AI Recommendation Algorithms and Children’s Online Safety: Age-Appropriate Design Laws

If you build or operate a digital product that children use — a social media platform, a gaming app, an educational service, a content streaming site — a wave of state laws now requires you to redesign how your AI recommendation and content amplification systems work for minor users. These laws do not merely add disclosure checkboxes. They mandate substantive changes to product defaults, data collection practices, and algorithmic behavior, and they impose affirmative duties of care toward the minors on your platform.

Four states have enacted age-appropriate design code laws: California, Maryland, Nebraska, and Vermont. Their provisions differ in scope and enforcement timeline, but their cumulative effect is a new baseline for how any technology company serving minors in those states must operate. A fifth state, South Carolina, enacted its own AADC in 2025. More states are expected to follow through 2026 and 2027. If you build for children or teenagers, this is the regulatory landscape you now operate in.

The Underlying Logic: Design as a Legal Obligation

Traditional privacy law asks a relatively simple question: did you get consent before collecting data? Age-appropriate design law asks a harder one: did you build the product in a way that protects children’s wellbeing from the ground up?

The design code concept originated in the UK’s Age Appropriate Design Code (also called the Children’s Code), which took effect in 2021 and requires platforms to treat children’s best interests as a primary design consideration — not an afterthought addressed by a separate parental consent flow. California imported this framework in 2022 and the idea has spread rapidly through state legislatures.

The key insight behind these laws is that data collection and algorithmic amplification are not neutral. Recommendation algorithms that maximize engagement have well-documented effects on adolescent mental health. Features designed to create habitual use — infinite scroll, autoplay, streak mechanics, social comparison metrics — exploit cognitive vulnerabilities that children are less equipped to resist than adults. The design code approach says that when you build products children will use, you have a legal obligation to account for those vulnerabilities in your design.

California: The Age-Appropriate Design Code Act

California’s Age-Appropriate Design Code Act (CAADCA), enacted in 2022, has been the most legally contested of the state AADCs. It covers any business that provides an online service, product, or feature that is “likely to be accessed by children” — meaning any individual under 18.

A preliminary injunction issued by a federal district court blocked enforcement of most of the law, but in March 2026, the Ninth Circuit Court of Appeals partially vacated that injunction, allowing key provisions to take effect as of April 2, 2026. The litigation is ongoing, and some provisions remain enjoined. But the partial revival of the California AADC means compliance obligations are real and currently in effect for covered businesses.

What California Now Requires

The provisions the Ninth Circuit allowed to take effect include:

High-privacy default settings. Covered businesses must configure privacy settings to their most protective levels by default for child users. This is not a disclosure requirement — it is a product configuration requirement. If your app offers a setting that limits who can contact a child user, that setting must be on by default, not available to turn on.

Recommendation algorithm constraints. This is the provision most directly relevant to AI. The Ninth Circuit allowed enforcement of the provision requiring that personalization and recommendation feeds for minors be based on no information other than the user’s age or status as a minor. In practice: your AI recommendation engine cannot use behavioral tracking data, engagement history, social graph data, or inferential profiling to personalize content for identified or likely minor users. Recommendation logic for minors must be stripped down to age-based defaults. All other users — those who are not minors — must be given the ability to opt out of personalization.

Age-appropriate notices. Notices and privacy information provided to child users must be presented in a way appropriate to the age of the child being addressed.

Monitoring and tracking signals. Covered businesses must provide controls allowing users or guardians to address geolocation tracking and other monitoring features.

Privacy rights tools. Covered businesses must provide effective tools through which users can exercise their privacy rights.

The California Attorney General has enforcement authority and can seek civil penalties of up to $7,500 per affected child per intentional violation — an exposure that can compound rapidly for platforms with large minor userbases.

Maryland: The Kids Code

Maryland enacted its version of an age-appropriate design code as part of a broader children’s privacy statute. Maryland’s law applies to covered entities that operate online services likely to be accessed by children under 18.

Maryland’s Kids Code requires covered entities to:

• Configure privacy settings to their highest protection level by default for minors;
• Avoid using personal data of minors to profile them for advertising or to recommend content in ways contrary to their best interests;
• Not use design features that psychologically manipulate children to extend platform usage;
• Not use targeted advertising directed to minors based on personal data;
• Not collect or sell personal data of minors beyond what is necessary for the service.

Maryland’s law is currently facing a legal challenge similar to the one that initially blocked California’s AADC. Businesses should monitor the litigation closely, but should not treat pending litigation as a reason to delay compliance planning. Courts can, as the Ninth Circuit demonstrated in California, allow significant portions of these laws to take effect even while other challenges are pending.

