California Attorney General Publishes Proposed Regulations Implementing Social Media Addiction Law

Beginning January 1, 2027, operators of certain internet-based services will be prohibited from offering websites with "addictive feeds" or sending notifications during prohibited hours (collectively, "covered features"), unless operators: (i) have actual knowledge that the user is not a minor; (ii) have reasonably determined that the user is not a minor; or (iii) have obtained "verifiable parental consent" to do so.

On May 15, 2026, the Cal. DOJ issued proposed implementing regulations that focus on the standard for making a "reasonable determination" that a user is not a minor. The proposed regulations would require that the "reasonable determination must be made by using one or more commercially reasonable and technically feasible" age assurance methods, including:

• Biological or behavioral signals;
• Verified information other than age;
• Cryptographic techniques;
• Government-issued identification; or
• An age assurance method that satisfies ISO/IEC 27566.

The proposed regulations require the selected age assurance method to be "reasonably effective," "to perform with measurable consistency," and "be testable" with quantifiable results.

The proposed regulations also outline a few ways in which an operator's determination that a user is not a minor would be considered "not reasonable," including: (i) where the operator relies on a self-declaration that the user is not a minor; (ii) general contractual restrictions on the use of the website; (iii) use of online payment methods that are available to minors; or (iv) an age assurance method that has known or documented risks.

If the regulations are adopted, operators will also need to take reasonable actions to prevent circumvention, fraud, or misuse of their age assurance measures, and document those efforts. This would extend to considering "emerging forms of circumvention" that arise from new advances in technology, such as AI.

The proposed regulations would also establish requirements for obtaining "verifiable parental consent." Prior to seeking parental consent, an operator will need to first notify the user that they cannot provide the covered features without parental consent. Also, the operator may not seek parental consent without the user's permission (which can be revoked at any time). If the user consents, the operator must offer the parent access to "any method" that is reasonably calculated to ensure that the individual providing consent is a parent of the minor, including through the methods set forth by the federal Children's Online Privacy Protection Rule. Operators may not require the parent to create their own account, make a purchase from the operator, or submit government identification absent offering at least one other method to provide consent. Once their consent is granted, parents can revoke it at any time.

The comment period will be open through June 30, 2026.