Children's Privacy in 2026: Enforcement Moves Into Product Design

California has enacted a comprehensive package of child online safety laws now in effect in 2026, including SB 1119 requiring AI companion chatbots to evaluate and address safety harms to children, impose default usage limits of one continuous hour and two total hours per day, and restrict emotional manipulation through excessive praise or flattery, and AB 2246 requiring high-privacy default settings for child users and prohibiting profiling or excess data collection. The laws represent a shift from retrospective enforcement to mandating product design changes, with the Meta settlement imposing restrictions on how teenagers use Facebook and Instagram and the TikTok settlement contingent on whether parental-consent mechanisms functioned as required.

Mandating design constraints and usage limits addresses some risks but leaves the underlying harm detection challenge unresolved: a chatbot restricted to two hours can still groom, manipulate or solicit explicit material within that window, and default privacy settings do not prevent a predator who has already made contact from escalating a conversation toward exploitation. Targeted detection of harmful interaction patterns, sustained targeting, coercion and boundary violations in direct messages complements design mandates by identifying the specific conversations that pose a threat to a specific child, regardless of the time limit or privacy setting applied. Where a design rule restricts access or visibility broadly, pattern-based detection intervenes surgically, blocking hostile or manipulative contact before it reaches the child and escalating the serious cases to a parent or authority without requiring surveillance of compliant users or restriction of legitimate interaction.