Alarming trends in teen mental health, paired with young people’s growing dependence on social media, have pushed California to adopt an increasingly aggressive set of protections for children online. Yet even as the state builds what many consider the strongest child privacy framework in the nation, it still lags behind more sweeping efforts underway in other countries — including Brazil, which recently enacted comprehensive legislation that in some ways goes further than anything California has managed to pass.
California’s rules bar companies from selling children’s data, give young users the ability to delete their own posts, and require platforms that target kids to actively manage the risks their products pose. Additional measures under consideration could go even further, potentially barring many teenagers from social media altogether. Though some of these laws face ongoing legal battles, taken together they represent some of the toughest online privacy protections for minors anywhere in the country.
That puts California well ahead of the federal Children’s Online Privacy Protection Act, or COPPA, which requires parental consent before websites can collect data from children under 13 — but only if the site is clearly aimed at kids or knowingly gathers their information. California’s laws cover a broader age range and impose stricter design requirements. Because tech companies often find it easier to apply California’s stronger protections nationwide rather than build separate systems, the state has effectively become a de facto national standard-setter on children’s privacy.
Still, for all its progress compared with the rest of the U.S., California’s approach remains narrower than what has emerged in some other nations. As lawmakers here worked through a patchwork of individual bills, Brazil moved to pass an all-encompassing law that mirrors — and in some cases exceeds — California’s protections.
Experts say the United States faces obstacles that other countries simply don’t have to contend with, including First Amendment constraints, differing cultural understandings of privacy, and a tech industry that treats strict privacy rules as an existential threat to its business model.
A DECADE OF INCREMENTAL PROGRESS
California has spent roughly ten years building out child privacy protections, and the pace has picked up considerably in recent years.
“In California, everything has been changing, and pretty dramatically, over the last four years,” said Ed Howard, senior policy advocate at the University of San Diego’s Children’s Advocacy Institute.
The state’s 2018 Consumer Privacy Act, like federal law, requires parental consent before companies can collect data from children under 13. But it goes further, also requiring consent from teens ages 13 to 16 before their information can be gathered.
In 2022, lawmakers passed the California Age-Appropriate Design Code Act, which requires companies to estimate users’ ages and default to strong privacy protections for anyone who might be underage. The law also cracks down on so-called “dark patterns” — design tricks that create an illusion of choice while actually steering users toward decisions that benefit the platform.
“If there’s a product that kids are likely to have access to, it has to be, by design and default, safe for them,” said Assemblymember Buffy Wicks, an Oakland Democrat who helped shape that legislation.
Wicks also authored a measure taking effect next year that will require companies to build in an age “signal” system, giving platforms a general sense of how old a device’s user is likely to be. It would be among the strictest laws of its kind in the country, though a series of tech industry legal challenges has already chipped away at some of its provisions.
Another law, the Protecting Our Kids from Social Media Addiction Act of 2024, bars social media companies from serving “addictive” content to minors without parental consent and restricts when platforms can send notifications to teens. That law, set to take effect in 2027, has so far withstood legal challenges.
Additional bills currently before the Legislature would go even further, banning “addictive” social media use outright for anyone under 16 — a proposal that has drawn sharp criticism from some online privacy advocates who worry it would effectively end anonymous internet use by requiring age verification at sign-up.
More recently, the state has turned its attention to artificial intelligence, passing a law requiring mental health safeguards on chatbots. That legislation followed a string of troubling incidents, including the death of California teenager Adam Raine, who spent months discussing suicide with ChatGPT before taking his own life. His case is one of several involving teenagers that have alarmed lawmakers.
Raine’s mother, Maria, recently testified before the state Senate’s Privacy, Digital Technologies, and Consumer Protection Committee, pressing for stronger safeguards. She described how ChatGPT, which began as “a program that helped with homework, became a confidant, and ultimately a suicide coach.”
Under a law signed last year, AI chatbots must disclose that they are not human, and companies are required to take reasonable steps to prevent children from viewing graphic content. Lawmakers are now considering additional bills that would require AI companies to conduct annual risk assessments related to mental health harms and give parents tools to limit how much their children interact with chatbots.
This flurry of state action stands in sharp contrast to Washington, where Congress has repeatedly failed to agree on the terms of a national law. Legislators are currently weighing the Kids Online Safety Act, which would extend COPPA-style protections to everyone under 18 and ban targeted advertising aimed at children and teens. But the bill has drawn fire from child safety advocates who say it doesn’t go far enough, and from civil liberties groups worried about free speech implications — leaving its future uncertain as the House and Senate continue to negotiate.
