agosto 04 2026

Children’s Privacy Mid-Year Update: Key Legislative Developments and Emerging Trends for Businesses

Authors:

The landscape of children’s and teens’ privacy and online safety regulation continues to evolve at a rapid pace. In the absence of comprehensive federal legislation, state legislatures are driving a patchwork of privacy protections, spanning age verification mechanisms, social media restrictions, addictive design prohibitions, and data minimization requirements. Meanwhile, litigation is emerging as a critical gatekeeper determining which of these enacted laws actually take effect. This Legal Update summarizes the key mid-year legislative developments and emerging trends that businesses should continue to monitor. For an in-depth review of the privacy landscape for children and teens, please see our previous Legal Update.

State Legislatures as Primary Driver

State legislatures remain the primary engine of children’s privacy and online-safety regulation. As of the time of writing, state activity has clustered around four principal categories: social media access and design restrictions; age-appropriate design code obligations; app-store or device-level age-assurance requirements; and harmful-content age-verification laws.

The most active category remains social media and online-safety legislation. As of July 2026, 21 states have passed social media laws regulating minors’ use of online platforms. Separately, five states have enacted standalone age-appropriate design code legislation, including California AB 2273, Maryland HB 603, Nebraska LB 504 as amended by LB 838, Vermont S.69, and South Carolina HB 3431 (effective February 5, 2026); and three states have enacted comparable minor-specific privacy duties through broader privacy statutes, including the Connecticut Data Privacy Act (SB 3 as amended by SB 1295), Colorado SB 24-041, and Montana SB 297.

States also continue to experiment with infrastructure-level approaches. Four states have enacted App Store Accountability Acts, with Alabama HB 161 (effective January 1, 2027) as the most recent. As of the date of this update, 26 states had enacted age-verification laws targeting minors’ access to harmful content, with West Virginia HB 4412 (effective June 12, 2026) and Iowa HF 864 (effective July 1, 2026) among the most recent.

At the federal level, several bills remain pending but none have yet been enacted, including the KIDS Act (HR 7757), which passed the House on June 29, 2026, while COPPA 2.0 (HR 6291) passed the Senate by unanimous vote earlier this year, and now awaits further House action. Other pending proposals include the Don’t Sell Kids’ Data Act (HR 6292), the RESET Act (HR 6488), the Algorithmic Transparency and Choice Act (HR 6253), the Safe Messaging for Kids Act (HR 6257), and the GUARD Act (S 3062). The Senate Commerce Committee is also expected to conduct a markup of several privacy and online safety-related bills on July 29, including the Kids Online Safety Act. The absence of enacted federal legislation means that, for now, businesses must continue to navigate a complex, state-by-state compliance landscape.

Age Verification as a Core Requirement

Age verification has emerged as a cross-cutting regulatory obligation across multiple categories of minor safety laws. Social media laws increasingly incorporate age verification as a prerequisite for minors’ access. Among others, Minnesota HF 4138 (effective July 1, 2027) amended the state’s social media transparency act to add age-verification requirements, and South Carolina HB 4591 (effective January 1, 2027) requires age verification for minors. App Store Accountability Acts additionally require app stores to conduct commercially reasonable age verification.

A notable new frontier is AI chatbot regulation. The federal GUARD Act (S 3062) would require “AI companions” to use reasonable age verification. At the state level, Idaho SB 1297, Oregon SB 1546, and Nebraska LB 525 have enacted or introduced legislation requiring age verification for AI chatbot interactions with minors. Businesses deploying conversational AI products should closely monitor this emerging category, particularly where products are designed to simulate companionship and engage with minors.

In addition to the harmful-content laws already in force, eight additional states have pending age-verification legislation for harmful content, including Ohio HB 84, Michigan SB 191, and Pennsylvania SB 603. These harmful content laws are largely limited to websites, apps, or portions of services on which a substantial share of the content is pornographic or sexual material harmful to minors.

Litigation as a Gatekeeper to Implementation

Litigation has become a critical gatekeeper between enactment and enforcement of minor online safety laws. The result is a dynamic enforcement landscape in which the legal validity of enacted statutes can shift rapidly based on circuit-level decisions.

In March, the Ninth Circuit issued a mixed ruling in NetChoice, LLC v. Bonta, 170 F.4th 744 (9th Cir. 2026), vacating the preliminary injunction against the California Age-Appropriate Design Code Act (CAADC) age-estimation requirements, while affirming the enjoinment of the CAADC’s dark pattern and data use provisions on vagueness grounds.

