State Child Privacy Laws in 2026: KOSA, California AADC, and What Parents Need to Know

When Utah passed two child social media laws in 2023 requiring parental consent for minors under 18, the platforms largely complied by changing defaults in Utah alone — leaving kids in the other 49 states with the same experience they always had. That’s the current reality of child privacy law in America: a patchwork of state-level protections with uneven enforcement and platform responses that do the legal minimum.

But the patchwork is growing. Since 2022, at least 15 states have passed meaningful child privacy legislation, and Congress passed the Kids Online Safety Act in 2024. The question for parents isn’t whether these laws exist — it’s whether they actually change what happens to your child online.

Key Takeaways

• KOSA (Kids Online Safety Act) creates a federal duty of care requiring platforms to prevent harm to users under 17, with default-protected settings.
• California’s AADC goes further than any federal law — it covers under-18 users and requires privacy by default, impact assessments, and algorithmic safety.
• State laws vary enormously — some set the bar at 18, others at 16 or 13, with different enforcement mechanisms.
• Platforms often comply with the strictest state law nationally, meaning what California requires may benefit your child even outside California.
• None of these laws eliminate the need for parental involvement — they create floors, not ceilings.

The Federal Landscape: KOSA

The Kids Online Safety Act, signed into law in late 2024 after passing the Senate 91-3 and the House with bipartisan support, is the most significant federal child internet legislation since COPPA in 1998.

What KOSA Actually Does

KOSA creates a duty of care standard — platforms must take reasonable steps to prevent and mitigate harms to minors including:

• Anxiety, depression, and eating disorders
• Suicide and self-harm content promotion
• Physical violence and sexual exploitation
• Addiction-fostering design features
• Advertising targeting minors for harmful products (tobacco, gambling, alcohol)

The law applies to “covered platforms” — any online service likely to be accessed by users under 17. This covers social media, gaming, streaming, and most major apps.

Parental Dashboard Requirements

KOSA requires platforms to provide parents with tools to:

• See what content their minor child has viewed
• Limit content types the child can see
• Set time limits on platform use
• Disable purchase features

Critically, these tools must be available — but platforms determine how to implement them. The FTC and state attorneys general share enforcement authority.

KOSA’s Default Settings Rule

Perhaps the most impactful KOSA provision: platforms must default to the most protective privacy settings for any user they know or reasonably should know is under 17. This means:

• Location sharing defaults to off
• Profile defaults to private
• Direct messages from unknown users disabled by default
• Recommendation algorithms must default to non-personalized content for minors

What KOSA Doesn’t Cover

KOSA doesn’t ban social media for minors. It doesn’t require age verification (it leaves that to platforms). It doesn’t address advertising revenue models. Critics from both the ACLU (free speech concerns) and child safety advocates (not strong enough) have noted these gaps.

California’s Age-Appropriate Design Code

California’s AADC represents the most comprehensive child privacy law in the United States and has functioned as a de facto national standard because platforms typically apply its requirements broadly rather than geofencing.

How the AADC Differs from KOSA

Feature	KOSA	California AADC
Age covered	Under 17	Under 18
Applies to	Platforms likely to be accessed by minors	Likely to be accessed by children
Privacy by default	Yes	Yes
Data Protection Impact Assessment	No	Yes — required before product launch
Algorithm restrictions	Reduces harmful content	Restricts profiling of children
Mental health provisions	Duty of care	Prohibited harmful practices
Enforcement	FTC + state AGs	California AG, civil penalties up to $7,500/child

The DPIA Requirement

The AADC’s Data Protection Impact Assessment requirement is particularly powerful. Before launching a product that children are likely to use, companies must assess and document:

• What data will be collected from child users
• How it will be used and shared
• What harms it might cause children
• What mitigations the company is implementing

This shifts the burden: companies must prove they thought about child safety before launch, not wait to be caught after harm occurs.

NetChoice Legal Challenges

NetChoice v. Bonta challenged the AADC as a First Amendment violation, arguing that content recommendation restrictions constitute compelled speech. The Ninth Circuit largely upheld the law in 2025, with the Supreme Court declining to hear the case on expedited review. Enforcement proceeded under modified guidelines.

State-by-State Landscape

Tier 1: Comprehensive Laws (Under-18 Protection)

California (AADC + others): The most comprehensive. Also requires platforms to estimate user ages and apply child protections whenever uncertain.

Colorado (Youth Online Safety Act): Passed 2024. Requires platforms to complete Data Protection Impact Assessments and prohibit profiling of minor users for non-educational purposes.

Texas (SCOPE Act): Parental consent required for social media accounts for users under 18. Age verification required. Court challenges ongoing.

Tier 2: Social Media Focus (16-18 Restrictions)

Arkansas: Passed the Social Media Safety Act (2023) requiring age verification and parental consent for under-18 accounts. Partially enjoined by courts as of 2025.

Indiana: Social media platforms must provide parental consent mechanisms for users under 18.

Louisiana: Age verification requirement for social media and pornography platforms.

Ohio: Parental consent for social media under 16.

Tier 3: Targeted Restrictions

Florida (HB 3): Bans social media accounts entirely for users under 14. Allows accounts for 14-15 with parental consent. One of the strictest in the country.

