California AB 1709 Bars Addictive Features for Users Under 16

California AB 1709 Bars Addictive Features for Users Under 16

California enacted AB 1709 on September 10, 2026, chaptering it the same day as Chapter 183, Statutes of 2026. The act adds Chapter 22.9 to Division 8 of the Business and Professions Code and bars a covered platform from providing an addictive feature to a California user under 16 years of age.

Information last verified on September 11, 2026. This is a developing story; we update it as the record changes.

Jurisdiction scope: This is California law and nothing else. Section 22682(f) defines "user" as a natural person who resides in the state and accesses or seeks to create an account on a covered platform, so the duty runs to California residents. AB 1709 does not amend federal law and does not change any other state's rules. For the separate federal proposals moving in Congress, see our explainer on what KOSA and COPPA 2.0 would require.

What Happened

The Legislature sent AB 1709 to the Governor at the end of the 2025-2026 regular session. The official history for the measure records that the Senate read the bill a third time and passed it on August 31, 2026 by a vote of 39 to 0, and that the Assembly concurred in the Senate amendments the same day by a vote of 78 to 0. The bill was enrolled and presented to the Governor at 1 p.m. on September 9, 2026. The Governor approved it on September 10, 2026, and the Secretary of State chaptered it the same day as Chapter 183, Statutes of 2026. The official status record classifies the measure as a majority-vote, non-urgency, non-appropriation bill.

Assembly Member Lowenthal introduced AB 1709 on February 4, 2026, with seven additional lead authors, Senator Stern as principal coauthor, and dozens of coauthors from both houses. The act adds Chapter 22.9 (commencing with Section 22682) to Division 8 of the Business and Professions Code, and Chapter 5.4 (commencing with Section 11530) to Part 1 of Division 3 of Title 2 of the Government Code.

Section 1 of the act is a block of legislative findings. The Legislature declares, among other things, that social media platforms are designed to maximize engagement through algorithmic recommendation, infinite scroll, autoplay and notifications, that adolescents are uniquely vulnerable to those design features, and that "current regulatory frameworks do not adequately address the addictive design of social media platforms." Findings are not operative commands, but they set out the state interest the Legislature is asserting.

What the Law Actually Says

The operative rule is two sentences long. Section 22683(a)(1) provides that "A covered platform shall not provide an addictive feature to a user who is under 16 years of age." Section 22683(b) adds that "A covered platform shall implement reasonable measures to ensure that users under 16 years of age are not provided any addictive feature on the covered platform."

Everything else in Chapter 22.9 is definitional, procedural, or remedial. Three definitions carry the weight.

Addictive feature. Section 22682(a) defines the term as "any of the following psychologically exploitative features intended to maximize engagement that foreseeably lead to compulsive use," then lists three: an addictive feed, autoplay, and any other feature designated as an addictive feature in regulations the Attorney General adopts under Section 22685. Autoplay is named in the statute itself and requires no rulemaking to be covered.

Covered platform. Section 22682(c)(1) defines a covered platform as an internet website, online service, online application, or mobile application, "including, but not limited to, a social media platform, as defined in Section 22675," that offers or provides users with an addictive feature "as a significant part of the service." The definition is expressly made "subject to regulations adopted pursuant to Section 22685." Section 22682(c)(2) excludes two categories: a site or service where interactions between users are limited to commercial transactions or to consumer reviews of products, sellers, services, events, or places; and a site or service that operates a feed for the primary purpose of cloud storage.

User. Section 22682(f) defines a user as a natural person who resides in California and accesses or seeks to create an account on a covered platform.

Two cross-references round out the definitions. Section 22682(d) borrows the meaning of "personal information" from Civil Code Section 1798.140, the definitional section of California's consumer privacy statute, which is the same definition that governs the state's broader consumer data privacy regime. Section 22682(e) borrows "social media platform" from Business and Professions Code Section 22675, the definitional section of the 2022 content-moderation transparency chapter, which requires a public or semipublic service that connects users socially and that lets them build a profile, populate a connection list, and post content other users can see.

What AB 1709 Does Not Do

AB 1709 is not an under-16 social media ban, and describing it that way misstates the statute. Section 22683(a)(2) says so directly: the prohibition "does not prohibit a covered platform from permitting a user who is under 16 years of age to create or maintain an account on the covered platform if that user is not provided with any addictive feature."

The regulated object is the feature, not the account. A covered platform that strips addictive features for under-16 users may keep those accounts open under the text of the statute. The act also does not require parental consent as an alternative route for under-16 users, does not set a minimum age for creating an account, and does not impose any duty on parents.