Nebraska: The Age-Appropriate Online Design Code Act

Nebraska Governor Jim Pillen signed the Nebraska Age-Appropriate Online Design Code Act on May 30, 2025. The law took effect January 1, 2026, though the Nebraska Attorney General may not seek civil penalties until July 1, 2026.

Nebraska’s approach is notably different from California’s and Maryland’s. Rather than adopting a broad duty-of-care model, Nebraska chose a narrower, feature-driven framework focused on specific design practices that are clearly harmful.

Nebraska’s law focuses on:

Actual knowledge standard. Nebraska’s law keys many of its obligations to actual knowledge that a user is a minor, rather than the California and Maryland approach of covering any service “likely to be accessed” by children. This makes Nebraska’s law more navigable for businesses that do not actively target minors and have no affirmative reason to know minor users are present.

Prohibited addictive design features. Nebraska prohibits specific design patterns when deployed toward users the operator knows to be minors: autoplay features that automatically progress content without active user action, infinite scroll without natural stopping points, and notification systems designed to interrupt sleep or undermine sleep hygiene.

No rulemaking authority. Nebraska’s legislature chose not to give the Attorney General rulemaking authority to expand the law’s requirements. The obligations are statutory and fixed until the legislature acts again. This makes Nebraska’s compliance picture more predictable.

Limited scope. Nebraska’s law expressly limits its application. It does not attempt to regulate the full design of a platform — only specific prohibited features when directed at known minor users.

For businesses already complying with California or Maryland, Nebraska’s requirements will typically be subsumed within a broader compliance program. For businesses that are not covered by California or Maryland (perhaps because they have no California or Maryland users), Nebraska’s more limited scope may be the primary obligation.

Vermont: The Vermont Age-Appropriate Design Code Act

Vermont Governor Phil Scott signed the Vermont Age-Appropriate Design Code Act on June 12, 2025. Vermont’s law is among the most ambitious of the state AADCs and takes effect January 1, 2027, giving covered businesses more lead time than Nebraska.

Vermont’s law is closer to the UK’s Children’s Code and to California’s approach than to Nebraska’s:

Broad duty of care. Vermont explicitly adopts a duty of care standard, requiring covered businesses to act in the best interests of child users — a more open-ended and demanding standard than specific feature prohibitions.

Robust rulemaking authority. Vermont’s law directs the Vermont Attorney General to engage in extensive rulemaking, which means the detailed compliance requirements will evolve through administrative process over the period leading up to the 2027 effective date. Businesses need to track Vermont’s rulemaking as it develops.

Transparency requirements. Vermont’s law includes novel transparency provisions requiring covered businesses to publish information about how their systems are designed, what data they collect from minors, and how recommendation algorithms function for child users. These transparency obligations are broader than anything in Nebraska’s law.

Data minimization. Vermont requires covered businesses to collect only the data necessary for the service as experienced by a minor — not the data that would be necessary to provide the full adult version of the service.

Vermont’s 2027 effective date provides more compliance runway, but the scope of Vermont’s law and its rulemaking process mean that companies serving Vermont minors need to begin preparation well before the deadline.

South Carolina and the Expanding AADC Landscape

South Carolina enacted its own age-appropriate design code in 2025, and the Kids Code Coalition has tracked legislation in more than a dozen other states. The model bill that the Electronic Privacy Information Center (EPIC) released in 2026 is designed to withstand the constitutional challenges that have slowed California’s law, incorporating provisions from cases the Ninth Circuit found permissible while omitting provisions the courts have found problematic.

The constitutional issues — primarily First Amendment concerns about mandating or restricting algorithmic curation — are still being litigated. But the broader legislative trend is clear: age-appropriate design is becoming the regulatory baseline for any product that children use, and the number of states adopting some version of these requirements is increasing with each legislative session.

AI-Powered Recommendation Engines: The Specific Technical Challenge

The most significant technical compliance challenge these laws create is for AI-powered recommendation and content amplification systems. Modern recommendation engines are typically trained on vast behavioral datasets — watch history, engagement patterns, time spent, clicks, pauses, replays. They surface content optimized to maximize continued engagement.

Under California’s AADC (the portions now in effect), that entire framework is prohibited for minor users. The recommendation system for a user identified or likely to be a minor cannot use behavioral data. It must operate on age-appropriate defaults. This is not a simple configuration change for most systems — it requires maintaining separate algorithmic logic for minor users, carefully segmenting behavioral tracking and training data by user age, and ensuring that inferred minor users (users the system suspects may be minors even without age verification) receive the same restricted treatment.

The compliance challenge compounds in the context of AI-generated content recommendations. A generative AI system that creates personalized content summaries, curates feeds, or suggests new creators to follow based on engagement patterns is doing exactly what the California AADC prohibits for minors. If your product uses any form of AI to personalize content for users — and today most consumer apps do — you need to evaluate those systems against the requirements of the states where your minor users are located.

