Newsom’s child safety laws force Big Tech to do what it never would

By Staff Writers Yewon Kim, Tharun Arya Mahesh & Kelly Shi

For years, popular social media platforms have promised to make the Internet safer for impressionable children. Those promises have not held up. 

Every year, algorithms grow more personalized and more deeply woven into students’ lives, and nearly 40% of children had high or increasingly addictive use of social media as of 2025. Internet safety is even more important of an issue now with the rise of AI’s accessibility to the public, but companies have shown neither the willingness nor the ability to shield children from addiction. In response, Gov. Gavin Newsom signed 13 bills aimed at strengthening CA’s protections for children online on September 10. The bills target social media algorithms, companion chatbots, child exploitation, and the privacy of young users. Newsom’s laws are a necessary start, and they work because they replace companies’ voluntary self-regulation with enforceable legal mandates. Protecting children means dismantling data-harvesting business models that sacrifice youth welfare for corporate profit.

Among the 13 laws, SB 1119, known as “Adam’s Law,” was named after a teen who died by suicide in 2025 after being coerced by an uncensored ChatGPT interaction. The law requires companion bot companies to build crisis protocols, parental controls, and basic protections for children that should have been in place before any child’s death. Other laws target the design of social media platforms. AB 1709 bans addictive features like autoplay, algorithmic feeds, and profiles for users under 16 on Internet websites, online services, online applications, and mobile applications — finally placing a legal limit on the tools platforms use to keep teenagers scrolling. AB 1159 bars the use of student personal information to train AI models, and other measures expand protections against AI-generated material involving child sexual exploitation. These laws are not overreach; they are overdue because they stop asking technology companies to be responsible and start requiring it. 

Beyond Parental Control

The harms of uncensored algorithms for both AI tools and social media in the long run are not hypothetical. In 2025, a study published in JAMA Network Open followed 11,876 US children and adolescents over three years and found that increases in social media use were followed by increases in depressive symptoms one year later, whereas increased depressive symptoms did not lead to later social media use. Big Tech companies understand these risks but empirically decide to turn a blind eye against them. In Tennessee’s lawsuit against Meta, the state’s lawyers pointed to a 2017 internal document in which Meta’s own product managers wrote that features like notifications and infinite scroll “are inherently at odds with well-being,” according to Virginia Lawyers Weekly. Meta argues that such documents show it looks for problems and claims that they try to fix them. Yet a company that knowingly kept product features that could hurt young users has forfeited any claim to police itself. 

Companion bots, including ChatGPT, MetaAI, and Character.AI, are built to act as a friend or partner and keep users talking.  The addictive design here is emotional: these chatbots remember past conversations, mirror a user’s feelings, and send prompts that pull people back, allowing them to keep a conversation going for as long as possible. For a teenager still learning how relationships work, a bot that never disagrees, never tires, and never logs off can crowd out the friendships that build real social skills. Artificially stimulating a human connection is particularly dangerous because it stunts users’ social development and isolates them from the real world. 

Social media platforms and AI chatbots are run by private corporations whose systems are inherently exploitative: the longer a child stays, the more the company earns, so every feature is built to keep them there. On social media platforms, three features do most of the damage: recommendation feeds that learn what keeps a specific child watching, autoplay that removes the natural stopping point, and infinite scroll that never ends. Together they track micro-interactions, from how long a teen lingers on a post to how late at night they are still scrolling, and use them to serve whatever holds attention longest, including content that reveals emotional distress. In 2012, The New York Times documented an instance where Target once figured out a customer was pregnant from her shopping habits before her family knew. Platforms do not need a shopping history. They have every tap, pause, and late-night scroll, and they use it to find a child’s vulnerabilities and sell them back as engagement. That is not personalization, but rather profiteering that should not be defended.

Parental oversight is not enough because parents cannot see what their children see. They cannot see the recommendation feed their child is served, cannot read the conversations a chatbot has with their child, and cannot tell which of a platform’s safety tools actually work. Lawmakers keep introducing bipartisan bills, but tech giants have a long history of finding loopholes and making only the minimum change required. Instagram’s Teen Accounts are an example of this: Meta promoted them as protection for minors, yet when independent child advocacy organization researchers tested 47 of Instagram’s advertised safety tools in 2025, they found that 30 were defunct or easily circumvented. For example, controls that were built to filter out graphic or inappropriate material failed to block sexually suggestive content or algorithmic reels to young children. Adam Raine’s parents, whose child “Adam’s Law” was named after, did not know he had come to trust ChatGPT until after he took his own life, according to CBS News. Furthermore, parental controls on social media only work when platforms build them honestly, and the testing of Instagram’s Teen Accounts above shows that they do not. Asking parents to stand up alone against companies determined to hold their children’s attention is not freedom; it is abandonment.

Failure of Vague Limits

Earlier legislative efforts failed because they left room for companies to evade liability. Companies deliberately satisfy regulatory pressure by introducing surface-level settings and pop-up warnings, all while leaving their underlying, profit-driven algorithms untouched. This way, the companies appear to be responsible corporate citizens while, in fact, they retain the ability to engage and exploit users at will. 

CA’s own history shows how vague rules fail. The Age-Appropriate Design Code Act (AB 2273) asked platforms to assess risks to children and avoid manipulative design, but in March 2026 the Ninth Circuit found its data-use and dark-pattern provisions likely unconstitutionally vague, and they remain blocked. A rule a court cannot pin down is a rule a company can ignore. The new laws are different because they are specific and verifiable. AB 1709 names autoplay and algorithmic feeds built from a user’s history, and SB 1119 requires independent audits and annual risk assessments, so companies must prove their safeguards work instead of just promising that they do.

Financial penalties, which current regulatory laws primarily rely on, are also ineffective because even large fines can become simply another business expense rather than a reason to change. In August 2026, Meta agreed to pay $16.7–18 billion to a coalition of state attorneys generals, the largest settlement of its kind. But the payments are spread over roughly 10 years, which turns an imposing figure into something closer to routine overhead. This settlement also only binds Meta. TikTok, YouTube, and every other platform are still free to use the same features.

Conclusion

The gap between rapidly advancing technology and slower regulation makes attempts at individual self-regulation ineffective. Big Tech profits from collecting data and maximizing engagement, creating little incentive to change systems that drive revenue. Meaningful regulatory consequences should be shifted from being easily incorporated costs to actual operational threats to the platform’s mechanisms and leadership. The UK’s Online Safety Act 2023 demonstrates this shift, empowering regulators to levy fines up to 10% of global turnover, block non-compliant services, and hold executives personally criminally liable for child safety failures. Similarly, the California Age-Appropriate Design Code Act (AB 2246) requires platforms to perform risk assessments and forbids using addictive dark patterns, imposing direct obligations on the companies.

Taking collective action and building community awareness remain crucial to force checks on corporate power. Students and teenagers should pay attention to their digital well-being by checking application permissions, limiting algorithmic reach, and engaging in mental health discussions. In particular, students and the people they know should take initiative in learning about youth technologies by educating themselves and their peers about the current state of online privacy rights. Furthermore, taking part in digital advocacy, whether supporting a civil liberties organization or testifying before a legislative body, provides immense value, as every contribution helps in pushing for stronger data protection laws and regulations for the time being. 

The question was never whether CA’s laws are perfect. It’s whether we keep treating children’s attention as a product. The voluntary era is over. What happens next depends on whether these laws are enforced.