---
title: SB 495. "Age-Appropriate Design Code Act"; enact
collection: bills
id: 2025-2026/sb495
cite_as: SB 495, 2025-2026 Regular Session (Ga.)
canonical_url: https://georgiacommons.org/bills/2025-2026/sb495
md_url: https://georgiacommons.org/bills/2025-2026/sb495.md
text_url: https://georgiacommons.org/bills/2025-2026/sb495/text
source_url: https://www.legis.ga.gov/legislation/73129
date: 2026-02-12
status: introduced
corpus_version: bills-2026-09-13
license: Public record of the Georgia General Assembly, via LegiScan; see about.md
publisher: Georgia Commons, an independent project of Georgia Civic Data. Not the State of Georgia. Not legal advice.
up: https://georgiacommons.org/bills/2025-2026.md
previous: https://georgiacommons.org/bills/2025-2026/sb494.md
next: https://georgiacommons.org/bills/2025-2026/sb496.md
index: https://georgiacommons.org/bills/index.md
omitted: votes and history
omitted_chars: 95
omitted_url: https://georgiacommons.org/bills/2025-2026/sb495.md?full=1
bill_number: SB 495
session: 2025-2026 Regular Session
session_slug: 2025-2026
chamber: Senate
bill_type: bill
status_date: 2026-02-11
last_action: Senate Read and Referred
sponsors:
- Sally Harrell
- Shawn Still
- Ed Setzler
- Bo Hatchett
- Marty Harbin
- Carden Summers
- Frank Ginn
- Ricky Williams
- Lee Anderson
- Elena Parent
- Harold Jones
- Ben Watson
- Clint Dixon
- Nikki Merritt
- Nan Orrock
- Russ Goodman
- Nabilah Islam Parkes
- Josh McLaurin
- Max Burns
- Blake Tillery
- Brian Strickland
- Chuck Payne
- Mike Hodges
- Billy Hickman
- Chuck Hufstetler
- Sonya Halpern
- Jason T. Dickerson
- Kenya Wicks
- Gail Davenport
- Tonya Anderson
- Jaha Howard
- Sam Watson
- Freddie Sims
- RaShaun Kemp
- Kim Jackson
- Ed Harbison
- Randal Mangham
- Drew Echols
- Derek Mallow
- Donzella James
text_version: Introduced
has_text: true
legiscan_url: https://legiscan.com/GA/bill/SB495/2025
upstream_id: 2114625
summaries_model: claude-sonnet-5
topic_tags:
- online privacy
- children's online safety
- social media regulation
- data protection law
- consumer protection
---
# SB 495. "Age-Appropriate Design Code Act"; enact
## Text
Senate Bill 495
By: Senators Harrell of the 40th, Still of the 48th, Setzler of the 37th, Hatchett of the 50th,
Harbin of the 16th and others
A BILL TO BE ENTITLED
AN ACT
To amend Chapter 1 of Title 10 of the Official Code of Georgia Annotated, relating to selling
and other trade practices, so as to enact the "Age-Appropriate Design Code Act"; to provide
restrictions on high-risk data practices relating to minors; to provide for requirements on
covered entities; to prohibit certain high-risk data practices or design features relating to
minors; to provide for enforcement by the Attorney General; to provide for rules and
regulations; to require such rules and regulations to be updated biennially; to provide for risk
assessments prior to certain design changes; to require documentation and retention of such
risk assessments; to require independent auditing of risk assessments; to require certain
default settings; to require that algorithmic feeds provided to minors meet certain criteria; to
require the ability for a minor to request the deletion of any personal data held by covered
entities; to require covered entities to provide public notice of privacy information, terms of
service, and community standards; to provide for enforcement of this article under the "Fair
Business Practices Act"; to provide for penalties; to provide for exclusions; to provide for
statutory construction; to provide for definitions; to provide for effective dates; to provide
for related matters; to repeal conflicting laws; and for other purposes.
BE IT ENACTED BY THE GENERAL ASSEMBLY OF GEORGIA:
SECTION 1.
Chapter 1 of Title 10 of the Official Code of Georgia Annotated, relating to selling and other
trade practices, is amended by adding a new article to read as follows:
"ARTICLE 38
10-1-970.
This article shall be known and may be cited as the 'Age-Appropriate Design Code Act.'
10-1-971.
As used in this article, the term:
(1) 'Adult' means a consumer who is not a minor.
(2) 'Affiliate' means a legal entity that controls, is controlled by, is under common
control with, or shares common branding with another legal entity. As used in this
paragraph, the term 'control' or 'controlled' means ownership of, or the power to vote on,
more than 50 percent of the outstanding shares of any class of voting securities of a
covered entity, control in any manner over the election of a majority of the directors or
of individuals exercising similar functions, or the power to exercise a controlling
influence over the management of a covered entity.
