CA AB2273

Requires businesses providing online services, products, or features likely to be accessed by children to complete Data Protection Impact Assessments before July 1, 2024, identifying risks to children from data management practices and implementing mitigation plans.

Mandates default privacy settings offering high-level privacy protection for children unless businesses demonstrate a compelling reason for different settings, and requires clear, age-appropriate privacy disclosures.

Prohibits businesses from profiling children by default, collecting unnecessary personal information, using dark patterns to manipulate children, or collecting precise geolocation information without necessity and obvious notice.

Establishes the California Children's Data Protection Working Group to deliver biennial reports on best practices for implementation, with members from state government and experts in children's data privacy, health, and rights.

Authorizes the Attorney General to enforce violations with civil penalties of up to $2,500 per affected child for negligent violations or $7,500 per affected child for intentional violations, with a 90-day cure period for businesses in substantial compliance.