Online service, product, or feature: access by children.

The bill text was reformatted from a traditional legislative document layout (with line numbers, page headers, and formal spacing) to a web page display format with navigation elements, quick search fields, and version history links. The substantive legal content is unchanged.

The bill was restructured from adding a single section (22588.3.5) to an existing chapter into creating an entirely new Chapter 22.1.5 (Sections 22583-22583.4) in Division 8 of the Business and Professions Code. The title changed from 'Youth Social Media Protection Act' to a general act relating to business, expanding applicability from large social media platforms to any online service, product, or feature likely to be accessed by children.

The requirement for large social media platforms to create a process by which a verified reporter can report social media-related threats or terms-of-service violations posing risk to minors was removed.

Two new coauthors were added: Assembly Members Kalra and Stefani.

Civil penalties were doubled: negligent violations increased from $2,500 to $5,000 per affected child, and intentional violations increased from $7,500 to $15,000 per affected child.

The requirement for the Attorney General to submit a report to the Legislature on children's safety features on social media platforms (former Section 22588.3.5) was removed.

Section 22583.1(a)(1) now explicitly references subdivision (b) of Section 1798.501 of the Civil Code as the standard for age estimation, tying the requirement to an existing statutory framework.

The amendment to Section 26000.5 of the Business and Professions Code (cannabis manufacturing requirements regarding licensed cultivator sourcing and industrial hemp prohibition) was entirely removed from the bill.

A new Chapter 22.1.5 (Sections 22583 through 22583.4) was added to Division 8 of the Business and Professions Code, creating a standalone statutory framework for child online privacy that applies to any business providing an online service, product, or feature likely to be accessed by children under 18.

Businesses must estimate child users' age with reasonable certainty, set default privacy settings to a high level of privacy, provide clear age-appropriate privacy information, give obvious signals when a child is being monitored or tracked, and provide accessible tools for exercising privacy rights.

Businesses are prohibited from using children's personal information in ways known to cause significant mental suffering or discrimination, profiling a child by default, collecting unnecessary personal information, repurposing collected data, collecting precise geolocation by default, using dark patterns to extract data from children, and retaining age-estimation data longer than necessary.

Civil penalties of up to $2,500 per affected child for negligent violations and up to $7,500 per affected child for intentional violations are imposed, enforceable only by the Attorney General. No private right of action is created. Recovered penalties go to the Consumer Privacy Fund.

New definitions established for 'child' (under 18), 'default,' 'likely to be accessed by children' (with six specific indicators including COPPA-directed services, audience composition evidence, child-targeted advertising, similar services, child-appealing design elements, and internal company research), 'online service, product, or feature' (excluding broadband access, telecommunications services, and physical product delivery), and 'profiling.'

Three coauthors (Aguiar-Curry, Bauer-Kahan, Petrie-Norris) were added, and the fiscal committee designation changed from 'no' to 'yes,' indicating a state fiscal impact review is now required.

A new Section 22588.3.5 was added to the Business and Professions Code requiring the Attorney General to submit a report to the Legislature on children's safety features on social media platforms. This ties into the existing Youth Social Media Protection Act framework.

The cannabis provision (Section 26000.5) had a minor typo fixed: 'shall only use use only' was corrected to 'use only.' No substantive policy change to the cannabis rule.

The fiscal committee designation changed from 'no' to 'yes,' indicating the new Attorney General reporting requirement triggers a fiscal impact review.