, and comply with specified privacy protections. Authorizes Attorney General enforcement with civil penalties up to $7,500 per affected child for intentional violations.

  In committee

• 5 August 2026

  Congress S. 1748: Kids Online Safety Act

  What it would do: Requires covered online platforms to exercise reasonable care in design features to prevent harms to minors including eating disorders, substance abuse, and sexual exploitation. Mandates safeguards, parental tools, transparency reporting, and prohibits opaque algorithms without user opt-out options.

  Passed committee

• 5 August 2026

  Congress S. 4199: Youth AI Privacy Act

  What it would do: Requires AI chatbot deployers to disclose to minors that they are not interacting with humans, prohibits personalization based on user data, bans compulsive-use features, restricts advertising, and prohibits processing minor user data for profiling or algorithm training, with FTC enforcement and private right of action for parents.

  Passed committee

• 21 July 2026

  Virginia SB 232: Consumer Data Protection Act; prohibitions and duties relating to minors.

  What it would do: Amends Virginia's Consumer Data Protection Act to add protections for minors, including prohibiting online service agreements with minors without verified parental consent, limiting social media use to one hour daily for users under 16, and requiring controllers to disclose targeted advertising and exercise reasonable care to prevent harm to minors.

  Passed committee

• 30 June 2026

  New Jersey S 3413: "New Jersey Kids Code Act"; adopts New Jersey Age-Appropriate Design Code and requires certain online service providers to implement certain measures concerning minors' use of online service.*

  What it would do: Requires covered online service providers with annual revenue exceeding $25,000,000 or processing personal data of 25,000+ consumers to implement age-appropriate privacy and safety protections for minors, including default high-privacy settings, restrictions on data use and algorithmic recommendations, notification limits, and mechanisms for account deletion.

  Passed committee

• 22 May 2026

  Illinois SB 3735: Educ-tech rts/biometric info

  What it would do: Establishes student and parent rights to opt out of school-issued electronic devices, automated grading, and predictive analytics with comparable analog alternatives. Prohibits school districts from purchasing or using biometric systems on students and requires destruction of existing biometric information within 30 days. Restricts operators from selling student data or training artificial intelligence on student information for non-school purposes.

  In committee

• 9 April 2026

  California AB 2426: Online platforms: educational children's content.

  What it would do: Requires advertising-supported digital content platforms with annual gross revenues exceeding $100,000,000 to establish and maintain a walled garden section containing at least four hours of educational children's content free from targeted advertising and accessible without account creation.

  Passed committee

• 7 April 2026

  Colorado HB 1148: Protections for Youth on Social Media

  What it would do: Requires covered businesses offering online gaming services to minors to implement privacy protections including highest-level default privacy settings, account deletion tools, restrictions on data collection and use, and prohibits compulsive use design practices. Imposes a 5% fee on add-on transactions by minors, with revenue directed to the state public school fund.

  Introduced

• 27 March 2026

  Illinois HB 3041: Data privacy and protection

  What it would do: Creates the Illinois Data Privacy and Protection Act, requiring covered entities to limit data collection to what is reasonably necessary, establish privacy policies, obtain affirmative express consent for sensitive data, and comply with individual rights including access, deletion, and correction of personal data.

  In committee

• 26 March 2026

  Minnesota HF 4511: Minnesota Age-Appropriate Design Code Act created, obligations placed on certain businesses regarding children's consumer information, and attorney general enforcement provided.

  What it would do: Creates the Minnesota Age-Appropriate Design Code Act requiring businesses meeting revenue or data thresholds to complete data protection impact assessments for online products accessed by children, configure high-privacy defaults, and prohibit harmful data practices. Authorizes attorney general enforcement with civil penalties up to $7,500 per affected child for intentional violations.

  In committee

• 24 March 2026

  New Mexico HB 214: Consumer information and data protection act

  What it would do: Creates the Consumer Information and Data Protection Act establishing data privacy rights for New Mexico residents, including rights to access, correct, delete, and port personal data, and restricts collection and sale of personal data, particularly for minors and sensitive health information.

  Introduced

• 19 March 2026

  New Jersey S 4016: Concerns social media privacy and data management for children and establishes New Jersey Children's Data Protection Commission.

  What it would do: Requires social media platforms to complete data protection impact assessments before offering new services likely accessed by children under 18, prohibits harmful data practices targeting children, and establishes a nine-member New Jersey Children's Data Protection Commission to recommend privacy best practices.