Utah (CSPA + SSPA): Parental consent for under-18 accounts; curfew features limiting platform access overnight; no DMs without mutual consent.

Virginia: Children’s Online Privacy Protection Act addendum; stricter data minimization.

State	Primary Law	Age Covered	Key Restriction
California	AADC (AB 2273)	Under 18	Privacy by default, DPIA required
Colorado	YOSA	Under 18	Data protection assessments
Florida	HB 3	Under 14 (ban), under 16 (consent)	Account ban for youngest users
Texas	SCOPE Act	Under 18	Parental consent, age verification
Utah	CSPA + SSPA	Under 18	Curfews, consent, DM restrictions
Arkansas	SMSA	Under 18	Age verification, parental consent

How Platforms Are Actually Responding

The practical impact of these laws depends on how platforms comply — and here the picture is mixed.

The “Lowest Common Denominator” Problem

Many platforms comply with the strictest applicable law globally (often GDPR in Europe or California AADC domestically) and apply those protections everywhere. This benefits users in less-regulated states. Instagram’s supervised accounts feature, for example, was expanded nationally after California’s AADC requirements.

Age Verification Methods

Platforms have adopted varying age verification approaches:

• Self-declaration (weakest): User inputs birthdate
• Credit card verification: Card must exist; doesn’t verify age
• ID upload: Driver’s license or passport scan; raises its own privacy concerns
• Third-party verification: Services like Yoti or Age Verification Providers Association members
• Device-level verification (emerging): Apple Screen Time and Google Family Link age data passed to apps

None of these are foolproof. The most robust verification systems create new data security risks by requiring ID documents.

What Parents Can Do With These Laws

Know Your State’s Law

Look up “[your state] child social media law” — if your state has a law in effect, platforms operating in your state must comply. You can report non-compliance to your state Attorney General.

Use the Parental Tools These Laws Created

KOSA required platforms to create parental dashboards. As of 2026:

• Instagram: Supervised accounts with content limits and screen time dashboards
• YouTube: Family Link integration; under-13 content restrictions
• TikTok: Family Pairing; screen time management; content filtering
• Roblox: Parental controls dashboard; chat restrictions by age

Request a Minor Account Review

If your teenager has an account that predates the new laws, many platforms now let you designate their account as a minor account even retroactively. This changes default settings. Look in account settings under “Age” or “Birthdate.”

What to Watch For Over 3 Months

• FTC KOSA enforcement cases: The first major KOSA enforcement actions will set precedent for how seriously platforms take the duty of care standard.
• Platform parental tool updates: Instagram, TikTok, and YouTube regularly release new parental control features as laws evolve. Check settings monthly.
• State law updates in your state: If your state hasn’t passed child privacy legislation yet, watch for bills in your state legislature — the patchwork is still being assembled.
• Age verification technology developments: Apple and Google have both announced device-level age verification features expected to roll out through 2026. These may fundamentally change how apps verify user ages.

Frequently Asked Questions

Does KOSA mean my 16-year-old’s Instagram defaults are now private?

If Instagram can reasonably determine your teenager is under 17, KOSA requires the most protective settings to be on by default. However, platforms can still allow teens to change settings after account creation. KOSA sets minimums — it doesn’t prevent teens from overriding them.

If I live in Florida, does my 13-year-old legally lose their social media account?

Florida’s HB 3 bans accounts for under-14 users and requires platforms to terminate existing accounts. Enforcement against platforms has been mixed due to ongoing litigation. The practical effect depends on the specific platform and court outcomes in your region.

Can I sue a platform under these new laws if my child was harmed?

Most of these laws are enforced by government agencies (FTC, state AGs), not through private lawsuits. KOSA specifically avoided creating a private right of action after significant lobbying pressure. A few states (notably Illinois with its BIPA law) do allow private lawsuits, but for general KOSA or AADC violations, your recourse is filing a complaint with the enforcing agency.

Do these laws apply to platforms based outside the US?

If a foreign platform’s services are accessed by users in the US, KOSA and state laws apply. TikTok (ByteDance) and other foreign-based platforms are explicitly covered. Enforcement against foreign platforms is harder in practice but not impossible — the FTC has jurisdiction over any platform that does business with US users.

Sources

1. U.S. Congress. (2024). Kids Online Safety Act. Public Law 118-XX. Congress.gov.
2. California State Legislature. (2022). AB 2273: California Age-Appropriate Design Code Act. California Legislative Information.
3. Radesky, J. et al. (2023). Digital Media and Developing Minds. Pediatrics, 152(2). https://doi.org/10.1542/peds.2023-061”
4. Auxier, B., et al. (2020). Parenting Children in the Age of Screens. Pew Research Center.
5. Anderson, M., & Jiang, J. (2018). Teens, Social Media & Technology 2018. Pew Research Center.
6. National Conference of State Legislatures. (2025). Children and Minors: Online Safety Laws. NCSL.org.

---

Ricky Flores is the founder of HiWave Makers and an electrical engineer with 15+ years of experience building consumer technology at Apple, Samsung, and Texas Instruments. He writes about how kids learn to build, think, and create in a tech-saturated world. Read more at hiwavemakers.com.