){kind=logo}
Hashed & Salted | A Privacy and Data Security Update
While Congress continues to try—and fail—to enact children’s privacy legislation, and the Federal Trade Commission (FTC) refines its enforcement approach to children’s privacy cases and its newly amended Children’s Online Privacy Protection Act (COPPA) Rule (read our recap of significant federal children’s privacy developments here), the states continue to enact new children’s privacy legislation. Beyond a few general privacy laws, states have been focused on app store accountability acts, age-appropriate design codes, and laws regulating children’s and teen’s access to social media and interactive services. While states across the map have passed more than two dozen of these laws, much of this legislation has been challenged and some has been enjoined.
App Store Accountability Acts
App store accountability acts require app stores to verify a user’s age category and obtain verifiable parental consent before a minor can download an app, purchase an app or make an in-app purchase. In addition, app developers must notify app stores if they make significant changes to an app, in order to allow the app stores to notify users of changes and obtain renewed verifiable parental consent for a minor’s continued use of the app. To date, four states have passed app store accountability acts, and so far none of them is effective. Below is a chart showing the status of the state app store accountability acts.
| State | Status | |
|
Texas |
Preliminary injunction entered prior to the law becoming effective on Jan. 1, 2026. Texas appealed the preliminary injunction, which the Fifth Circuit stayed on May 28, pending the appeal. Emergency petitions for vacate the Fifth Circuit’s stay order are pending with the Supreme Court. |
|
|
Utah |
The law had an effective date of May 6, 2026. The Computer & Communications Industry Association filed a preliminary injunction motion to enjoin the law. During the briefing, the law was amended to remove the ability for Utah to enforce the law, leaving only the private right of action. Based on that change, the parties agreed to a voluntary dismissal of the case (read our Quick Take here). The amendment makes the bulk of the bill effective on May 6, 2027. (NOTE: Unlike other app store accountability acts, the amendment makes the age verification requirements applicable not only to new accounts but also to existing accounts.) |
|
|
Luisiana |
The law had an effective date of July 1, 2026, but the Louisiana governor signed a bill delaying the effective date until July 1, 2027. | |
| Alabama |
Effective Jan. 1, 2027. (NOTE: The Alabama app store accountability act also applies to both new and existing accounts.) (Read our Quick Take here.) |
|
In addition to the app store accountability laws listed above, California passed its Digital Age Assurance Act (AB 1043) in October 2025. Unlike app store accountability acts, California’s Digital Age Assurance Act applies to operating systems providers, which are required to collect user ages and provide user age signal information. Application developers are required to request the age signals, which will give them actual knowledge of their users’ ages, potentially triggering children’s privacy protections.
Age-Appropriate Design Codes
Several states have passed age-appropriate design codes. Not many of them have gone into effect, however, either because the laws have been challenged or because the laws had longer periods between enactment and effective dates. That is now changing.
First, on March 12, the Ninth Circuit issued its latest opinion in NetChoice, LLC v. Bonta, partially affirming and partially vacating the district court’s preliminary injunction of the California Age Appropriate Design Code Act (CA ADCA). The Ninth Circuit held that NetChoice — a trade association representing major tech companies —failed to establish likely success on facial challenges to the CA ADCA’s coverage definition, age estimation requirement and data use provisions, effectively allowing those portions to go into effect. The court did affirm the injunction of the dark patterns restrictions, however. The cases is now back in the district court for further consideration.
Second, South Carolina passed an age-appropriate design code that went into effect immediately, on Feb. 5. NetChoice filed a challenge almost immediately, on Feb. 9 (NetChoice v. Wilson), but no injunction has been entered.
Finally, Vermont’s Age Appropriate Design Code (which appears to apply even if only 2% of a company’s audience is under the age of 18) takes effect on Jan. 1, 2027. Below is a short summary of the status of the age-appropriate design codes and their key requirements.
