Rules
California Age Appropriate Design Code vs COPPA: Scope
California age appropriate design code and COPPA differ in age scope: AADC reaches services likely accessed by users under 18; COPPA covers children under 13.
What to take away
- The California Age Appropriate Design Code (AADC, AB 2273) covers services likely to be accessed by users under 18, while COPPA covers services directed to children under 13.
- COPPA is enforced by the Federal Trade Commission and state attorneys general. The AADC assigns enforcement to the California Attorney General, but a preliminary injunction in NetChoice v. Bonta blocks enforcement.
- COPPA requires verifiable parental consent before collecting personal information from a child under 13. The AADC requires a data protection impact assessment for each feature likely to be accessed by minors.
- A single privacy program can satisfy both laws if you map age ranges, default settings and data retention to the stricter rule in each case.
- Neither law tells you how to verify age without collecting more data than the law allows, which is the shared problem both leave open.
What the two laws actually cover
COPPA, passed in 1998, is codified at 15 U.S.C. §§ 6501–6506. It applies to operators of commercial websites and online services directed to children under 13, and to operators with actual knowledge they are collecting data from that group. The FTC's Children's Online Privacy Protection Rule (16 C.F.R. Part 312) sets out notice, consent and deletion duties.
COPPA vs California AADC
COPPA
- Age covered
- Under 13
- Trigger
- Directed or actual knowledge
- Core duty
- Notice and parental consent
- Defaults
- Limited collection
- Enforcement
- FTC and state AGs
- Penalty shape
- Per violation
California AADC
- Age covered
- Under 18
- Trigger
- Likely to be accessed
- Core duty
- Impact assessment before launch
- Defaults
- High privacy by default
- Enforcement
- California Attorney General
- Penalty shape
- Per affected child
AB 2273 was signed in 2022 and applies to businesses that provide an online service, product or feature likely to be accessed by children; its word "business" is tied to the CCPA's business definition rather than to a new test written into AB 2273. California defines a child as a user under 18, which is a wider net than COPPA. The statute is codified at Cal. Civ. Code §§ 1798.99.28–1798.99.40; its full text appears on the California legislative information site. Although the statute assigns enforcement to the California Attorney General, a preliminary injunction in NetChoice v. Bonta, in the U.S. District Court for the Northern District of California, blocks enforcement.
One practical difference follows from that age line. A social app aimed at teens aged 13 to 17 falls outside COPPA's consent trigger but inside the AADC's design duties. Teams that treat the two as the same rule usually miss the older group.
Why the two laws were written for different webs
COPPA was drafted for a web of desktop sites, registration forms and chat rooms, where the central question was whether a service was directed to children. The California Age Appropriate Design Code was drafted in 2022 for products built on feeds, autoplay, notifications and public-by-default profiles — the design layer COPPA never had to address.
That difference, more than the age numbers, explains why the two laws ask different questions. COPPA asks whether you may collect a young child's data at all. The AADC asks how a product is designed for the minors who are already inside it.
The criteria that matter
COPPA
- Age covered
- Under 13
- Trigger
- Directed to children or actual knowledge
- Core duty
- Notice and verifiable parental consent
- Defaults
- Limited collection from children
- Enforcement
- FTC and state AGs
- Penalty shape
- Civil penalties per violation
California AADC
- Age covered
- Under 18
- Trigger
- Likely to be accessed by children
- Core duty
- Data protection impact assessment before launch
- Defaults
- High privacy by default for minors
- Enforcement
- California Attorney General
- Penalty shape
- Civil penalties per affected child
How each law applies
The starting point depends on the audience and the duties at issue: COPPA focuses on children under 13, while the AADC's scope extends to services likely to be accessed by children under 18.
COPPA first
A developer building a game or learning app for elementary school users should start with COPPA. The consent machinery is the hard part, and the FTC has a long record of consent orders that show what adequate notice looks like. If your audience is under 13, the federal rule sets the floor.
The useful history here is enforcement rather than text: COPPA's reach has been defined case by case, and the AADC's will be defined the same way once the injunction lifts.
AADC first
A social app with a teen user base should start by assessing the AADC's design duties. As written, the law calls for a data protection impact assessment that identifies risks to children and mitigations, and requires the assessment to be made available to the California Attorney General upon request. Defaults must be set high for minors, and nudges that encourage extended use need justification.
Age assurance is the expensive item. The law asks for a reasonable estimate of age, not a document check on every user, and that wording leaves room for estimates drawn from account signals.
Both at once
Most US social products end up in both regimes. The efficient path is one assessment template with two columns, one for under 13 and one for 13 to 17. Consent records cover the younger column; design decisions cover both.
A checklist for the shared template:
- Map every feature that collects personal information and note the youngest likely user.
- Write the retention period for each data type and the deletion trigger.
- Record the default privacy setting for each age band before launch.
- Keep the impact assessment and consent log in one auditable folder.
Where each one wins
COPPA wins on clarity of process. The consent standard, the notice content and the deletion duty are all spelled out, and the FTC publishes business guidance that answers common questions. A small team can follow it without counsel on retainer.
For background on how the federal statute reads, the Children's Online Privacy Protection Act text in the US Code is short and worth reading in full.
The AADC wins on coverage of design choices. It reaches recommendation feeds, notification timing and default visibility, which COPPA largely leaves alone. That is where most teen harm claims now land, so the California rule is the more demanding of the two for a social product.
What none of them solve
Both laws assume a service can tell a child from an adult. Neither specifies an age verification method that works at scale without collecting more personal data, which then creates its own risk. That gap is the same one that shows up in internet communities comparison in plain terms, where different platforms reach different answers on the same question.
Neither law sets a federal standard for teen accounts. A developer serving users in fifty states still watches for new state codes that copy the California model, and each one adds its own filing duty.
