SC H3402

Requires covered entities (businesses with $25+ million annual revenue, or processing data of 50,000+ consumers, or deriving 50%+ revenue from selling personal data) to act in the best interests of children under 18 when processing their data online

Mandates data protection impact assessments for online services, products, or features reasonably likely to be accessed by children, examining potential harms from algorithms, targeted advertising, design features, and data collection practices

Prohibits profiling children by default, collecting precise geolocation without necessity and visible notification, using dark patterns to manipulate children, and processing children's personal data beyond what is necessary for the service

Requires default privacy settings to offer high-level privacy protection for children, with privacy information presented in age-appropriate, clear language

Authorizes Attorney General enforcement with civil penalties of up to $2,500 per affected child for negligent violations and $7,500 per affected child for intentional violations, with no private right of action