Age-Appropriate Design Codes Key Requirements
| State | Status | Highlights of Requirements | |
|
California Age-Appropriate Design Code Act (AB 2273) |
Effective July 1, 2024 Partially enjoined |
The following requirements survived injunction: - Child is under 18 - Required age-estimation technologies - Request obvious signal to the child when the child is being monitored or tracked - Obvious sign to the child for the duration of the online service’s collection of precise geolocation information - Provide prominent, accessible and responsive tools to help children and their parents exercise their privacy rights - Limitations on the collection, sale or sharing of any precise geolocation information of a child |
|
|
Maryland Age-Appropriate Design Code (SB 0571/HB 6063) |
Effective Oct. 1, 2024 Challenged but no injunction entered |
- Child is under 18 - Limitations on the collection, sale or sharing of personal information - Prohibitions against dark patterns |
|
|
Connecticut (SB 5 and SB 1295) |
SB 5 – Effective Oct. 1, 2024 SB 1295 – Effective July 1, 2026 |
- No minimum business threshold - Child is under 13; minor is under 18 - Must use reasonable care to avoid any heightened risk to minors - Limitations on profiling and sharing of personal information |
|
|
Colorado (SB 041) |
Effective Oct. 1, 2025 |
Similar to Connecticut |
|
|
Montana (SB 297) |
Effective Oct. 1, 2025 |
- Minor is under 18 - Must use reasonable care to avoid a heightened risk of harm to a minor - Limitations on collecting and processing minors’ data |
|
| South Carolina |
Effective Feb. 5, 2026 Challenged by NetChoice on Feb. 9 (NetChoice v. Wilson); no injunction entered |
- Minor is under 18 - Applies to services reasonably likely to be accessed by minors - Must use reasonable care in the use of minors’ personal data and the design features - Must have easy-to-use privacy tools - Default protections for minors - No data protection impact assessment (DPIA) required |
|
|
Nebraska Age-Appropriate Online Design Code Act (LB 504) Amended by LB 838 |
Effective Jan. 1, 2026 Amendment effective July 17 (read our Quick Take here) |
- Child is under 18 - Limitations on collection and use of personal information - Prohibition against dark patterns - DPIA required under Nebraska Data Privacy Act - Required default settings - Recent amendment significantly expanded scope. Previously only applied to companies that “derive at least 50% of their annual revenue from the sale or sharing of consumers’ personal data.” That requirement was removed. |
|
| Vermont Age-Appropriate Design Code (S 69) | Effective Jan. 1, 2027 |
- No minimum business threshold - Applies to all businesses reasonably likely to be accessed by minors (appears to have 2% threshold) - Child is under 18 - Owe a reasonable duty of care to ensure access will not result in (1) reasonably foreseeable emotional distress, (2) reasonably foreseeable compulsive use of the service or (3) discrimination against a covered minor - Prohibition against profiling and limitations on collecting and sharing - Required default privacy settings |
|
General Children’s Privacy Laws
Two states have passed general children’s privacy laws. New York’s Child Data Protection Act went into effect on June 20, 2025, and prohibits operators of online services from processing the personal data of minors ages 13 – 17 without informed consent from the minor unless doing so is strictly necessary for the service (read our client alert here). The Arkansas Online Privacy Act will be effective on July 1. This law extends many COPPA protections to teens under the age of 17.
Social Media/Interactive Services
As quickly as states have passed laws regulating minor use of social media, the laws have been challenged by NetChoice.—. While NetChoice previously had enjoyed a tremendous amount of success challenging these laws, it has started to lose some of these challenges or the appellate courts are staying the NetChoice injunctions. Therefore, some of these laws are now going into effect. While we have not seen much enforcement of these laws during these challenges, the Florida attorney general—who was able to win his appeal to halt the NetChoice injunction—has vowed to aggressively enforce the law as soon as possible. Additionally, in early 2026 a major social media addiction lawsuit went to trial, testing the limits of platform liability for harms to children.
Below is a chart describing the status of the social media/interactive services laws with a list of the general requirements that are currently in effect.
NOTE: Virginia’s social media law (SB 854), which took effect Jan. 1 and imposed a one-hour daily time limit on social media use by minors under 16, was enjoined on Feb. 27 in NetChoice v. Jones. The court held that NetChoice was likely to succeed on its First Amendment claims. Virginia is currently appealing the preliminary injunction.