(3) 'Age status' means one of the following age categories:
(A) Zero to five years of age, or preliterate and early literacy;
(B) Six to nine years of age, or core primary school years;
(C) Ten to 12 years of age, or transition years;
(D) Thirteen to 15 years of age, or early teens; and
(E) Sixteen and 17 years or age, or approaching adulthood.
(4) 'Algorithmic feed' means a component of an online service, product, or feature that
displays or delivers a stream or list of media that is selected, ranked, or arranged in whole
or in part by an algorithmic recommendation system.
(5) 'Algorithmic recommendation system' means a computational process used to
determine the selection, order, rank, relative prioritization, or relative prominence of
media provided to a consumer through an online service, product, or feature, including
search results, ranking, recommendations, display, or any other method of automated
selection. Such term shall not include a computational process which:
(A) Enables consumers to find specific other consumers on a covered entity's online
service, product, or feature, such as by entering an individual's information as a search
query or uploading a list of contacts;
(B) Returns media responsive to a consumer's search query, so long as the system does
not process other personal data of the consumer to determine the selection, order, rank,
relative prioritization, or relative prominence of the media; or
(C) Associates the search query with the consumer after search results are returned.
(6) 'Biometric data' means data generated from the technological processing of a person's
unique biological, physical, or physiological characteristics that allow or confirm the
unique identification of the consumer.
(7) 'Collect' means buying, renting, gathering, obtaining, receiving, or accessing any
personal data pertaining to a consumer by any means. This includes receiving data from
the consumer, either actively or passively, or by observing the consumer's behavior.
(8) 'Compulsive use' means a pattern of repetitive use of a covered entity's product or
service that is engrossing and irresistible for a consumer and that materially disrupts the
daily life of a consumer.
(9) 'Consumer' means a natural person residing in this state. Such term shall not include
an individual acting in a commercial or employment context or as an employee, owner,
director, officer, or contractor of a company, partnership, sole proprietorship, nonprofit,
or government agency whose communications or transactions with the covered entity
occur solely within the context of the individual's role with the company, partnership,
sole proprietorship, nonprofit, or government agency.
(10) 'Covered entity' means a sole proprietorship, partnership, limited liability company,
corporation, association, or other legal entity that conducts business in this state and is
organized or operated for the profit or financial benefit of its shareholders or other owners
and which:
(A) Generates a majority of its annual revenue from online services, products, or
features;
(B) Operates or develops online products, services, or features which are reasonably
likely to be accessed by a minor; and
(C) Collects consumers' personal data or has consumers' personal data collected on its
behalf by a processor and determines, jointly or solely, the purpose and means of the
processing of consumers' personal data.
(11) 'Default' means a preselected option adopted by the covered entity for its online
service, product, or feature.
(12) 'De-identified data' means information that does not identify and cannot reasonably
be used to infer information about, or otherwise be linked to, an identified or identifiable
individual, or to a device linked to such individual, or linked to one or more identifiable
individuals in a household, provided that the covered entity possessing the data:
(A) Takes reasonable measures to ensure that the data cannot be associated with a
natural person, including the de-identification requirements set forth in 45 C.F.R.
Section 164.514;
(B) Publicly commits to maintain and use the data only in a de-identified fashion and
not attempt to re-identify the data; and
(C) Contractually obligates any recipients of the data to comply with all provisions of
this article.
(13) 'Derived data' means data created by the derivation of information, assumptions,
correlations, inferences, predictions, or conclusions from facts, evidence, or other sources
of information or data about a minor or a minor's device.
(14)(A) 'Design' or 'design feature' means any aspect of an online service, product, or
feature that a covered entity develops or creates, in whole or in part, to facilitate use of
the online service, product, or feature. Such term shall include, in whole or in part, any:
(i) Algorithmic recommendation system;
(ii) Algorithmic feed;
(iii) Consumer interface;
(iv) Notification or push alert system;
(v) Processing of personal data; and
(vi) Reward or incentive system.
(B) Such term shall not include any:
(i) Media generated by a consumer;
(ii) Content moderation policy; or
(iii) Component of an algorithmic recommendation system that enforces the covered
entity's content moderation policies.
(15) 'Direct messaging' means sending a private single or group message to one or more
other consumers that is separate from public posts.
(16) 'Genetic data' means any data, regardless of its format, that results from the analysis
of a biological sample of a person, or from another source enabling equivalent
information to be obtained, and includes genetic material, including deoxyribonucleic
acids (DNA), ribonucleic acids (RNA), genes, chromosomes, alleles, genomes,
alterations or modifications to DNA or RNA, single nucleotide polymorphisms (SNPs),
epigenetic markers, uninterpreted data that result from analysis of a biological sample or
other source, and any information extrapolated, derived, or inferred therefrom.