Key questions for technical compliance:

• How does your system identify which users are minors, or which users are likely minors?
• Can your recommendation engine operate in a “no-behavioral-data” mode for a defined user population?
• Do your engagement-optimization features — autoplay, infinite scroll, push notifications — have minor-specific configuration?
• How are minor users’ behavioral data segregated from training data for your AI systems?
• What are your data retention practices for data collected from minor users?

Algorithmic Amplification: A Separate but Related Issue

Beyond recommendation engines, these laws address “algorithmic amplification” — the mechanism by which platforms boost the reach of certain content through computational ranking and prioritization. The concern is that platforms that algorithmically amplify emotionally intense, controversial, or self-harm-adjacent content do so to maximize engagement metrics, and that this amplification mechanism is particularly harmful to adolescent users.

Maryland’s and California’s laws both constrain the use of algorithmic amplification for minors. A platform cannot algorithmically prioritize content for minor users based on engagement signals that optimize for the platform’s business interests rather than the child’s wellbeing.

This creates a direct tension with advertising-supported business models. If your platform earns revenue from advertising that depends on engagement metrics, and if algorithmic amplification of content drives those engagement metrics, the design code requirements constrain your core monetization logic as applied to minor users.

There is no simple legal workaround here. The laws are designed precisely to address this tension. The required solution is to either segment minor users into a different product experience that does not rely on engagement-optimized amplification, or to verify that your users are adults before applying engagement-optimized algorithmic logic.

Practical Compliance Framework

For businesses that operate digital products accessed by minors, the following framework addresses the requirements across California, Maryland, Nebraska, and Vermont:

Step 1: Determine which laws apply. You are covered if you operate a digital product or service that is likely to be accessed by children in any of these states. For California, Maryland, and Vermont, that means any product reasonably expected to attract child users — you do not need to be actively marketing to children. For Nebraska, the compliance obligations are stronger if you have actual knowledge of minor users.

Step 2: Conduct a data and algorithm audit. Map every point at which your systems collect data from or about users. For each data type, evaluate: is this data collected from minor users? Is it used to train recommendation systems? Is it used to personalize content or advertising? Is it shared with third parties?

Step 3: Implement age identification or age estimation. You cannot apply minor-specific protections if you do not know which of your users are minors. Implement an age verification or age estimation methodology appropriate to your product. Note that COPPA and the updated COPPA Rule (discussed in a separate post in this series) impose related requirements on age identification for products directed to children under 13.

Step 4: Segment your recommendation and personalization systems. Build or configure separate algorithmic logic for identified or likely minor users. This logic should not rely on behavioral tracking data and should not use engagement-optimization approaches that conflict with the best interests of child users.

Step 5: Configure privacy defaults. Ensure that for minor users, all privacy settings default to their most protective configuration. Document the defaults and the process for users to modify them.

Step 6: Disable or modify prohibited design features. Audit your product for autoplay, infinite scroll, and compulsive-use notification features. Configure minor-user experiences to disable or limit these features, as required by Nebraska and aligned with the broader duty-of-care standard in Vermont and California.

Step 7: Review advertising and data sharing practices. AADC laws broadly prohibit using minor users’ data for behavioral advertising. Review all advertising integrations and third-party data sharing arrangements to ensure compliance.

Step 8: Document everything. These laws will be enforced. Regulatory investigations will ask for evidence of your compliance program, your design decisions, and your internal assessments of likely impact on minor users. Build your documentation practices now.

Looking Ahead

The age-appropriate design code movement is not slowing down. The EPIC model bill is designed to survive First Amendment challenges. The Ninth Circuit’s March 2026 ruling signaled that at least some core AADC obligations are constitutionally sound. State legislatures in at least a dozen more states are considering similar legislation.

The FTC, for its part, has been increasingly focused on the intersection of algorithmic design, children’s privacy, and mental health. FTC enforcement actions against platforms for failing to honor children’s privacy obligations have included substantial penalties and lengthy consent orders. COPPA violations by platforms with large minor userbases have resulted in penalties exceeding $100 million.

For businesses building technology products, the direction of travel is clear: the era of designing for adult engagement metrics and treating child protection as an afterthought is ending. Products used by minors will need to be designed with those users’ wellbeing as a primary consideration — not just as a compliance check, but as a product design principle.

If your product is used by children or teenagers, these laws affect you today in California, Maryland, and Nebraska. Vermont follows in 2027. Building a compliance program now, while there is still time to engineer solutions before enforcement, is substantially less expensive than responding to an enforcement action after the fact.

This post is for general informational purposes only and does not constitute legal advice. Reading this post does not create an attorney-client relationship. If you have questions about your specific situation, consult a qualified attorney.