California has spent two years writing rules for how technology companies treat children, and for most of that time the argument has been about disclosure. Warning labels. Parental controls. Settings buried three menus deep that a determined parent could eventually find.
The package Governor Gavin Newsom signed on September 10 does something different. It attaches a number to a harmed child, and the number is $1 million.
That single provision has done more to focus attention than the other eleven bills combined, and it deserves a closer look than the headline allows, because what it actually changes is not the size of the penalty. It is who has to prove what.
Quick facts
- Newsom signed the package in Marin County on September 10, 2026, alongside First Partner Jennifer Siebel Newsom and a bipartisan group of legislators
- AB 2, by Assemblymember Josh Lowenthal, sets civil penalties of up to $1 million per child injured
- SB 1119, known as “Adam’s Law,” is named after Adam Raine and covers companion chatbots
- Platforms may no longer serve users under 16 autoplay or algorithmic feeds built from user history and profile data
- Adam’s Law is the first in the country to require independent child safety audits and annual risk assessments
- Twelve bills were signed in total, covering chatbots, feeds, age signals, school devices and student data
- Meta has publicly objected, arguing personalization is how it keeps teen content age appropriate
What the $1 million actually attaches to
AB 2 is listed in the governor’s own summary under a deliberately dry title: “Injuries to children: civil penalties.” That phrasing is the whole story. The bill does not fine a company for running a bad algorithm, or for failing to file a report, or for missing a compliance deadline. It creates an exposure that scales with the number of children a platform is found to have injured.
Regulatory fines in this space have historically been flat. A company breaks a rule, the regulator issues a penalty, the company treats it as a line item and moves on. Per-child liability behaves differently, because the arithmetic gets frightening quickly. A platform with a few hundred substantiated cases is looking at a nine-figure problem, and a platform with a few thousand is looking at something that shows up in an earnings call.
The catch, and it is a real one, is the word “injured.” Establishing that a specific child was harmed by a specific product, as opposed to harmed by adolescence, is the same evidentiary problem that has bogged down years of litigation against social platforms. California has not solved that problem. It has raised the payoff for solving it, which is a different thing, and which is why the next few years of this law will be decided in courtrooms rather than in Sacramento.
The twelve bills, sorted
The $1 million figure travels well on social media, but the package is broader than one bill, and some of the quieter items are likely to change more products faster.
Adam’s Law is the one most likely to be copied elsewhere. It is named after Adam Raine, and it requires companion chatbot operators to build crisis protocols for suicidal ideation, offer parental controls, and notify a parent when a child switches a safety setting off. It also becomes the first American law to require companies to submit to independent child safety audits and file annual risk assessments, which moves chatbot safety out of the realm of blog posts and into the realm of paperwork somebody can subpoena.
Washington has been circling the same territory without landing on it. When the Senate advanced its own set of AI chatbot bills for minors earlier this year, privacy advocates split over whether age checks would end up collecting more data on children than they protected. California’s version sidesteps part of that fight by regulating what the product does after a child is already using it, rather than trying to keep children out at the door.
The feed rules are the ones platforms will feel first
The under-16 provisions are narrower than the coverage suggests, and narrower is not the same as weaker. Platforms are barred from serving minors autoplay and from serving them algorithmic feeds assembled from user history and profile data. A feed built from what a teenager follows is still allowed. A feed built from what a teenager cannot stop watching is not.
That distinction tracks what researchers have been finding. In one study, scientists put people in an MRI scanner and watched short video feeds suppress activity in the regions handling self-control. The mechanism being regulated is not the content. It is the delivery.
Meta’s objection, in its own words
Company spokesperson Jim Cullinan said personalization is “an important part of what makes Facebook and Instagram valuable for teens as they connect with family and friends and explore their interests,” and added that “personalization is also how we deliver age-appropriate content for teens that is relevant to them, all with the proper guardrails in place.”
It is a genuinely two-sided argument. Ranking is how a platform buries the worst of what it hosts as well as how it surfaces the most compulsive. A chronological feed for a 14 year old is not automatically a safer feed.
How California compares to everyone else
Three broad approaches have emerged internationally, and California has now committed to the one that is hardest to enforce and hardest to evade.
| Approach | Who uses it | What it targets | Main weakness |
|---|---|---|---|
| Age bans | Australia, UK proposals | Access itself, below a set age | Depends entirely on age verification working |
| Warning labels | Several US states | User awareness at login | Changes almost nothing about the product |
| Design liability | California, September 2026 | Specific mechanics plus per-child penalties | Requires proving a named child was injured |
Australia and the United Kingdom have leaned toward keeping younger users off platforms entirely. That is clean to describe and messy to implement, and it runs straight into the identity problem: verifying that a user is over a threshold usually means collecting a document from every user, including the adults. American lawmakers have been fighting the same battle since proposals to push age verification down to the app store layer started moving through statehouses.
California’s new rules regulate how a feed is assembled for users under 16, not what those users are allowed to see. Photo via Pexels.
What happens between now and the first lawsuit
Two things are worth watching, and neither is the penalty number.
The first is whether the design rules survive contact with the courts. California’s earlier attempt to restrict addictive feeds for minors has spent much of its life tangled in litigation from industry groups arguing that ranking decisions are protected expression. The new package is written more carefully, and it splits its bets across twelve bills rather than one, which means a loss on any single provision does not take the rest down with it. That structure looks deliberate.
The second is what compliance actually looks like in a product. A platform that has to run one feed algorithm for adults and a materially different one for anyone under 16 needs to know, with confidence, which users are under 16. That pulls age assurance back into the picture through the side door, which is precisely the fight California just avoided having directly.
Newsom framed the signing in the language of consumer safety rather than speech, comparing the state of children’s technology to cribs and car seats sold before anyone required them to be safe. “Innovation comes with responsibility,” he said, “and protecting our children comes first.” First Partner Jennifer Siebel Newsom put it as wanting technology that “supports their wellbeing, rather than exploits their vulnerabilities.”
That framing is the real strategic move here. Product liability is a body of law with a century of precedent behind it, and it is considerably less friendly to platforms than the speech arguments they have been winning with. California did not just raise the fine. It picked a different courtroom to fight in.
