Brazil gives parents social media controls for their kids. Why doesn’t California?

This story was produced in partnership with Agência Pública as part of a series on how regulatory solutions adopted in Brazil could point the way for the U.S. Reporting by Colin Lecher and Maria Martha Bruno.

Alarming trends in teen mental health and increased social media use led California to pass a new wave of laws to protect kids online. 

The state enacted protections to prevent children’s data from being sold, to give kids an opportunity to delete what they post, and to require businesses that target children to manage potential risks. Future legislation could ban social media altogether for many teens.

Some of those regulations face legal challenges, but together, the laws amount to some of the strictest privacy safeguards for children in the United States. 

California’s laws are considered stronger than the federal Children’s Online Privacy Protection Act, or COPPA, which is geared toward protecting children’s privacy. Under that law, website operators must obtain parental permission before collecting information on kids under 13 if their site is targeted toward, or knowingly collects information about children.

California’s laws expand the ages protected and place further restrictions on product design. To some extent, California sets childrens’ privacy policy for the entire country, since companies may choose to provide California’s more stringent protections to children nationwide rather than carve out protections just for the most populous U.S. state. 

But despite policies that are extensive when compared to the rest of the country, California’s regulations still lag well behind those of other countries. As California passed various child privacy laws, countries like Brazil passed comprehensive legislation that overlaps with some California policies, while going even further. 

Experts say the United States and California face unique hurdles in passing children’s privacy laws that other countries don’t. Among those are First Amendment challenges, different conceptions of privacy, and — maybe most importantly — a tech industry that sees strict privacy laws as an existential threat to its future. 

A child privacy push

California has led the way nationally for a decade on protecting kids online, and more recently has picked up more steam. 

“California, everything there is changing and changing fairly dramatically within the last just four years,” said Ed Howard, Senior Policy Advocate for the Children’s Advocacy Institute at the University of San Diego.

Like the federal law, the California Consumer Privacy Act, passed in 2018, requires companies to obtain parental permission to collect data on kids under13. But it also protects teens between 13 and 16 by forcing companies to make them consent before their data can be gathered. 

In 2022, the Legislature enacted the California Age-Appropriate Design Code Act. That law requires companies to estimate ages, then ensure they provide, by default, strict privacy protections for underage users. The law also limits the use of so-called “dark patterns,” which provide an illusion of choice for users while steering their behavior in certain directions.

“If there’s a product that’s likely to be accessed by children, it has to be, by design and by default, safe for them,” said Assemblymember Buffy Wicks, an Oakland Democrat who worked on that legislation.

Wicks also authored a measure that next year will require companies to include a “signal” system that will tell businesses a device user’s approximate age. The law would be among the strictest in the country, although a series of legal challenges by the tech industry have left it partly defanged.

Another law, the Protecting Our Kids from Social Media Addiction Act of 2024, bans social media companies from showing minors “addictive” feeds without parental consent and limits the hours when companies can send notifications to teens. The law, which goes into effect in 2027, has already survived legal challenges. 

Bills now before the Legislature would ban kids under 16 from “addictive” social media entirely, in a step that has earned the ire of some online privacy groups over fear it would end online anonymity by requiring age verification at sign-up. 

More recently, the state has begun regulating artificial intelligence, passing a law to impose mental health safeguards on chatbots. That legislation was passed in response to a series of troubling incidents, including the death of California teenager Adam Raine, who talked about suicide with ChatGPT for months before eventually taking his own life. The death is just one in a series of several incidents involving teens that have alarmed legislators. 

Raine’s mother, Maria, recently testified in front of Senate Privacy, Digital Technologies, and Consumer Protection Committee, calling for stricter protections. ChatGPT, she said, was “a homework helper [that] turned into a confidant, then a suicide coach.”

Under a law enacted last year, AI chatbots are required to disclose that they are not real people and companies must take reasonable steps to prevent children from seeing graphic content. 

The Legislature is considering bills to further govern how chatbots can interact with kids online. Those would require AI companies to make annual risk assessments on potential mental health harms and create controls that let parents limit how kids interact with bots. 

The flurry of legislation is a marked contrast to the federal picture, as Congress has repeatedly failed to agree on terms for national laws. 

This session, lawmakers are considering the Kids Internet and Digital Safety (KIDS) Act, which would expand several privacy laws. Among them would be applying COPPA protections to everyone under 18 and prohibiting targeting online ads toward children and teens. 

But the act faces criticism from child safety advocates for not forcing strong enough legal obligations on tech companies, and from civil rights organizations over free speech concerns. The act may be doomed as the House and Senate argue over its provisions. 

