GA SB495

Prohibits covered entities from collecting, selling, or retaining personal data of minors beyond what is necessary for the service being used, and bans design features intended to cause compulsive use such as autoplay videos, infinite scroll feeds, and variable reward schedules

Requires highest-level default privacy settings for minors, including disabling algorithmic recommendations connecting adults to minors, hiding friends/followers lists, blocking push notifications, and disabling interaction counts on posts

Mandates risk assessments before deploying new designs that could cause compulsive use in minors, with documentation retained for 10 years and annual independent audits required

Applies to for-profit entities generating majority revenue from online services that are reasonably likely to be accessed by minors (at least 2% minor audience), with exemptions for small businesses under $25 million annual revenue and fewer than 50,000 users' data processed

Violations constitute unfair trade practices under Georgia's Fair Business Practices Act, with damages of $5,000 per violation or actual damages, plus punitive damages up to $50,000 or three times total damages; effective January 1, 2027