Two other passages in the act speak the language of a minimum age, and they are worth naming because they are the strongest textual argument against the reading above. Legislative finding (n) in Section 1 declares that "[e]stablishing a minimum age requirement for social media use is a reasonable and evidence-based measure to reduce exposure to addictive digital environments." And new Government Code Section 11530(c), in the advisory-commission chapter, defines "minimum age" to mean 16 years of age. Neither is an operative command. Legislative findings impose no duty, and no operative provision of Government Code Chapter 5.4 uses the defined term at all; that chapter creates an advisory body and nothing more. The only operative prohibition the act enacts is Section 22683, and Section 22683(a)(2) expressly contemplates under-16 accounts.

The Seven Conditions That Take a Feed Outside the Definition

Section 22682(b) is where most of the operational detail lives. It defines an "addictive feed" as a service, or a portion of one, in which multiple pieces of user-generated or user-shared media are recommended, selected, or prioritized for display, concurrently or sequentially, based in whole or in part on information provided by the user or otherwise associated with the user or the user's device. It then lists seven conditions, which apply "alone or in combination with one another," that take the feed outside the definition:

1. Non-persistent information. The information is not persistently associated with the user or the user's device and does not concern the user's previous interactions with media generated or shared by others.
2. Search terms. The information consists of search terms that are not persistently associated with the user or the user's device.
3. Settings and device signals. The information consists of user-selected privacy or accessibility settings, technical information concerning the user's device, or device communications or signals concerning whether the user is a minor.
4. Express user request. The user expressly and unambiguously requested the specific media, or media by a particular author, creator, or poster, or requested the blocking, prioritization, or deprioritization of that media. This condition carries its own carve-back: it fails if the media is also recommended, selected, or prioritized based in whole or in part on other information associated with the user or the device, "except as otherwise permitted by this chapter," and, for audio or video content, it fails if the media is automatically played.
5. Direct private messages. The media consists of direct, private communications between users.
6. Next in sequence. The media displayed is exclusively the next media in a preexisting sequence from the same author, creator, poster, or source, and, if it is audio or video, it is not automatically played.
7. Compliance. The recommendation, selection, or prioritization is necessary to comply with Chapter 22.9 or its regulations.

Condition 4 is the one that does the most work in practice, because it is what takes a feed built from accounts the user chose to follow outside the definition, and condition 6 does the same for the next item in a sequence the user already started. Both conditions cut off at the same place: if the media is audio or video and it plays automatically, neither condition applies. That tracks Section 22682(a)(2), which makes autoplay a standalone addictive feature regardless of how the feed is assembled.

Age Verification and the Account Deletion Rule

Section 22684(a)(1) requires that "Before providing an addictive feature to a user, a covered platform shall verify the age of a user pursuant to the Digital Age Assurance Act," meaning Title 1.81.9 (commencing with Section 1798.500) of Part 4 of Division 3 of the Civil Code, subject to any Attorney General regulation adopted under Section 22685.

The Digital Age Assurance Act was added by Chapter 675 of the Statutes of 2025 (AB 1043). It is effective January 1, 2026 and operative January 1, 2027 under Civil Code Section 1798.505. It works through the operating system and the app store rather than through document uploads: Civil Code Section 1798.501(a) requires an operating system provider to collect a birth date or age at account setup and to return a real-time signal placing the user in one of four brackets, under 13, at least 13 and under 16, at least 16 and under 18, or at least 18. Section 1798.501(b) requires a developer to request that signal when the application is downloaded and launched, and deems a developer that receives a signal to have actual knowledge of the user's age range across all platforms and points of access of the application, even if the developer willfully disregards it. Readers following the wider move toward age signals delivered at the operating-system and app-store layer may also want our separate coverage of the Texas app store age-verification case.

Section 22684(a)(2) supplies a fallback. If the covered platform is unable to verify age under the Digital Age Assurance Act, it "shall instead rely on the age determination with respect to the user made pursuant to subparagraph (B) of paragraph (1) of subdivision (a) of Section 27001 of the Health and Safety Code." That provision, part of the Protecting Our Kids from Social Media Addiction Act, states that commencing January 1, 2027 the operator "has reasonably determined that the user is not a minor, including pursuant to regulations promulgated by the Attorney General."

Section 22684(b) is the provision most likely to be misread. Paragraph (1) states that, except as provided in paragraph (2), "a covered platform shall delete the account of a user under 16 years of age and any personal information associated with the user of the account." Paragraph (2) then states that the subdivision "does not apply to a covered platform that permits a user under 16 years of age to create or maintain an account on the platform pursuant to paragraph (2) of subdivision (a) of Section 22683."

The exception is written at the platform level, not the account level. On the face of the text, a covered platform that permits under-16 accounts without addictive features is not subject to subdivision (b) at all. The deletion duty therefore attaches to platforms that do not take the no-addictive-feature route. Section 22684 as enacted states no deadline for completing a deletion.

