Online businesses would limit how they use minors’ data

Covered businesses would set minors’ privacy settings to the highest level by default. These rules would apply to minors a covered business knows are under 18 or labels as minors under attorney general rules, on covered online services. A minor could allow a specific known adult to see their account or media, contact them, or see their location, as applicable. A minor could request that a social media account be unpublished or deleted. A business would have 15 days after receiving a request to unpublish or delete the social media account.

Covered businesses would limit how they collect and use minors’ personal data. These rules would cover data about minors whom covered businesses know are under 18 or label as minors; age-check rules would apply to covered businesses and processors. Businesses could use personal data to recommend media only when a minor asks for certain content, chooses privacy or accessibility settings, or searches for something; search data could be used only for that search. For age checks, businesses and processors could collect only data strictly needed, use it only to check age, and generally would have to delete it once they determine the user’s age range. They could not share it with third parties other than processors, and users would have a way to appeal an age decision. The push notification limit would apply from midnight through 6 a.m.

Covered businesses would have to protect minors from certain harms and explain how they use minors’ data. The duty would apply when a covered business processes a covered minor’s data. Website or app disclosures would describe recommendation systems and features that use minors’ data, including data shared and how long it is kept. Businesses would not have to block minors from viewing media. Media content alone would not establish emotional distress, compulsive use, or discrimination under the duty of care. The attorney general would have to adopt rules on these practices by January 1, 2027, and review the rules at least every two years.