Keypoint: 2024 will again see numerous developments in children’s privacy law.

As the 2024 state legislative season begins, it’s clear that lawmakers are again focused on children’s privacy. For the past few years, lawmakers have introduced different children’s privacy models, on both the federal and state level. However, regulating this specific area of law has its own set of challenges. We are releasing our 2024 State Children’s Privacy Law Tracker, which identifies enacted legislation and states considering legislation. Bookmark the page and use it as a resource.

For an update on children’s state privacy law, see below where we outline recent developments, children’s privacy laws that go into effect in 2024, and proposed laws this legislative session.

Recent Developments

FTC Proposed Changes to COPPA

In December, the Federal Trade Commission (“FTC”) proposed changes to the Children’s Online Privacy Protection Rule (“COPPA Rule”). The COPPA Rule went into effect in 2000 and the FTC last made changes to the Rule in 2013. The FTC proposed new revisions to clarify and streamline the COPPA Rule, address changes in technology, and strengthen its protection of children’s personal information. Here is a short summary of the FTC’s proposed changes:

• Require separate opt in consent for targeted advertising
• Prohibit conditioning a child’s participation with a service to the collection of personal information
• Limit the support for the internal operations exception
• Limits on nudging kids to stay online (i.e., push notifications)
• Codify the FTC’s current guidance related to education technology
• Increase accountability for Safe Harbor programs
• Strengthen data security requirements
• Limit data retention (i.e., for only as long as necessary to fulfill the purposes for collection)
• Expand definitions (e.g., personal information)

The public has until March 11, 2024, to submit comments to the proposed changes to the COPPA Rule.

California Age-Appropriate Design Code Act

In 2022, California enacted the California Age-Appropriate Design Code Act (CAAADC). The CAAADC was set to go into effect July 1, 2024. However, on December 14, 2022, NetChoice, a national trade association of online businesses, filed a complaint for declaratory and injunctive relief from the CAAADC.

On September 18, 2023, the U.S. District Court for the Northern District of California granted NetChoice’s motion for a preliminary injunction in NetChoice v. Bonta. The Court found that CAAADC likely violated the First Amendment.

CAAADC was modeled on the United Kingdom’s Age Appropriate Design Code, a country that does not have the same First Amendment protections. California appealed the District Court’s decision to the U.S. Court of Appeals for the Ninth Circuit. We will have to wait and see whether the Ninth Circuit determines that the CAAADC is unconstitutional. Until then, we are seeing a revised version of the Age-Appropriate Design Code Act (“AADC”) model circulate among states as identified in the New Proposed Laws section below.

2024 Laws

Connecticut

On June 26, 2023, the Connecticut governor signed SB 3 to amend the Connecticut Data Privacy Act. Connecticut’s law, which Senator James Maroney sponsored, will go into effect on October 1, 2024, and requires controllers that offer an online service, product, or feature to minors (an individual younger than 18) to have a duty of care to avoid heightened risk of harm to those minors. The law also requires controllers to obtain the minor’s consent, or parent/legal guardian consent for minors below 13, to sell personal information of minors, engage in targeted advertising, or profiling. Lastly, controllers must conduct data protection impact assessments to identify whether there is a heightened risk of harm to minors.

Florida

On May 9, 2023, the Florida governor signed SB 262, which will go into effect on July 1, 2024. Florida’s law applies to online platforms that provide an online service, product, game, or feature likely to be predominantly accessed by children. Florida’s law defines an online platform as a social media platform, online game, or online gaming platform. Overall, Florida’s law is limited in scope to the type of platform, not whether a company provides an online service, product, or feature.   

New Proposed Laws

Lawmakers in the following states have proposed legislation to regulate children’s privacy. *This list of bills does not cover social media bills or bills that target websites featuring adult content. Although multiple states have enacted and/or proposed such laws, we will not track these laws this season because these laws apply to a smaller group of companies.

Colorado

Colorado Senate Majority Leader Robert Rodriguez and Minority Leader Paul Lundeen introduced SB24-041 to amend the Colorado Privacy Act with protections for minors’ data. The bill, which is modeled on Connecticut’s SB 3 discussed above, applies to any data controller that conducts business in Colorado or targets Colorado residents with its products or services.

Hawaii

The Senate introduced in Hawaii SB2309 and SB2012. SB2309 is a version of the AADC and establishes a Children’s Data Protection Working Group for implementing the law. SB2012 is a similar bill, that also create the same type of working group.

Illinois

On March 10, 2023, the House introduced HB 3880 and referred it to the Rules Committee. This bill creates the Children’s Privacy Protection and Parental Empowerment Act, and the bill has rolled over to this session.  

Maryland

In Maryland, lawmakers introduced HB 603, which applies to covered entities that meet certain revenue or sale threshold requirements.

Minnesotta

In Minnesota, Representative Kristin Bahner is again running an AADC bill. Last year’s bill (HF 2257 / SF 2810) rolled over to the 2024 session and was the subject of an informational hearing in early January.

New Mexico

In New Mexico, lawmakers introduced SB 68 a version of the AADC.  

New York

In New York, the Assembly introduced A4967 and the Senate introduced a version of the bill S3281. The Assembly bill is currently with the Assembly Science and Technology committee and the Senate bill is with the Senate Internet and Technology committee. The bills require data controllers to assess the impact of its products and service on children, and bans certain data collection and targeted advertising.

Pennsylvania

In Pennsylvania, the House introduced bill 1879 and referred it to the Committee on Children and Youth on December 5, 2023. The bill applies to any business that knowingly processes a child’s personal information.

South Carolina

Lawmakers in South Carolina introduced H 4541 and it was referred to the Committee on Judiciary on January 9, 2024. The House also introduced H 4842, a version of the AADC and referred it to the Committee on Judiciary on January 16, 2024. 

Vermont

The House introduced H.712 in Vermont, and it was referred to the Committee on Commerce and Economic Development on January 9, 2024. The Vermont bill only applies to entities that meet certain revenue or sale of data threshold requirements.  

Virginia

On January 9, 2024, the House introduced HB 707 and HB 821 and referred the bills to the Committee on Labor and Commerce. On the same day, the Senate introduced SB 432 and SB 361 and referred the bills to Committee on General Laws and Technology. The Senate introduced SB 684, an Online Children’s Safety Protection Act on January 18, 2024, and referred the bill to the Committee on General Laws and Technology.  

West Virginia

On January 15, 2024, the House introduced HB4718 and referred it to the Committee on the Judiciary.

[View source.]