Enforcement, Penalties, and Who Can Sue

Section 22686(a) provides that the chapter "shall be enforced by a civil action brought only by the Attorney General, or a local public prosecutor." There is no private right of action in the chapter, and no provision authorizing a parent, a minor, or a competitor to sue.

Section 22686(b) sets the civil penalty at up to $50,000 per affected minor for a knowing violation and up to $25,000 per affected minor for a negligent violation. Section 22686(c) directs that, in assessing a penalty, "a court shall consider the size of the covered platform, the severity and duration of the violation, and the covered platform's good faith efforts to comply with this chapter."

Section 22685 gives the Attorney General two distinct powers. Subdivision (a) is ordinary implementing-regulation authority. Subdivision (b) is broader: the Attorney General "may alter the scope of 'covered platform'" on a determination that doing so is necessary to ensure the term applies to services that make addictive features available to users under 16. Section 4 of the act is a severability clause.

The e-Safety Advisory Commission

Section 3 of the act adds Government Code Chapter 5.4. Section 11530.1(a)(1) establishes the e-Safety Advisory Commission as an independent advisory body within the Department of Justice for administrative purposes only. Section 11530.1(a)(2) states that the commission is not part of the Department of Justice for any other purpose, that it "is purely advisory," and that its advice and recommendations are not binding upon and shall not be imputed to any state agency or department.

Section 11530.1(c) fixes the membership at seven: four appointees by the Governor, one by the Senate President pro Tempore, one by the Speaker of the Assembly, and one by the Attorney General. Section 11530.1(b)(2) draws members from seven listed expertise areas: pediatrics; child, adolescent or social psychology; technology, including platform design, online safety or age assurance technologies; civil society organizations with expertise in children's online safety, online safety or public health; advocacy on behalf of marginalized youth, including youth of color, foster youth or youth with disabilities; academia or research related to child development, public health or online safety; and education, specifically K-12 education. Section 11530.1(b)(3) separately requires at least one member with experience working on LGBTQ+ civil rights or statewide public policy related to LGBTQ+ youth. Members serve at the pleasure of the appointing authority for a maximum of eight consecutive years, serve without compensation, and are subject to the Political Reform Act of 1974.

Section 11530.2(a) lists the subjects on which the commission may advise, including the effectiveness, privacy implications, accuracy and feasibility of age assurance technologies, harmful design features, and state agency rulemaking under Section 22685. Section 11530.2(b) requires the commission to report to the Legislature and the Governor on or before January 1 of each year.

When It Takes Effect

AB 1709 contains no urgency clause and no section setting an operative date. The official status record for the measure classifies it as a non-urgency bill.

That makes the default constitutional rule controlling. California Constitution article IV, section 8(c)(1) provides that, except as stated in paragraphs (2) and (3), "a statute enacted at a regular session shall go into effect on January 1 next following a 90-day period from the date of enactment of the statute." Section 8(c)(3) makes urgency statutes, election statutes, and tax-levy or usual-current-expense appropriation statutes effective immediately, and none of those describes AB 1709.

Enactment occurred on September 10, 2026. A 90-day period from that date runs into December 2026, and the January 1 next following that period is January 1, 2027. The statute itself sets no other operative date, and nothing in the text delays any individual section past that date.

How AB 1709 Fits With Existing California Law

AB 1709 amends no existing statute. Its title adds two new chapters and does nothing else, so Health and Safety Code Chapter 24 stays in force on its own terms and the new Business and Professions Code chapter operates alongside it rather than rewriting it. What AB 1709 does borrow is language. It does not write its central definitions from scratch. The definition of "addictive feed" in new Section 22682(b), including all seven conditions, tracks the definition already in Health and Safety Code Section 27000.5(a), enacted by Chapter 321 of the Statutes of 2024 (SB 976) as part of the Protecting Our Kids from Social Media Addiction Act. The "covered platform" definition in Section 22682(c), including both exclusions, tracks the "addictive internet-based service or application" definition in Health and Safety Code Section 27000.5(b).

The consequence attached to those definitions is what changes. Under Health and Safety Code Section 27001(a), an operator may provide an addictive feed to a minor if it has obtained verifiable parental consent, or if it lacks actual knowledge that the user is a minor, with a reasonable-determination standard commencing January 1, 2027. Under new Business and Professions Code Section 22683(a)(1), there is no consent route for a user under 16; the feature simply may not be provided.

Those definitions have already been litigated. In NetChoice, LLC v. Bonta, No. 25-146 (9th Cir. Sept. 9, 2025), reported at 152 F.4th 1002, a Ninth Circuit panel addressed a First Amendment and vagueness challenge to the Protecting Our Kids from Social Media Addiction Act. Two of its holdings bear on the definitional text AB 1709 copies. The panel held that the Act is not unconstitutionally vague, rejecting the arguments that the phrase "addictive feed" is standardless, that the definition is unclear as applied to follow-based feeds, that the phrases "significant part," "operates a feed" and "primary purpose" are indeterminate, and that the Act's exceptions create confusion about which services are covered. The panel also held that the challenge to the Act's age-verification requirement was unripe, reasoning that the Act did not require age verification before 2027 and that the Attorney General had not yet issued regulations defining what verification would require. Separately, the panel held that one of the Act's default-setting provisions, the like-count restriction, was likely unconstitutional and severable, and it otherwise affirmed the denial of a preliminary injunction.