International, comprehensive

For years, advocates have pointed to research linking teens’ mental health to social media use in arguing for stronger protections. A substantial proportion of teens say social media has damaged their mental health, and heavy social media use is linked to increased risk of anxiety and depression. 

Recently, Meta and YouTube were found liable in a landmark lawsuit accusing them of knowingly creating platforms with features that were addictive and harmful to children and teens. That suit argued that internal documents showed how the company was aware of the damage their services could do, but allowed kids to use them anyway. 

Other countries have taken a more comprehensive route than the United States, passing packages of laws specifically meant to cover children’s data and social media use. “I look at what’s happening in the U.K., I look at what’s happening in Australia,” said Wicks, who said she’s recently met with British and Greek policymakers about children’s privacy issues.

“We steal good ideas when we see them from other places,” she said, saying the Age-Appropriate Design Code Act was “wholesale borrowed from the UK.”

In Brazil, the ECA Digital comprehensive children’s privacy act became law this year despite tech industry lobbying. 

The act forbids companies from targeting ads to children based on their online behavior. It also requires parental supervision tools and defaults to the most protective privacy settings for kids. It also bans potentially addictive features like autoplay and infinite scroll for kids. 

Some legal experts see how provisions of that law and others could be imported to the United States, possibly through a state like California. 

Mariana Olaizola Rosenblat, a policy advisor on technology and law at the NYU Stern Center for Business and Human Rights, pointed out that there’s already some consistencies between regulations in Brazil and California.

“I think there’s quite a bit of overlap, but where they diverge is mostly because of specific constitutional features of the U.S. legal system,” she said. The First Amendment has often been used in legal challenges brought by the tech industry against laws limiting what content their algorithms show. 

Olaizola Rosenblat, who has studied global privacy laws, said provisions in the ECA Digital, like a requirement that social media sites offer parental supervision tools, could be imported to the U.S., too. Those tools allow parents to control features and content their kids see, including by setting limits on messaging, screen time, automatic playback, and rewards. She points out that California has also passed provisions like privacy-by-default settings for child users and limits on advertising.

International laws can often go further in placing limits on the content that minors might see because the countries don’t have the same guaranteed speech rights. “They’re able to regulate that in a way that I don’t think the U.S. can under the First Amendment,” she said. 

Texas Tech University researcher Marina Petric said this amounts to “First Amendment fundamentalism.”

“The U.S. narrative has been embedded into the architecture of digital platforms as though it were a universal standard,” she said. “Those who reject this premise are portrayed as supporters of censorship. But freedom of expression defined by one side and applied only to some is not freedom of expression — it is a tool of power.”

Ultimately, there are ways to take pieces of international laws and import them, Olaizola Rosenblat said. There are at least parts of laws like the ECA Digital that are compatible with legal rights in the U.S. 

“Our system is uniquely vulnerable to the power of that money.”

Ed Howard, University of San Diego

Howard adds that the structure of the U.S. government makes it easier to pass individual laws than major packages all at once. He also points out that privacy issues are constantly evolving, and slow-moving bodies like Congress have trouble keeping up. 

But both Howard and Olaizola Rosenblat believe the major barrier to a stricter children’s privacy law is a single issue: the influence of tech industry cash.

“The thing that is by a wide margin, the biggest reason, is the power of money in our system and the fact that our system is uniquely vulnerable to the power of that money,” Howard said.

In 2025, tech companies pushing for fewer regulations on AI and cryptocurrency poured more than $39 million into political spending and lobbying, according to a CalMatters analysis. The companies say the money goes toward supporting candidates that protect their industry, but critics say the companies are exerting undue influence.

As part of its spending, Meta gave $150,000 to the California Democratic Party and $20 million to a new political committee. While lawmakers questioned how best to regulate AI last year, the company spent far more than any other previous year. Meta said the money was “to help elect state political candidates in California — no matter their party affiliation — that support and defend the American tech industry.”

That’s only the tip of the iceberg. Tech companies spend tens of millions more every year lobbying Congress. 

“I think the main problem is the tech lobby, which is very successful in the U.S. and maybe not as successful in other jurisdictions like Brazil,” Olaizola Rosenblat said. “Because they know that the most threatening thing to them would be a federal law in the U.S.”

While other countries get lobbied, the U.S. is a uniquely gigantic market, and California is the tech industry’s home base. Tech giants are willing to push back hard against laws that threaten their business model in the country, and that includes for laws aimed at protecting kids. 

“When it comes to privacy, every business has a financial stake in there being very little privacy,” Howard said.