California on track to pass tough internet privacy rules for kids

What's happening: The proposal, AB2273, the California Age Appropriate Design Code, is poised to pass the state Senate and Assembly this week and then move onto Governor Gavin Newsom's desk for signature, sources following the proposal told Axios.

• Newsom has not publicly commented on the bill. He recently rolled out a new plan aimed at increasing access to mental health services for youth in California.

Details: The California proposal resembles new rules passed last year in the U.K. that govern how tech firms can target kids with push notifications, require messaging controls, and provide other features intended to keep minors safe online.

• The bill, which includes hefty fines for noncompliance, puts California's attorney general in charge of enforcement. One tech industry win is an amendment that gives potential violators a "cure" period of 90 days before any fines.

The California bill targets online services "likely to be accessed by children" under 18.

• Industry reps pushed unsuccessfully for that age to be lower.
• The U.S. law governing children's online privacy, COPPA, applies to sites specifically targeted to children and protects those under 13.

What they're saying: "While this bill has improved, we remain concerned about its unintended consequences in California and across the country," Dylan Hoffman, TechNet's California executive director, told Axios. TechNet represents tech firms like Amazon, Apple, eBay, Google, Meta and Snap.

• "It's another example of why we need a federal privacy law that includes universal standards to protect kids online instead of a patchwork of state laws that creates confusion and compliance complications for businesses," Hoffman said.
• "We’ve been working with stakeholders including industry representatives throughout the legislative process and have made every effort to address their practical concerns without watering down the protections the bill would provide to youth,” Nichole Rocha, a former California legislature privacy employee who's now head of U.S. Affairs for 5Rights Foundation, sponsor of AB 2273, told Axios.
• One industry lobbyist familiar with the situation described the current text of the bill, which is likely to be its final form, as not perfect, but a "workable standard [companies] can start thinking through."

The other side: Bill opponents say a major component of AB2273, age authentication via "estimating the age of child users," is overly burdensome and invasive for users.

• "[AB2273] would erect digital barriers throughout the Internet for everyone; drive some businesses out of the industry entirely; expose everyone, including children, to greater privacy and security risks; strip vulnerable users of access to sensitive information they need; create chilling effects that discourage critical and whistleblower content; shrink the Internet for California minors; and put California minors at a permanent professional disadvantage," Eric Goldman, a law professor at Santa Clara University Law School, wrote in a August 22 op-ed.

By the numbers: Tech and other groups have been lobbying in the 2021-22 California legislative session on AB2273, per state filings viewed by Axios.

• Amazon spent $211,124 lobbying the California legislature in the 6th quarter of the 2021-22 session, including on AB2273. Sources familiar with lobbying around the bill tell Axios Amazon is especially concerned about the impact of AB2273, especially its age component.
• TechNet spent $458,428 in California lobbying in 2021-22, including on AB2273. Also for 2021-22 in California, including on AB2273, TikTok spent $37,500; the News Media Alliance spent $20,000; Snap spent $190,000; Google spent $47,000 and Twitter spent $16,000.

What's next: The bill will be voted on in the state Senate as early as Monday and is expected to pass the assembly quickly after. If signed by Newsom, the law would take effect July 1, 2024.