In a recent blog post, we covered a new California law, the California Age-Appropriate Design Code Act (the “AADC”), that will have far-reaching implications for a variety of industries. In this first post in a five-part series, we will explore how AADC is likely to impact the advertising industry, and what steps advertisers can take now to get ready. 

Click here for part two, covering the video game industry.

AADC Recap.

The California AADC is modeled after the UK’s own Age-Appropriate Design Code. As of this writing, no actions have yet come down from the UK Information Commissioner’s Office (ICO), who is tasked with enforcement. 

Effective July 1, 2024, the California AADC aims to regulate online products, services, and features that may pose a risk to children’s mental, physical and emotional health. At a high level, the AADC will apply to certain businesses (as defined under California law) that offer such online products services, and features which are “likely to be accessed” by a child. Notably, “child” here refers to anyone under the age of 18, a remarkable broadening of scope for those familiar with the threshold of under 13-years-old for the federal Children’s Online Privacy Protection Act (COPPA). 

The intersection of advertising and the California AADC poses interesting challenges, particularly with the AADC’s added requirements in both identifying child consumers and prohibiting certain advertising activity, such as profiling. The California AADC created the California Children’s Data Protection Working Group, which is required to deliver a report to the California Legislature by January 1, 2024, regarding best practices for the implementation of the AADC. However, regulations which may clarify compliance are, at the very least, months away. 

1. Advertisers will need to estimate ages of consumers.

For each online product, service or feature released to the public, advertisers will need to assess if this is likely to be accessed by children. Online products covered by the AADC likely include advertisements displayed online across social media platforms as well as advertisements streamed or broadcast. If the content of the ad is likely to be seen by consumers under the age of 18, advertisers will then need to estimate the age of child users within a “reasonable level of certainty.”

For advertisers, this has several implications. First and foremost, advertisers will need to ensure that information regarding consumers’ ages is collected and used internally to create such estimations, and is not used for any other purpose.

Once such data is collected, advertisers will have to demonstrate what steps were taken to mitigate the risks posed to children by accessing their advertisements, or perhaps even the underlying product advertised. 

This raises the question as to which party is responsible for these age verification services: advertising agencies, their clients, or the platforms that host these advertisements? The answer may ultimately impact the process of purchasing ad space on certain online platforms. Advertisers will also need to consider what data must now be intentionally collected or even purchased from data brokers in order to satisfy the obligation to estimate consumer ages.

2. Advertisers will need to demonstrate compliance.

A hurdle that all companies will face is demonstrating compliance to regulators. 

Under the California AADC, businesses must complete so-called ‘data protection impact assessments’ or DPIAs. DPIAs are, at a very high level, internal assessments that look at what consumer data is collected, how this data is used, and if there are ways to mitigate risk to consumers in connection with their personal information.

For example, advertisers who intend to promote beauty products probably have little to no reason to collect a consumer’s drivers license number. In following that logic, the California AADC aims to have advertisers limiting the data they collect about consumers to what is necessary and reasonably related to the scope of their online products and advertisements.

Advertisers will also need to document these mitigation measures and what internal assessments were made about data collection.

3. Advertisers will need to stop certain targeted advertising practices.

Targeted advertising is also squarely in the crosshairs of the California AADC. 

The law prohibits profiling children (except under certain narrow instances) and outright bans the use of ‘dark patterns’ that induce children into providing their personal information or taking any other actions that are “materially detrimental” to the child’s well-being.

Dark patterns have a relatively broad meaning under the law and are not defined clearly. As regulations comes out, the scope of what is considered a dark pattern may narrow or broaden considerably. As it stands now, however, advertisers should rethink some of their advertising strategies, such as requiring consumers to click “I’ll pay the full price” when turning down discounts or pre-checking certain boxes which opt consumers into marketing outreach.

In addition to limiting or even ceasing these practices, advertisers will also need to implement simpler, user-friendly tools for consumers to exercise their rights in relation to their personal information. For online products that are likely to be accessed by children, this means making these tools and related policies understandable to children.

4. Advertisers will need to update their existing agreements.

Prior to the AADC, advertisers had less reason to focus on the data privacy provisions in their agreements. Now, due to these changes under the law, advertisers will need to think about revising their existing agreements to clarify particular obligations under the law. Further, advertisers will need to reconsider the scope of data collection services by particular vendors and what obligations their vendors are in turn bound by.

This may mean either amending some existing agreements or renegotiating new agreements to include AADC-specific provisions in preparation for the California AADC.

5. Advertisers for certain adult products will need to take special precautions.

Advertisers that work with certain adult-directed products, such as alcohol/smoking products or adult toys, may need to tread with particular caution here. Even without knowing the full scope of compliance that will be required under the AADC, it seems clear that California regulators will be looking closely at certain online products or advertisements that promote potentially “unhealthy” habits, such as gambling or vaping.

This may mean that advertisers for adult products need to estimate their consumers’ ages more scrupulously and work to serve such advertisements only to those consumers that the advertiser can verify are over the age of 18. Whether this approach will satisfy the AADC requirements, however, remains to be seen.

Advertisers of adult products may also consider linking to webpages with age-gates or other mechanisms that prevent children from accessing their ads and underlying products. However, while the practice of age-gating has grown in popularity across the internet, it is unclear if age-gating certain adult products would be adequate under the California AADC.

Conclusion

In sum, California AADC may impact the advertising industry in remarkable and profound ways.

Although meaningful enforcement is still several months away, advertisers should start thinking about how they can begin implementing changes now to ease into these new requirements. Revising internal policies, thinking about data relative to consumers’ needs, and sunsetting certain data collection practices are examples of the early and perhaps easiest steps toward compliance with the California AADC.