LOOKING ABROAD FOR IDEAS
For years, advocates for teen safety have pointed to research linking heavy social media use to mental health struggles. A significant share of teens report that social media has hurt their mental health, and research has tied excessive use to higher rates of anxiety and depression.
Recently, Meta and YouTube were found liable in a landmark lawsuit alleging the companies knowingly built platforms with addictive features harmful to children and teens. The suit cited internal documents suggesting the companies understood the potential harm their products caused but allowed young users on the platforms anyway.
Other countries have taken a more comprehensive approach than the U.S., passing sweeping legislation specifically aimed at protecting children’s data and regulating their social media use. “I look at what’s happening in the U.K., I look at what’s happening in Australia,” Wicks said, noting she recently met with lawmakers from Britain and Greece to discuss child privacy issues.
“We steal good ideas when we see them elsewhere,” she said, adding that the Age-Appropriate Design Code Act was “borrowed wholesale from the U.K.”
In Brazil, the ECA Digital law — a comprehensive child privacy measure — was signed this year despite heavy pushback from the tech industry. The law bars companies from targeting children with ads based on their online behavior, mandates parental oversight tools, and defaults to the strictest privacy settings for young users. It also bans potentially addictive features such as autoplay and infinite scroll.
Some legal experts believe pieces of that law, and others like it, could be adapted for use in the United States — quite possibly through a state like California.
Mariana Olaizola Rosenblat, a tech policy and law adviser at New York University’s Stern Center for Business and Human Rights, said there’s already substantial overlap between Brazilian and Californian regulations.
“I think there’s quite a bit of overlap, but the differences mostly stem from specific constitutional features of the U.S. legal system,” she said. The First Amendment has frequently been invoked in tech industry lawsuits challenging laws that restrict what algorithms can show users.
Olaizola Rosenblat, who studies international privacy law, said some ECA Digital provisions — such as requiring social platforms to offer parental oversight tools — could realistically be adopted in the U.S. Those tools let parents control features and content their children see, including limits on messaging, screen time, autoplay and reward systems. She noted California has already passed similar measures, including default privacy settings for minors and advertising restrictions.
International laws can often go further in restricting content available to minors, since other countries don’t operate under the same free speech guarantees. “They can regulate it in a way that, in my view, the U.S. can’t do because of the First Amendment,” she said.
Marina Petric, a researcher at Texas Tech University, called this dynamic “First Amendment fundamentalism.”
“The American narrative has been built into the architecture of digital platforms as though it were a universal standard,” she said. “Those who reject that premise get labeled as supporters of censorship. But free speech defined by one party and applied selectively isn’t free speech — it’s a tool of power.”
Still, Olaizola Rosenblat said there are ways to adapt pieces of international law for use domestically. At least parts of laws like the ECA Digital, she said, are compatible with existing legal rights in the U.S.
Howard added that the structure of American government makes it easier to pass individual bills piecemeal rather than sweeping omnibus legislation all at once. He also noted that privacy issues evolve quickly, and slow-moving bodies like Congress often struggle to keep pace.
But both Howard and Olaizola Rosenblat agree the biggest obstacle to stronger child privacy protections boils down to one thing: the influence of tech industry money.
“The single biggest reason, by far, is the power of money in our system, and the fact that our system is uniquely vulnerable to that power,” Howard said.
In 2025, tech companies pushing for lighter regulation of AI and cryptocurrency spent more than $39 million on political spending and lobbying efforts, according to a CalMatters analysis. Companies say the money supports candidates who back their industry, but critics argue it buys outsized influence.
As part of its spending, Meta donated $150,000 to the California Democratic Party and $20 million to a new political committee. As lawmakers debated how best to regulate AI last year, the company spent far more than in any previous year. Meta said the money was intended to “help elect state political candidates in California — regardless of party affiliation — who support and defend the American tech industry.”
That’s just a fraction of the picture. Tech companies spend tens of millions more each year lobbying Congress.
“I think the biggest problem is the tech lobby, which is very successful in the United States and maybe not as much in other jurisdictions like Brazil,” Olaizola Rosenblat said. “Because they know the most threatening thing for them would be a federal law in the United States.”
While other countries also face industry pressure, the U.S. represents an unusually large market, and California is home to the tech industry itself. That gives major tech companies strong incentive to fight hard against any law that threatens their business model — including rules meant to protect children.
“When it comes to privacy, every company has a financial interest in there being very little privacy,” Howard said.
Original source: CalMatters