Other states have taken their own routes to the same goal, and we track those separately. See our coverage of the Tennessee age-verification litigation in the Sixth Circuit and of Utah's approach to verifying a user's age.

Analysis: Why This Matters

The following is analysis from the Recording Law Editorial Team.

The most consequential thing about AB 1709 is not its headline. California already restricted algorithmic feeds for minors in 2024 through SB 976, subject to parental consent. AB 1709 keeps that statute's definitional machinery almost word for word and layers on a parallel prohibition that has no consent off-ramp for users under 16. It does not amend SB 976, so the older chapter and its consent route remain on the books; what changes is that consent no longer buys an under-16 user an addictive feature, because the new chapter bars the feature outright. The legal question a platform faces therefore shifts from "did we get a parent to agree" to "is this user under 16, and is this feature an addictive feature."

That shift puts enormous weight on the definitions, which is where the Ninth Circuit's 2025 vagueness ruling becomes relevant. The panel held that the SB 976 definitions give a person of ordinary intelligence fair notice, and it relied specifically on the exception structure in Health and Safety Code Section 27000.5(a)(4) to resolve the follow-based-feed question. Our observation, not the court's: because Section 22682(b) reproduces that same structure, the same textual reasoning describes the new chapter's definitions, although the panel was construing a different statute with a different operative rule and said nothing about AB 1709, which did not exist when it decided.

Two features of the enacted text deserve attention on their own terms. First, Section 22685(b) lets the Attorney General alter the scope of "covered platform" by regulation. That is a delegation of the boundary of the regulated class, not merely of implementation details, and Section 22682(c)(1) is drafted to defer to it. Second, the interaction of Section 22683(a)(2) and Section 22684(b)(2) creates a fork rather than a mandate: a covered platform that keeps under-16 accounts without addictive features is outside the deletion subdivision entirely, while one that does not take that route faces a deletion duty with no stated deadline.

A third point is a drafting wrinkle worth flagging as our observation. Section 22684(a)(2) sends a platform that cannot verify age under the Digital Age Assurance Act to the age determination in Health and Safety Code Section 27001(a)(1)(B). That provision is phrased around whether a user is a "minor," and Health and Safety Code Section 27000.5(d) defines a minor as an individual under 18 located in California. AB 1709's threshold is 16, and the Digital Age Assurance Act's signal brackets in Civil Code Section 1798.501(a)(2) do distinguish 13 to 16 from 16 to 18. How the fallback standard maps onto the 16-year line is a question the text leaves to the Attorney General's rulemaking under Section 22685.

We are not predicting whether AB 1709 will be challenged, by whom, or how any challenge would be resolved. Those are questions for the parties and the courts.

How This Affects You

Nothing changes today. The prohibition in Section 22683 is not operative until January 1, 2027 under the constitutional rule described above, and the Digital Age Assurance Act it relies on becomes operative the same day.

If you are a California resident under 16, or a parent of one, the statute as written does not require a platform to close the account. It bars the platform from giving that account an addictive feed or autoplay, and it lets the platform keep the account open on that basis. A platform that instead chooses not to serve under-16 users at all would be operating under Section 22684(b)(1), which directs deletion of the account and associated personal information.

If you operate an online service that California residents use, the threshold questions under the text are whether your service provides an addictive feature as a significant part of the service, whether either Section 22682(c)(2) exclusion applies, and whether any feed you run satisfies one of the seven conditions in Section 22682(b). The Attorney General's regulations under Section 22685 can change the answer to the first question, and the answers here are fact specific. This article describes the statute; it is not advice about any particular service.

If you are watching enforcement, note that only the Attorney General and local public prosecutors can bring an action under Section 22686(a), so the pace of enforcement will turn on their decisions rather than on private plaintiffs.

This is general legal information, not legal advice. It covers California law only and reflects sources verified on September 11, 2026. Laws change and this story is developing; consult a lawyer licensed in your jurisdiction about your specific situation.

Related articles

• What KOSA and COPPA 2.0 would require
• California Data Privacy Laws: CCPA, CPRA and consumer rights
• Utah's age-verification statutes
• Sixth Circuit revives the NetChoice challenge to Tennessee's law
• Supreme Court declines to block Texas app store age verification

---

Last updated: 2026-09-11. This is a developing story; details verified as of 2026-09-11.