United States of America: California Age-Appropriate Design Code Act (AB 2273) including data protection regulation amended

On 26 April 2022, the California Age-Appropriate Design Code Act (AB 2273) including data protection rules, has been amended by the California Assembly. The amended version of the bill clarifies several previous provisions, for example by expanding the prohibition on collecting and retaining personal information to also clearly cover selling and sharing of data. Furthermore, where the original version sometimes allowed information collection in a child's "best interests", the amended version changes these exceptions to apply where collection is necessary to provide the service at issue. The amended version further requires Data Protection Impact Assessments to be provided to the California Privacy Protection Agency within 12 months of the implementation of the Act, to be reviewed every 24 months or before new features are made public. Finally, while the Act would require entities to establish the age of consumers with reasonable accuracy, the amended text adds a provision prohibiting age-identifying information from being used for other purposes and from being retained for longer than necessary.