  In committee

• 16 March 2026

  Congress S. 836: Children and Teens’ Online Privacy Protection Act

  What it would do: Amends the Children's Online Privacy Protection Act to expand protections for children and teens by restricting individual-specific advertising, requiring verifiable consent from parents or teens, expanding the definition of personal information to include persistent identifiers and biometric data, and requiring operators to delete personal information upon request.

  Passed chamber

• 26 February 2026

  Washington SB 5708: Protecting Washington children online.

  What it would do: Requires businesses providing online services likely accessed by minors to estimate user age, restrict data collection from children under 13, use high-privacy default settings, and prohibit dark patterns and harmful profiling. Restricts addictive feeds to non-minors and limits notifications to minors during school hours without parental consent.

  Floor vote

• 25 February 2026

  Maryland HB 1638: Consumer Protection - Covered Platforms - Protection of Minors (Kids Online Protection and Antigrooming Act)

  What it would do: Requires owners or operators of covered platforms to establish default privacy and safety settings for minors under 17, including restricting adult connections, prohibiting unsolicited messaging, limiting geolocation sharing, and allowing parents to manage accounts and receive notifications. Authorizes the Attorney General to enforce violations with civil penalties up to $10,000 per violation after providing 45 days to cure.

  In committee

• 20 February 2026

  Kentucky HB 633: AN ACT relating to data privacy.

  What it would do: Amends Kentucky data privacy law to add protections for minors on online services, including default high privacy settings, deletion tools, opt-out of algorithmic feeds, parental controls, blocking features, and restrictions on profiling, targeted advertising, dark patterns, and push notifications during school and nighttime hours.

  In committee

• 20 February 2026

  South Dakota HB 1309: restrict the processing of online personal data of individuals sixteen years of age or younger.

  What it would do: Prohibits operators of online applications and websites from processing personal data of users sixteen years or younger unless permitted under federal law, parental consent is obtained, or processing is strictly necessary for specified operational purposes.

  In committee

• 19 February 2026

  Washington HB 1834: Protecting Washington children online.

  What it would do: Prohibits operators of addictive internet-based services from providing addictive feeds to minors without age verification starting July 1, 2027, and restricts push notifications to minors during certain hours without parental consent. Requires operators to provide users mechanisms to limit feed access, hide engagement metrics, and set accounts to private.

  Passed committee

• 12 February 2026

  Georgia SB 495: "Age-Appropriate Design Code Act"; enact

  What it would do: Restricts covered entities from engaging in high-risk data practices targeting minors, including collecting unnecessary personal data, using algorithmic feeds without consent, and deploying compulsive design features. Requires risk assessments, default privacy settings, deletion requests, and transparency disclosures.

  In committee

• 3 February 2026

  Mississippi SB 2388: Kids Online Protection and Anti-Grooming Act; enact.

  What it would do: Requires owners and operators of covered platforms to owe minors a duty of care including prohibiting adults from initiating contact with minors and notifying legal representatives within 24 hours of microtransactions, sexually explicit material exposure, or adult-minor connections, with violations subject to damages and attorney's fees.

  In committee

• 29 January 2026

  Washington SB 6111: Protecting children online.

  What it would do: Requires digital service providers offering social networking features to verify user age, obtain parental consent for minors 16 and under, limit data collection, prohibit precise geolocation tracking and targeted unlawful advertising to minors, and implement strategies to prevent minor exposure to harmful content including self-harm, exploitation, and violence.

  In committee

• 28 January 2026

  Hawaii HB 2040: Relating to protection of minors.

  What it would do: Prohibits social media platforms from providing algorithmically-curated feeds to minors without parental consent or age verification, and restricts collection and sale of personal data from minors unless necessary for service provision or permitted by federal law.

  In committee

• 13 January 2026

  New Jersey A 1358: Concerns social media privacy and data management for children and establishes New Jersey Children's Data Protection Commission.

  What it would do: Requires social media platforms to complete Data Protection Impact Assessments before offering new services likely accessed by children, prohibits certain data practices harmful to children, and establishes a nine-member New Jersey Children's Data Protection Commission to recommend best practices.

  In committee

• 12 January 2026

  New York A 6549: Establishes the "stop online predators act"

  What it would do: Requires online platforms used by minors under 18 to conduct age verification, implement default privacy protections preventing non-connected users from contacting, viewing profiles, tagging, or transacting with minors, and obtain parental approval for connections and financial transactions for users under 13.

  In committee