California Just Passed a Law to Stop Tech Companies From Selling Your Kids' Data
Silicon Valley built its empire on your attention. Turns out, it built a pretty decent side business on your children's data, too. And for years, nobody stopped it.
Related: Your Landlord Just Entered Without Notice - What California Renters Can Do About It · CALWIRE Tech Report (Friday, September 11, 2026)
That changed this week. California, which has a long habit of writing the rules the rest of the country eventually follows, has passed a new law specifically targeting tech companies that harvest and sell personal data belonging to minors. The legislation lands at a moment when the political pressure on Big Tech over kids' online safety has hit something close to a fever pitch, and when Sacramento has firmly decided it's not waiting for Congress to act.
For parents in California and, frankly, everywhere else, this is one of those stories that sounds dry until you realize what it's actually about: a multibillion-dollar industry that has been quietly treating your child's digital footprint like a commodity.
What the Law Actually Does
The new California measure puts hard limits on what tech companies can do with data collected from users under 18. Selling it, sharing it, using it to build behavioral profiles for ad targeting. All of it is in the crosshairs. The companies doing this aren't fringe actors. They're household names with headquarters a short drive from San Jose, with campuses in Menlo Park, with offices overlooking San Francisco Bay.
California already has the California Consumer Privacy Act on the books, plus the California Age-Appropriate Design Code, which a federal court partially blocked last year. This new law is another layer, and supporters say it closes gaps that predatory data brokers have been slipping through for years.
The message from Sacramento is hard to misread: we're coming back, and we're coming back louder.
Why Silicon Valley Should Be Nervous
Here's the uncomfortable math for the tech industry. California has 39 million people and the fifth-largest economy on the planet. When California writes a privacy rule, companies rarely build two separate products, one for Californians and one for everyone else. They change the product. Full stop. That's how California's auto emissions standards ended up reshaping the entire U.S. car industry for decades. Same logic applies here.
Tech lobbyists have spent years arguing that self-regulation is sufficient, that parents have tools, that the existing patchwork of federal law covers what needs covering. The California legislature just looked at that argument and voted no.
The federal Children's Online Privacy Protection Act, known as COPPA, has been on the books since 1998. It was written when dial-up modems were still a thing. The internet that COPPA was designed to regulate bears almost no resemblance to the one kids use today, and everyone in Washington knows it. Congress has talked about updating it for years. California, characteristically, got tired of waiting.
The Kids Who Got Caught in the Middle
The people this law is designed to protect aren't abstractions. They're teenagers on TikTok whose watch history, search behavior, and emotional reactions to content have been packaged and sold to advertisers. They're 12-year-olds whose gaming habits generate detailed psychological profiles. They're kids who, by every legal definition, cannot consent to contracts but whose digital lives are being monetized with remarkable precision.
Advocacy groups pushing for stronger protections have argued for years that data brokers operating in the background, often invisible to parents and kids alike, are the real threat. A social media app at least has a face. A data broker operating out of a nondescript office park has none. California's law is written to catch both.
See also: Your Employer Isn't Paying You Right: How to File a Wage Claim With the California Labor Commissioner · How to Get Your California Motorcycle License: M1 and M2 Endorsement Requirements Explained
Critics of the legislation, and there are some, argue that it's vague enough to create compliance chaos, that smaller tech companies will bear the real burden while giants absorb the legal costs, and that enforcement will be the usual California problem: aggressive on paper, patchy in practice. Those are fair concerns. They're also a reason to watch how the attorney general's office actually uses this law once it's on the books, not just a reason to dismiss it.
The Bigger Picture
California didn't invent the idea of protecting children from corporate data collection. The European Union's GDPR has had strict rules on minors' data for years. The UK passed its own Age Appropriate Design Code. But the United States has been a notable laggard, and the gap between what American kids are exposed to and what European kids are legally shielded from has grown embarrassing.
The Silicon Valley angle here isn't incidental. It's the whole point. The companies most directly affected by this law are the same ones whose founders and executives show up at White House dinners, who fund California political campaigns on both sides, and who have more lawyers on retainer than most states have legislators. Passing a law that actually bites them takes a certain amount of political nerve, whatever you think of the specifics.
Other states are watching. They always do when California moves. Florida, Texas, and Colorado have each floated similar proposals in recent sessions. None have gone as far, or as fast.
Silicon Valley spent two decades telling the world that data is the new oil. California just decided that when the people producing that oil are children, different rules apply.