California’s Child-Safety Bills Overview
On September 10, Governor Newsom signed a large package of child-safety bills. Most of it concerns schools, student data, and general-audience social media. Several of the new laws are particularly relevant to adult websites, creator and fan platforms, tube sites, clip stores, and adult AI products. Most take effect January 1, 2027, although some companion-chatbot and application requirements have later 2027 compliance dates.
One point up front. None of these laws creates a general California requirement to verify age before showing sexual material, and California still has no site-level age-verification mandate for adult content. Instead, they attach age-assurance obligations to particular product features: a personalized feed, an autoplay player, a companion chatbot, or a mobile app receiving an age-bracket signal can each trigger an age obligation on its own, whether or not the site is adult.
AB 1946: CSAM Reporting, and Major New Exposure for Commercial Sexual Exploitation
AB 1946 is the most consequential item for adult UGC and creator platforms. It applies to a “social media platform” under Business and Professions Code Section 22675: a service whose substantial function is social interaction and where users build profiles, follow others, and post content others can see. Many fan and creator platforms may meet that test, and so may tube sites with profiles, subscriptions, and comments. There is no revenue or user threshold. Stand-alone end-to-end encrypted messaging services, and the end-to-end encrypted portion of a multiservice platform, are excluded; non-end-to-end-encrypted direct messaging is covered. The definition of CSAM can now include certain AI-generated or altered depictions, including digital forgeries of identifiable minors.
A covered platform must provide a clear and conspicuous reporting mechanism, free of dark patterns, that lets a California resident report suspected CSAM. A report must be reviewed by a person unless there is a hash match or the material is already blocked. You must permanently block the reported instance within 48 hours where there is a reasonable basis to believe it is CSAM, send written confirmation within 72 hours, and issue a final determination within seven days. Public prosecutors can recover up to $250,000 per day of violation, and a depicted individual can sue for up to $250,000 per violation.
This is not your CyberTipline obligation. NCMEC reporting under 18 U.S.C. Section 2258A remains a separate federal duty. A platform that reports diligently to NCMEC but has no compliant user-facing mechanism is fully exposed.
The largest dollar exposure is the amendment to Civil Code Section 3345.1. A social media platform must not knowingly facilitate, aid, or abet commercial sexual exploitation, defined as deploying a system, design, feature, or affordance that is a substantial factor in causing minor users to become victims. Statutory damages run from $1,000,000 to $4,000,000 for each act, and waiver is void. Knowledge is deemed where material was reported through the new mechanism, the statutory criteria are met, and the material was first hosted on the platform after January 1, 2025.
There is a complete defense, and all four elements are required: at least biannual audits of your designs, algorithms, and features to detect anything that could contribute to a violation; action within 30 days of each audit to mitigate the risk identified; a copy of each audit to every board member within 90 days with a description of the action taken; and submission of the audits to the Attorney General, and on request to a local prosecutor. Submitted audits are confidential. Standing that program up is a 2026 project.
AB 1709: Personalized Feeds and Autoplay May Trigger Age Assurance
AB 1709 bars a “covered platform” from providing an “addictive feature” to a user under 16, with no parental-consent override. A covered platform is any website, online service, or application offering an addictive feature as a significant part of its service. There is no revenue or user threshold. An addictive feature means an addictive feed or autoplay, and an addictive feed is user-generated media recommended or prioritized based on information associated with the user or the user’s device. Autoplay is not defined. The exclusion for services where user interaction is limited to commercial transactions or consumer reviews will not help a clip store or creator platform that also carries user posts and comments.
The consequential provision is Section 22684: before providing an addictive feature to a user, a covered platform must determine that user’s age. That runs to every user, not only to users you suspect are minors, so the practical question is whether you can serve a personalized feed at all without an age-assurance layer. Penalties reach $50,000 per affected minor for a knowing violation and $25,000 for a negligent one, with no cure period and no safe harbor.
SB 1119: Adult AI Companion Products Are Not Automatically Exempt
Not every chatbot is a companion chatbot. The definition covers an AI system with a natural language interface that gives adaptive, human-like responses, can meet a user’s social needs, and can sustain a relationship across multiple interactions. Customer-service bots, business-operations and productivity tools, and standalone voice assistants are expressly excluded, and an image or video generator is not a companion chatbot. An AI creator persona, AI girlfriend product, or roleplay companion may qualify if it is designed to sustain an ongoing relationship with the user across multiple interactions.
Most of SB 1119 applies only to operators that permit child users, who take on risk assessments, a child safety policy, a crisis protocol, parental controls, and session limits. But an operator that prohibits minors is not exempt. Section 21811 requires it either to determine each user’s age or to apply the child protections to everyone, and to publish a description of how it complies. An 18+ provision in your Terms does not satisfy that, and the statute does not require ID verification either; it points to the device-level age signal. Section 21811’s age-assurance requirement appears to take effect January 1, 2027. The more extensive child-safety requirements for operators that permit minors become operative July 1, 2027. The existing SB 243 disclosure and crisis-protocol duties already apply.
SB 1276: Synthetic and Altered Depictions of Minors
SB 1276 amends Penal Code Section 311.3 to reach digitally altered and artificial-intelligence-generated matter depicting a person under 18 engaged in sexual conduct, and adds downloading, streaming, and accessing to the covered conduct. It creates no platform compliance regime, but it should drive a policy review: prohibited-content rules, AI use policies, moderation systems, escalation procedures, and creator agreements should address synthetic and altered material expressly rather than by implication. One caveat: Section 311.3 lacks the “appears to be” language Section 311.1 uses, so whether it reaches wholly synthetic material depicting no real minor is unsettled.
A Short Note on Children’s Privacy and Mobile Apps
AB 2246 replaces California’s Age-Appropriate Design Code with a narrower statute covering a service “likely to be accessed by children.” That test turns on audience composition, advertising, and design indicators, not on what your Terms say. If it applies, the service must either estimate age or extend child privacy protections and high-privacy defaults to all users. An adult service that has never run age assurance and cannot document its audience is poorly placed to argue that children do not reach it.
AB 1856 matters only if you ship a native mobile application. Operating systems will expose an age-bracket signal that a developer must request on download and launch. The developer is then deemed to know the user’s age range even if it ignores the signal, including on its own website reached from that device. If you operate only a website, this one does not apply.
What Adult Platforms Should Do Now
- Determine whether your feeds or autoplay make you a covered platform under AB 1709, and what determining age before feature delivery would require of the product.
- Review your age-assurance architecture rather than relying on an 18+ Terms provision, and account for the age-bracket signal if you ship a mobile app.
- Build the AB 1946 reporting, review, blocking, and determination workflow to the statutory clocks, with logging sufficient to prove timing.
- Evaluate the Section 3345.1 audit defense and start the audit, remediation, board distribution, and submission cycle this year.
- Inventory AI features for companion-chatbot functionality, and update prohibited-content rules, moderation procedures, and creator agreements to cover synthetic depictions of minors.
Contact Silverstein Legal to discuss how these laws apply to your properties.
This article does not constitute legal advice and is provided for your information only and should not be relied upon in lieu of consultation with legal advisors in your own jurisdiction. It may not be current as the laws in this area change frequently. Transmission of the information contained in this article is not intended to create, and the receipt does not constitute, an attorney-client relationship between sender and receiver.
About Silverstein Legal
Founded in 2006 by adult entertainment lawyer Corey D. Silverstein, Silverstein Legal is a boutique law firm that caters to the needs of anyone working in the adult entertainment industry. Silverstein Legal’s clients include hosting companies, affiliate programs, content producers, processors, designers, developers, and website operators.
Related Articles
