This was a legislative and policy week rather than an enforcement one. Brussels put its child online safety proposal on the table, California's governor had two sets of privacy-adjacent bills waiting on his desk, and the debate over how fast to develop frontier AI moved into Congress. Here's what mattered.
New and Pending Legislation
The European Commission formally unveiled the EU KIDS Act on September 17↗, a day after President Ursula von der Leyen previewed it in her State of the Union address. The proposal sets age tiers for social media and related services: no accounts for children under 13, limited and guardian-supervised accounts for 13 and 14, and full accounts from 15 in a safe-by-design environment. Hunton's summary↗ describes a scope that reaches social networking and video-sharing services along with AI companions, general chatbots, and online games, while IAPP reports it centers on very large online platforms designated under the Digital Services Act.
The obligations are the part to watch. Covered providers would have to use privacy-preserving age assurance, including the EU's age verification tool, which IAPP says is expected by the end of 2026, and avoid features such as addictive design, profiling-based recommender feeds, infinite scroll, and push notifications during sleeping hours. IAPP reports that the burden of proof would shift to platforms to show they follow safety-by-design principles, that investigations would be fast-tracked to 90 days, and that penalties could reach 6% of global annual revenue. It is only a proposal: it now goes to the European Parliament and the Council, and neither source gives a timeline for adoption.
Von der Leyen's address also set up more to come. According to IAPP's coverage of the speech↗, a Digital Fairness Act addressing addictive design and dark patterns is due this fall, and in November the Commission will propose prioritizing AI integration in five sectors: health, transportation, agriculture and food, advanced manufacturing, and defense and space. She also said the Commission would invite frontier AI developers to discuss how public authorities can support efforts to slow the pace of development.
In California, two sets of bills were still awaiting Governor Newsom, who had until September 30 to sign or veto. Covington noted that SB 690, which would end private lawsuits over website-based pen-register claims↗ under CIPA, passed the Legislature on August 28 after clearing the Senate 35-0 in June 2025 and being amended in the Assembly on July 1, 2026. Those claims could then be brought only by the Attorney General. The bill would apply retroactively to pending claims, which Covington reads as reaching actions filed on or after January 1, 2025, and would take effect January 1, 2027 if signed or left unsigned. Private claims under CIPA's wiretapping and confidential-recording provisions (Sections 631 and 632) would remain.
The other set was three AI employment bills↗: SB 947, the "No Robo Bosses Act," which limits automated decision systems in discipline and termination and requires human corroboration (proposed effective date July 1, 2027); SB 951, which adds Cal/WARN notice requirements when layoffs are caused in whole or substantial part by AI or automation (January 1, 2027); and AB 1883, which bars employer surveillance tools from inferring emotional states or collecting neural data, with safety and certain federal-contract exceptions (January 1, 2027). For now this is a watch item, not a compliance deadline.
Also worth noting
The pace of frontier AI development became a policy topic in its own right. IAPP reports that Anthropic CEO Dario Amodei published an essay urging AI companies to slow the improvement of model capabilities↗ until safeguards catch up, and that executives including OpenAI's Sam Altman publicly backed the call while Microsoft's Satya Nadella supported independent safety evaluators but was skeptical of a broader slowdown. The concrete steps discussed include embedding third-party evaluators, and reactions diverged: China's Foreign Ministry said it has no plans to slow its own development, and President Trump opposed slowing American AI.
In Congress, IAPP's follow-up↗ describes a bipartisan bill from Reps. Jay Obernolte and Lori Trahan setting safety obligations for frontier developers, under review by the House Energy and Commerce Committee, and reported talks between Sens. Ted Cruz and Amy Klobuchar on a proposal that could require government approval before certain models launch, with no bill introduced from those talks yet. For privacy and security teams, the provisions to watch are the ones on risk-management frameworks, independent audits, and incident reporting.
The Takeaway
Child online safety is converging on a common toolkit: age tiers, age assurance, and bans on engagement-maximizing design. The EU has now put that toolkit into a single proposal, and California enacted its own minors' package earlier this month. If your service reaches minors, the practical steps are to map where age is known or inferred today, review features such as autoplay, infinite feeds, and nighttime notifications, and watch the Digital Fairness Act for dark-pattern rules. On the California side, SB 690's fate was due by September 30, and even if signed it would leave wiretapping-style claims untouched, so keep that exposure on a separate track.