Social Media Laws Affecting Minors
| State | Status | General Requirements | |
|
Arkansas Social Media Safety Act (SB 396) |
Permanent injunction Appealed and pending before the Eighth Circuit |
|
|
|
Arkansas Amend Social Media Safety Act (Act 900/SB 611) |
Preliminary injunction granted on April 20, 2026 |
||
|
Arkansas Regulation of Social Media Platforms (Act 901 of 2025) |
Preliminary injunction granted on Dec. 15, 2025 |
|
|
|
California Protecting Our Kids from Social Media Addiction Act (SB 976) |
Effective Jan. 1, 2025 Preliminary injunction issued by district court; Ninth Circuit partially affirmed and partially reversed the district court’s opinion Nov. 6, 2025 – Ninth Circuit denied petition for rehearing en banc |
The following provisions of the act are effective based on the Ninth Circuit’s ruling: - Social media companies must receive parental consent before minors can receive “addictive feeds” - Minor accounts must have “private mode” default settings |
|
|
Colorado Healthier Social Media Use by Youth (HB 24-1136) |
Effective Aug. 8, 2024 Preliminary injunction granted on Nov. 6, 2025, in NetChoice v. Weiser Appeal pending before the Tenth Circuit |
||
| Florida Online Protections for Minors (HB 3) |
Effective Jan. 1, 2025 CCIA & NetChoice v. Uthmeier Preliminary injunction granted by district court on June 3, 2025; Eleventh Circuit granted Florida’s request to halt preliminary injunction |
- Prevents a minor younger than 14 years of age from becoming a social media account holder - Requires parental consent for 14- and 15-year-olds to have a social media account - Allows the parent to terminate the account of 14- and 15-year-olds |
|
|
Georgia Protecting Georgia’s Children on Social Media Act (SB 351) |
Effective July 1, 2025 Preliminary injunction granted on June 26, 2025, in NetChoice v. Carr Eleventh Circuit asked to review |
||
| Louisiana Secure Online Child Interaction and Age Limitation Act (SB 162) |
Effective July 1, 2025 Dec. 15, 2025 – Law blocked by summary judgment in NetChoice v. Murrill |
|
|
| Mississippi Walker Montgomery Protecting Children Online Act (HB 1126) |
Effective July 1, 2024 NetChoice v. Fitch June 18, 2025 – District court enjoins law July 17, 2025 – Fifth Circuit grants Mississippi’s request to stay preliminary injunction July 21, 2025 – Supreme Court denies emergency motion to lift stay Feb. 2, 2026 – Fifth Circuit hearing on appeal of preliminary injunction |
Digital service providers must: - Use reasonable age verification method - Require express parental consent for minors (under 18) to create a social media account - Limit collection and use of personal data from minors - Develop strategies to prevent or mitigate minors’ exposure to harmful material |
|
| Nebraska Parental Rights in Social Media Act (LB 383) |
Effective July 1, 2026 NetChoice v. Hilgers Filed in a district court on May 14, 2026 |
- Social media companies must use reasonable age verification methods - Minors can only become account holders if the minor’s parent provides express consent - Social media companies must provide tools to allow parents to monitor a minor’s account |
|
| New York Stop Addictive Feeds Exploitation (SAFE) for Kids Act |
Proposed rules released on Sept. 15, 2025 Law will go into effect 190 days after final rules released |
Prohibits covered operators from: - Providing an addictive feed to a user unless the covered operator has used commercially reasonable and technically feasible methods to determine that the user is not a covered minor or has obtained verifiable parental consent - Sending notifications concerning an addictive feed to a covered minor between the hours of midnight and 6 a.m. unless the covered operator has obtained verifiable parental consent |
|
| Ohio Parental Notification by Social Media Operators Act (HB 33) |
Effective Oct. 3, 2023 NetChoice v. Yost Preliminary injunction entered Jan. 8, 2025, blocking enforcement Permanent injunction entered on April 16, 2025, blocking law Sixth Circuit vacated the injunction June 18, 2026, finding NetChoice lacked standing and the law did not violate First Amendment constitutional |
Platforms must: - Obtain verifiable parental consent before creating an account for a child (under 16) and send written confirmation of consent - Terminate access to the platform within 30 days of receiving revocation of parental consent - Provide parental content controls |
|
| Tennessee Protecting Children from Social Media Act (SB 2097/HB 1891) |
Effective Jan. 1, 2025 NetChoice v. Skrmetti June 20, 2025 – Preliminary injunction denied Feb. 4, 2026 – Hearing on appeal of preliminary injunction denial in Sixth Circuit |
Requires social media platforms to: - Verify the age of prospective account holders - Prohibit minors under 18 years of age from obtaining an account without express parental consent - Allow parents to revoke their consent for minors’ social media accounts - Provide parental supervision tools for minors’ social media accounts, including a method for parents to view privacy settings |
|
| Texas Children Online Through Parental Empowerment (SCOPE) Act (HB 18) |
Effective Sept. 1, 2024 CCIA & NetChoice v. Paxton District court grants preliminary injunction in two cases in Aug. 2024 and Feb. 2025. The cases, now consolidated, are on appeal in the Fifth Circuit. |
||
| Utah Minor Protection in Social Media Act (SB 194) |
Effective Oct. 1, 2024 NetChoice v. Reyes District court grants preliminary injunction in September 2024 Nov. 20, 2025 – Hearing on Utah’s appeal to the Tenth Circuit of NetChoice’s preliminary injunction |
||
| Utah Harm to Minors by Algorithmically Curated Social Media Service (HB 464) |
Effective Oct. 1, 2024 A companion bill to SB 194, HB 464 was also blocked by the district court |
Creates a private right of action allowing Utah minor account holders or their parents to bring a cause of action against a social media company for adverse mental health outcomes |
|
-
-
Associate