(17) 'Media' means any text, image, video, or audio recording.
(18) 'Minor' means a consumer who a covered entity knows or should reasonably know
is under the age of 18 years.
(19) 'Online service, product, or feature' means a digital product that is accessible to the
public via the internet, including a website or mobile application. For the purpose of this
paragraph, the following are not included:
(A) Telecommunications service, as defined in 47 U.S.C. Section 153;
(B) A broadband service, as defined in 47 C.F.R. Section 54.400; or
(C) The in-person sale, delivery, or use of a physical product.
(20) 'Personal data' means any information, including derived data and unique identifiers,
that is linked or could reasonably be linked, alone or in combination with other
information, to an identified or identifiable individual or to a device that identifies or is
linked to one or more identifiable individuals in a household. Such term shall not include
de-identified data or publicly available information.
(21) 'Process' or 'processing' means any operation or set of operations performed,
whether by manual or automated means, on personal data or on sets of personal data,
such as the collection, use, storage, disclosure, analysis, deletion, modification, or other
handling of personal data.
(22) 'Processor' means a person who processes personal data on behalf of a covered
entity, another processor, or a federal, state, tribal, or local government entity.
(23)(A) 'Publicly available information' means information that:
(i) Is made available through federal, state, or local government records or to the
general public from widely distributed media; or
(ii) A covered entity has a reasonable basis to believe the consumer has lawfully
made available to the general public.
(B) Such term shall not include:
(i) Biometric data collected by an entity about a consumer without the consumer's
knowledge or consent;
(ii) Information collated and combined to create a consumer profile that is made
available to a consumer of a publicly available website, either in exchange for
payment or free of charge;
(iii) Information made available for sale;
(iv) An inference generated from the information described in subparagraph (A) of
this paragraph;
(v) Any obscene visual depiction, as defined in 18 U.S.C. Section 1460;
(vi) Personal data created through the combination of personal data with publicly
available information;
(vii) Genetic data, unless otherwise made publicly available by the consumer to
whom the information pertains;
(viii) Information provided by a consumer on a website or online service made
available to all members of the public, for free or for a fee, where the consumer has
maintained a reasonable expectation of privacy in the information, such as by
restricting the information to a specific audience; or
(ix) Intimate images, whether authentic or computer generated, known or reasonably
believed to be nonconsensual.
(24) 'Reasonable alternative design' means an alternative design feature for which the
risk of causing compulsive use in consumers who are minors is lowered.
(25) 'Reasonably likely to be accessed' means an online service, product, or feature that
is reasonably believed to be accessed by a minor based on any of the following
indicators:
(A) The online service, product, or feature is directed to children, as defined by the
Children's Online Privacy Protection Act, 15 U.S.C. Section 6501, et seq., and the
Federal Trade Commission's rules implementing such act;
(B) The online service, product, or feature is determined, based on competent and
reliable evidence regarding audience composition, to be routinely accessed by an
audience that is composed of at least 2 percent minors; or
(C) The covered entity knew or should have reasonably known that at least 2 percent
of the audience of the online service, product, or feature is composed of minors,
provided that, in making this assessment, the covered entity shall not collect or process
any personal data that are not reasonably necessary to provide an online service,
product, or feature with which a minor is actively and knowingly engaged.
(26) 'Third party' means a person, public authority, agency, or body that is not a minor
or a covered entity.
10-1-972.
(a) A covered entity shall not engage in or use any of the following high-risk data practices
or design features:
(1) Collect, sell, share, or retain any personal data of a consumer that is not necessary to
provide an online service, product, or feature with which a consumer is actively and
knowingly engaged;
(2) Use previously collected personal data of a consumer for any purpose other than a
purpose for which the personal data was collected, unless necessary to comply with any
obligation under this article;
(3) Permit any person, including a parent or guardian, to monitor the online activity of
a consumer or to track the location of a consumer without providing a conspicuous signal
to the consumer when the consumer is being monitored or tracked;
(4) Use the personal data of the consumer to select, recommend, or prioritize media for
the consumer in an algorithmic feed, unless the consumer has explicitly requested to
receive media from a specific account, specific category, or related media;
(5) Use the personal data of the consumer to select, recommend, or prioritize media for
the consumer in an algorithmic feed, unless the personal data are:
(A) Consumer selected privacy or accessibility settings;
(B) The consumer's location, but only to determine whether the consumer is within this
state for purposes of complying with this Code section;
(C) The consumer's age status, but only to implement the covered entity's policies
regarding media appropriate for minors; or
(D) A search query, provided the search query is used only to select and prioritize
media in response to the search;
(6) Send push notifications to the consumer between the hours of 12:00 Midnight
and 6:00 A.M.; or
(7) Use any design feature or component of a design feature that:
(A) Automatically plays a video, unless the video is the next in a series and the
consumer chose to play a prior video in the series;
(B) Uses intermittent, variable reward schedules;
(C) Continuously and seamlessly loads new media in an algorithmic feed and absent
a specific request from the consumer, such as an infinite scroll feed;
(D) Is intended to cause compulsive use; or
(E) Has been identified and declared by the Attorney General as a prohibited data
practice or design feature pursuant to subsection (c) of this Code section.