In a separate challenge to California’s Protecting Our Kids from Social Media Addiction Act (SB 976), the Ninth Circuit in NetChoice, LLC v. Bonta, 152 F.4th 1002 (9th Cir. 2025) affirmed the district court’s ruling that parental consent can be required for minors to access “addictive” (i.e., personalized) feeds. It reversed the district court on engagement counts (e.g., likes, comments) and held this to be unconstitutional. It also held that the challenge to the statute’s age-verification provisions was unripe because those provisions do not take effect until January 1, 2027. Following this decision, several prominent social media and technology companies filed individual as-applied challenges to this law, which are still pending in the district court.

In Texas, the Fifth Circuit stayed a lower court injunction against the App Store Accountability Act on June 4, 2026, allowing the law to take effect pending appeal. The Supreme Court subsequently declined to block the law on an emergency basis, meaning the Texas law remains in effect while the appeal continues. Separately, the Sixth Circuit vacated a permanent injunction against Ohio’s social media law on June 18, 2026, which would make it enforceable (although NetChoice has asked for en banc reconsideration).

Separately, Tennessee’s Protect Tennessee Minors Act (HB 1614/SB 1792), a harmful-content age-verification law directed at websites with a substantial portion of material harmful to minors, remains enforceable after the Sixth Circuit stayed the district court’s preliminary injunction.

Across US jurisdictions, social media and related minor online safety laws currently exist in varying degrees of enforceability:

Connecticut SB 3, as amended by SB 1295, and Puerto Rico P. de la C. 262 are fully enforceable without record of being challenged;
Florida HB 3, Mississippi HB 1126, Ohio HB 33, and Tennessee HB 1891 are on appeal but not currently subject to operative injunctions;
Texas HB 18, California SB 976, and Nebraska LB 383 are partially enjoined but still in litigation; and
Arkansas SB 396, SB 611, and SB 612, Colorado HB 24-1136, Georgia SB 351, Louisiana SB 162, Utah SB 194, and Virginia SB 854 remain at least partially enjoined pending appeals. Businesses should closely track appellate decisions that may shift this landscape on short notice.

Evolution Beyond COPPA Concepts

Minor safety laws are continuing to move beyond the Children’s Online Privacy Protection Act (COPPA) framework of parental consent-based protections toward broader, more prescriptive restrictions. Several key areas illustrate this evolution:

Targeted advertising restrictions: Oregon HB 2008 (effective January 1, 2026) amended the state’s Consumer Privacy Act to restrict targeted advertising directed at minors and prohibit the sale of minors’ personal data. New Hampshire HB 1460 (effective January 1, 2027) similarly prohibits the sale of minors’ data.
Geolocation and communications controls: The federal Safe Messaging for Kids Act (HR 6257) would require (if passed) direct messaging controls for minors on social media platforms, while California SB 976 and Indiana HB 1408 include protections limiting communications from non-connected users to minor accounts such as setting a minor’s social media account to private mode by default.
Enhanced parental controls and reporting tools: App store accountability acts incorporate parental control requirements, while social media laws such as Ohio’s Parental Notification by Social Media Operators Act require platforms to obtain verifiable parental consent and send written confirmation of that consent to the parent or guardian.
Data minimization, platform design, and user controls: While earlier age-appropriate design codes such as the CAADC focus on minor privacy and risk-assessment obligations, recent age-appropriate design codes have evolved into broader online-safety and platform-design laws that include direct prescriptions of platform and feature requirements. Pending state bills, such as Michigan SB 758, include requirements comparable to existing state age-appropriate design codes.
Algorithmic transparency: The federal Algorithmic Transparency and Choice Act (HR 6253) would require platforms to disclose recommendation policies and provide options regarding personalized recommendations to minors. Collectively, these developments signal a legislative trajectory toward comprehensive, affirmative obligations on businesses that go well beyond notice-and-consent.

Key Takeaways for Businesses

Businesses operating digital platforms, apps, or services accessible to minors should take note of several practical implications.

Navigating a Patchwork of Laws: The state-by-state nature of this regulatory landscape requires a multi-jurisdictional compliance strategy.
Age Verification: Age-verification and age-assurance requirements are becoming more common in harmful content laws that target adult-content websites and apps and may reach other products and services, such as those relating to social media, app distribution, or AI chatbots. Businesses should assess applicability by product/service type and jurisdiction.
Litigation Moves Goalposts: The litigation environment means that compliance obligations can shift quickly. Businesses should monitor appellate dockets alongside legislative calendars.
Cross-Functional Support: Compliance programs should coordinate with cross-functional teams to address product design, algorithmic transparency, and safety features.
Beyond COPPA: What’s Coming Next: Businesses should anticipate that children’s data protection obligations will continue to expand beyond the COPPA framework toward prescriptive restrictions on advertising, data sales, and platform design.