On September 10, 2026, Governor Gavin Newsom signed a large children's online-safety package. EFF counts 12 bills, and the governor's own release lists 13. The bills cover companion chatbots, child sexual abuse material reporting, student data, age-verification signals and school curricula. The most consequential is AB 1709. It is a good example of a law with a defensible core and an enforcement mechanism that undercuts it.
The strongest case for AB 1709
Supporters have a serious argument. Feeds tuned to maximize engagement are a product-design choice, not speech that anyone chose to author, and adolescents are plausibly more susceptible to compulsive-use patterns than adults. A legislature that regulates product features, not content, has a better claim to constitutional footing than one that regulates ideas. Common Sense Media, which applauded the signing, is right that voluntary industry fixes have been slow.
The bill text works this way. It prohibits covered platforms from providing "addictive features" to users under 16. Those are algorithmic feeds, autoplay and other features the Attorney General defines in regulations, each "intended to maximize engagement" in ways that "foreseeably lead to compulsive use." Civil penalties run up to $50,000 per affected minor for knowing violations and up to $25,000 for negligent ones. It also creates a seven-member e-Safety Advisory Commission inside the Department of Justice.
Where the design breaks down
The rule cannot be enforced without knowing who is under 16. Platforms must verify age through California's Digital Age Assurance Act or alternative methods. If they cannot verify a user under 16, they must delete the account and its associated personal data. In practice a platform that wants to avoid per-minor penalties has every incentive to check everyone. EFF warns that this means "invasive age-verification methods, such as requiring government IDs or biometric scanning." It says these create "massive honeypots of sensitive personal data" and damage online anonymity. Adults bear that cost too, even though the law is aimed at minors.
The category of "addictive feature" is too elastic. EFF argues that the covered inputs include basic signals such as who a user follows or what posts they like, tools that services use to surface relevant user-generated content. A rule that treats a recommendation system as inherently exploitative sweeps in the mechanism by which teenagers find a queer support community, a religious group or a political campaign. Delegating the remaining definitions to regulations adds uncertainty for smaller platforms, which cannot absorb per-minor penalty exposure the way the largest companies can.
The trade-off falls hardest on the most vulnerable teens. In the EFF press release, Jordan Wilson of COLAGE said AB 1709 strips LGBTQ+ youth of "the ability to meet and build community with one another on the internet." Evan Greer of Fight for the Future said such bans "make kids less safe, while undermining privacy and freedom of expression for everyone." Those are advocates' claims, not measured outcomes. But the burden of proof should rest with the state when it restricts access to lawful speech, and the record for age-gating as a safety tool is thin.
What the same package gets right
The signing day was not uniformly bad news. EFF supported two bills in the package. AB 2071 integrates digital wellness into middle and high school health curricula, teaching students to identify unhealthy tech habits, protect their personal safety and evaluate digital content, including AI-generated media, for credibility and bias. It was co-authored by students. AB 2298 adds cybersecurity concepts to recommended school curricula so young people can safeguard their personal data.
These bills address the same harms as AB 1709: compulsive use, manipulation and data exposure. They do it by building capability instead of restricting access, and they impose no identity checks on anyone. Literacy education also has a design advantage. It applies to every platform, including ones that do not exist yet, without a regulator having to define "addictive" in advance.
A proportionate path forward
The evidence-based response is not to abandon design rules for minors. It is to separate them from universal identity verification. Three principles would help:
- Regulate specific, testable features. Defaults such as disabling autoplay or overnight notifications for minors can be audited without collecting government IDs.
- Minimize the data. If age assurance is unavoidable, it should rely on privacy-preserving signals processed on-device and deleted after use. The advisory commission's mandate should prioritize this.
- Measure before expanding. The commission's annual reports to the Legislature and Governor should include evidence on whether the law reduced harm and what it cost in access and privacy.
California has shown that it can pair a restriction with education programs that work. The open question is whether the restriction survives scrutiny and whether the state will collect the data to find out. Until then, AB 1709 is a costly experiment, and its costs land on adults and vulnerable teens alike.