US States · 7 laws · 32 requirements
California: the laws your website or app must follow
If your customers are in California, these are the privacy, consumer, security, accessibility and AI laws SafeLaunch checks your site against, with what each one requires and where in the law it says so.
Coming up in California
- 2027-01-01 · California Age-Appropriate Design Code (partly enjoined) (date not confirmed): Text read from a non-official mirror; operative date believed 1 Jan 2027 (no urgency clause); to be re-checked on leginfo.
- 2027-01-01 · CCPA / CPRA: New regulations (ADMT, risk assessments, cybersecurity audits) effective 1 Jan 2026, with ADMT compliance from 1 Jan 2027 and audits phased 2028–2030.
- 2027-07-01 · California AI laws (BOT Act, SB 243 companion chatbots, AI Transparency Act): SB 243 from 1 Jan 2026 (annual reports from 1 July 2027);
How a SafeLaunch audit checks each one
- CheckedChecked automatically on every scan
- AI reviewLooked for by the AI analysis, reported only with evidence
- Your answersDecided from your answers to the audit questions
- PreparedPrepared for you in the report's compliance pack
- You confirmA scan can't see this; you need to confirm it
CCPA / CPRA
In force.
Who it covers: For-profit businesses with over ~$26.6M revenue, or that handle 100,000+ California consumers' data, or earn half their revenue from selling/sharing data.
What it requires of a website or app (12)
- A privacy policy: categories collected, purposes, sources, recipients, rights and how to use them, updated every 12 monthsChecked§1798.100, .130; Regs §7011
- A notice at collection where data is collectedChecked§1798.100(a); Regs §7012
- A "Do Not Sell or Share My Personal Information" link when sharing for cross-context adsChecked§1798.135
- Honour Global Privacy Control as an opt-out of sale/sharingAI reviewRegs §7025
- A "Limit the Use of My Sensitive Personal Information" link where sensitive data is used beyond what's necessary (if if you use sensitive personal information)Your answers§1798.121
- Rights to know, delete, correct and opt out, answered within 45 days, with two request methodsChecked§1798.105–.130
- Opt-in consent to sell or share data of consumers under 16 (if if under-16s use the product)Your answers§1798.120(c)
- Reasonable security (with a private right of action for breaches)Checked§1798.150; Civ. Code §1798.81.5
- Contracts with service providers and contractors containing the required termsPrepared§1798.100(d); Regs §7051
- Pre-use notice and opt-out for automated decision-making used for significant decisions (if if ADMT makes significant decisions)Your answersRegs §7220 (from 1 Jan 2027)
- Risk assessments for high-risk processing; cybersecurity audits for larger businessesPreparedRegs §7150, §7120
- Consent flows free of dark patterns (symmetry of choice)CheckedRegs §7004
Sources:CPPA regulations
CalOPPA
In force.
Who it covers: Any commercial website or app collecting personal information from California residents, at any size.
What it requires of a website or app (5)
- A conspicuously posted privacy policyCheckedB&P §22575(a)
- It lists the categories collected and the third parties they're shared withChecked§22575(b)(1)
- It says how users can review and correct their information, if offeredChecked§22575(b)(2)
- It says how the site responds to Do Not Track signals, and whether third parties track across sitesChecked§22575(b)(5)–(6)
- It has an effective date and explains how users are told of changesChecked§22575(b)(3)–(4)
Sources:B&P Code §22575
California Age-Appropriate Design Code (partly enjoined)
Partial: AB 2246 (Ch.
Who it covers: Businesses covered by the CCPA that run online services likely to be accessed by children under 18.
What it requires of a website or app (2)
- Estimate users' age or apply child-level protections to all users (if if children use the product)Your answersCiv. Code §1798.99.29(a)(1)
- High privacy settings by default for children (if if children use the product)Your answers§1798.99.29(a)(2)
Sources:AB 2246 (Wicks), chaptered text, CalMatters mirror (leginfo to be re-checked) NetChoice v. Bonta (Cooley)
Unruh Act (accessibility)
In force; an ADA violation is an Unruh violation ($4,000 minimum statutory damages).
Who it covers: Businesses serving Californians, including websites tied to them.
What it requires of a website or app (1)
- The site is usable by people with disabilities (WCAG 2.1 AA as the benchmark)CheckedCiv. Code §51(f), §52
Sources:Civil Code §51
Automatic Renewal Law
In force; amended by AB 2863 from 1 July 2025 (express consent, online cancellation, annual reminders).
Who it covers: Businesses offering automatically renewing subscriptions to California consumers.
What it requires of a website or app (4)
- Renewal terms shown clearly and near the request for consent, before the subscription starts (if if you sell subscriptions)CheckedB&P §17602(a)(1)
- Express affirmative consent to the renewal terms, and an acknowledgement sent afterwards (if if you sell subscriptions)CheckedB&P §17602(a)(2)–(3)
- Cancellation online, in the same way the customer signed up, with no obstruction (if if you sell subscriptions)CheckedB&P §17602(d)
- An annual reminder for yearly plans, and notice before price changes (if if you sell subscriptions)AI reviewB&P §17602(b), (h)
California AI laws (BOT Act, SB 243 companion chatbots, AI Transparency Act)
BOT Act in force since 1 July 2019; SB 243 from 1 Jan 2026 (annual reports from 1 July 2027); AI Transparency Act (SB 942) operative 2 Aug 2026.
Who it covers: Bots that talk to Californians to sell or persuade; operators of AI companion chatbots; generative AI providers with over 1 million monthly users.
What it requires of a website or app (5)
- A bot used to sell something or influence a vote says it is a bot (if if the product uses a chatbot)CheckedB&P §17941 (SB 1001)
- Companion chatbots tell users clearly they are talking to AI (if if you offer an AI companion chatbot)CheckedSB 243
- Companion chatbots have a protocol for suicidal ideation and self-harm that refers users to crisis services (if if you offer an AI companion chatbot)AI reviewSB 243
- Known minors get break reminders at least every 3 hours and no sexually explicit content (if if minors can use an AI companion chatbot)AI reviewSB 243
- Large generative AI providers offer a free AI-detection tool and embed disclosures in images, video and audio they generate (if if you provide generative AI to over 1 million monthly users)AI reviewB&P §22757 (SB 942)
CIPA (wiretapping and tracking claims)
In force.
Who it covers: Any website or app used by people in California.
What it requires of a website or app (3)
- No chat widget, session recording or ad pixel that captures what visitors type or do before they are told and agreeCheckedPenal Code §631(a)
- No tracking tool that collects device and routing information (a 'pen register') without consentCheckedPenal Code §638.51
- Tell people a chat is recorded or handled by a third party, in the chat and in the privacy notice (if if you offer chat)AI reviewPenal Code §631–632.7
Sources:California Penal Code §631
Licensed professionals in California
These regulators' advertising and conduct rules apply on top of the laws above, only to sites of that profession.
Check your site against California's rules
A free scan checks your website or app against these rules in about a minute and shows what applies, with evidence from your pages. The full report gives the exact fix for each finding.
Check my site freeOne free fix in your inbox each week
A new copy-paste prompt for Lovable, Cursor or Claude Code every week, with the rule behind it and how to check it worked, plus the Monday briefing on new laws and deadlines. No spam, unsubscribe in one click.
By signing up you agree to get these weekly emails. We send it with Kit, and you can unsubscribe at any time. What we share with Kit is in our privacy notice.
A plain-language summary of what each law requires of a website or app, from the SafeLaunch rulebook, with the provision and official sources. It is not legal advice and not every duty in each law is listed.