California bans autoplay for users under 16

On September 10, 2026, California Governor Gavin Newsom signed a package of laws on the online safety of young people. According to the Los Angeles Times, the measures number more than ten; the list of provisions is also published in the governor’s office statement.

Two rules concentrate the meaning of the intervention, and they concern two different technologies.

The first is SB 1119, which applies to operators of companion chatbots — conversational systems designed to maintain an ongoing relationship with the user. The law requires them to carry out risk assessments and, in certain cases, to notify parents in the presence of self-harm threats. It is a process and reporting obligation: it does not establish what the system should answer, but requires those who operate it to measure dangers in advance and to warn when a specific one is detected.

The second is AB 1709, which bans certain platforms from using features defined as addictive for users under 16: among these, the automatic playback of content and content feeds recommended by algorithms. Here the intervention does not concern what is published, but the way the content is served — the structure that decides when one video ends and the next begins without the user choosing.

The ban does not target the content, but the mechanisms that prolong its consumption.

The California government’s statement also lists among the measures independent child safety audits and annual risk assessments for companion chatbots: two recurring verification tools, not a single prior authorization.

Why it matters beyond California

Jurisdiction is at the state level, but the pool of companies headquartered or operating there makes these rules a reference point for the sector. When a rule requires changes to a service’s architecture — disabling autoplay for a given age group, introducing periodic risk assessments — technical adaptation rarely stays confined to the territory that imposes it, because duplicating infrastructure costs more than applying the stricter standard everywhere.

However, the boundaries of what is known must be recorded precisely: both sources describe the signing and the list of measures, and one of the two is the governor’s office, that is, the party that promoted and presented the package. The title of the official statement contains a comparative assessment of the rules’ rigor: it is the administration’s position, not a fact verified by third parties, and this newspaper does not adopt it.

What we don’t know

The dossier does not contain the entry-into-force date of the two laws cited, nor the size thresholds defining which platforms are subject to AB 1709. It does not contain the penalties provided for in case of non-compliance, nor the body in charge of oversight. It does not contain the full text of the list of more than ten measures, so we cannot describe the measures other than the two cited. It does not contain reactions from the companies concerned, nor any announcements of legal challenges.

One point deserves particular caution: SB 1119 provides for parental notification in the presence of self-harm threats, but the dossier does not specify in which cases the notification is triggered, with what safeguards for the minor user’s privacy, and who assesses the risk threshold. It is the most delicate node of the package, because it puts two legitimate goals in tension — protection and privacy — and how it is resolved in the regulatory text is not, as of now, documented by the available sources.

Practical verification will come from the first cycle of annual assessments and independent audits provided for by the rules signed on September 10.