A new California law is changing the rules governing advertising to children. The Age-Appropriate Design Code Act (“AADC”), signed into law on September 15, 2022, is a landmark privacy bill that will impose new requirements upon online companies. The AADC is modeled after the United Kingdom’s code, each bearing the same name.

Effective July 1, 2024, the California AADC applies broadly to online services, products and features that are “likely to be accessed by children.” It requires these online providers to refrain from taking any actions that are “materially detrimental to the physical health, mental health, or well-being of a child.” The new law is anticipated to have a significant impact on gaming and advertising companies alike that utilize children’s data.

Developments in Children’s Advertising

According to the Washington Post, Roblox announced that it plans to begin advertising to users ages 13 and older within its metaverse space.  Roblox operates as a host platform that allows users to both create and participate in user-designed games within the massively multiplayer online world, boasting over 52.2 million daily active users.  Of these users, it is reported that nearly half are 13 years old or younger.

Roblox’s decision to begin advertising to 13-year-olds and up is not mere coincidence. The Children’s Online Privacy Protection Act (“COPPA”) is the primary federal law regulating children’s online privacy, applying only to children under the age of 13. COPPA established a more narrow knowledge requirement, meaning that companies must comply with COPPA requirements only where the company has “services directed to children” or has “actual knowledge that such information was collected from a child.” See 16 U.S.C. § 6501 (4)(B).

Now, Roblox and companies with similar user demographics need to consider the ramifications of the California AADC on their data practices when dealing with children users.

AADC as Measured Against COPPA

As mentioned, the AADC has a much broader scope than COPPA in that it applies to services and products likely to be accessed by a child. Further, California’s AADC goes a step beyond COPPA protection by defining “children” as anyone under the age of 18. However, the AADC only applies to “businesses” as defined under the California Privacy Rights Act[1] (“CPRA”): a for-profit organization that either (i) has an annual gross revenue of more than $25 million; or (ii) buys, receives for commercial purposes, sells or shares for commercial purposes the personal information of more than 100,000 consumers, or (iii) derives 50% or more of its annual revenue from selling consumers’ personal information. See Cal. Civ. Code § 1798.140(d).

Broadly speaking, COPPA essentially requires that companies who direct services at children or know it is collecting personal information from children under the age of 13 must first obtain verified parental consent and post a privacy policy to their website. Comparatively, the California AADC prohibits companies from employing a variety of advertising tactics upon children where it would be detrimental to the child’s overall health. It also restricts companies from profiling younger users for targeted advertising  purposes and disallows the use of ‘dark patterns’ to lure or encourage children into disclosing personal information.

Under the AADC, companies must also complete Data Protection Impact Assessments for each new service or product to address the use of children’s data and potential detriment to a child’s well-being as a result. Unlike COPPA, companies who fall under the AADC cannot obtain parental consent to legitimize their collection and use of children’s data if it poses a risk of detriment to these children. For the full text of the California AADC, click here. 

Future of Advertising under California AADC

The AADC has widely been hailed as one of the most expansive privacy laws in the United States. The passage of California’s AADC means that Roblox, a product used prominently by children under the age of 18, must be vigilant in its new advertising efforts where California-resident users are concerned.

Certainly, the AADC complicates matters for companies as it relates to data privacy and their interaction with children on the internet. It remains to be seen if Roblox will move forward with its advertising plans in light of the this new law. In the interim, additional guidance on how companies can become compliant is still forthcoming from the California Attorney General.

For more information about the California AADC, check out our recent post summarizing the new law’s key components.

[1] The CPRA becomes effective January 1, 2023, amending and supplanting its predecessor, the California Consumer Privacy Act. As of the effective date of the AADC, the CPRA’s new thresholds will be the current controlling definition for covered entities under California law.