(b) A covered entity may engage in any of the high-risk data practices or design features
listed in subsection (a) of this Code section if:
(1) The consumer explicitly requests the practice or feature; and
(2) The covered entity has used a commercially reasonable and technically feasible
age-assurance method to determine that the consumer is not a minor.
(c) The Attorney General shall adopt rules and regulations pursuant to this article that
prohibit a covered entity from engaging in or using any data practices or design features
that:
(1) Carry a risk of compulsive use that is not substantially outweighed by any benefits
provided by the practice or feature to consumers; or
(2) Subvert or impair consumer autonomy, decision making, or choice while using the
covered entity's online service, product, or feature.
(d) The Attorney General shall, at least once every two years, review and update the rules
and regulations promulgated under subsection (c) of this Code Section to keep pace with
emerging technology.
10-1-973.
(a) Prior to deploying any new design, or making a material change to an existing design
that will be deployed to consumers, a covered entity shall assess the risk that the design
will cause compulsive use in minors.
(b) For any design that carries a reasonably foreseeable risk of causing compulsive use in
minors, a covered entity shall:
(1) Determine if there is a reasonable alternative design; and
(2) Provide the reasonable alternative design that carries the lowest risk of compulsive
use as a default to each consumer, until:
(A) The consumer explicitly requests the original design; and
(B) The covered entity determines, using a commercially reasonable and technically
feasible age-assurance method, that the consumer is not a minor.
(c) Notwithstanding subsection (b) of this Code section, a covered entity shall not deploy
any design to consumers if its assessed risk of causing compulsive use to minors outweighs
the assessed benefit of the design to minors, unless:
(1) The consumer explicitly requests the design; and
(2) The covered entity determines, using a commercially reasonable and technically
feasible age-assurance method, that the consumer is not a minor.
(d) A covered entity shall assess all existing design and mitigate the risk of causing
compulsive use in minors as described in this Code section.
(e) A covered entity shall document each step taken in accordance with subsections (a),
(b), and (c) of this Code section, along with any experiments, evidence, and data that
support the assessments and determinations made, and retain such documents for a period
of ten years. All data collected about individual consumers to comply with this subsection
shall be de-identified and made anonymous.
(f) A covered entity shall submit annually all records related to the assessments and
determinations made in accordance with subsections (a), (b), and (c) of this Code section
to an independent auditor who shall assess the records for compliance with this Code
section and recommend any changes that would bolster compliance.
(g) Nothing in this Code section shall require a covered entity to:
(1) Assess any media for the risk of causing compulsive use; or
(2) Limit any consumer's access to any specific consumer generated content or category
of consumer generated content.
(h) The provisions of this Code section shall not apply to a covered entity that qualifies as
a small business. To qualify as a small business, a covered entity shall meet the following
criteria for the three preceding calendar years, or for the covered entity's period of existence
if the covered entity is less than three years old:
(1) The covered entity's average annual gross revenues during the three-year period did
not exceed $25 million, as adjusted annually based on the Consumer Price Index as
reported by the Bureau of Labor Statistics of the United States Department of Labor; and
(2) The covered entity, on average, did not annually collect, process, retain, or transfer
the personal data of more than 50,000 people during the three-year period for any purpose
other than initiating, rendering, billing for, finalizing, completing, or otherwise collecting
payment for a requested service or product.
10-1-974.
(a) A covered entity shall configure all default privacy settings provided to a minor
through its online service, product, or feature to the highest level of privacy.
(b) A covered entity shall provide the following settings by default to all minors:
(1) Do not use an algorithmic recommendation system to recommend to adult consumers
that they connect to a minor as a friend, follower, or contact on an online service;
(2) Do not use an algorithmic recommendation system to recommend to adult consumers
that they follow a minor's media, unless the minor's account was connected to the known
adult's account as a friend, follower, or contact prior to the recommendation;
(3) Do not use an algorithmic recommendation system to recommend to adult consumers
that they communicate with a minor through direct messaging, unless the minor's account
was connected to the known adult's account as a friend, follower, or contact prior to the
recommendation;
(4) Do not use an algorithmic recommendation system to recommend to minors that they
communicate with a known adult through direct messaging, unless the minor's account
was connected to the adult's account as a friend, follower, or contact prior to the
recommendation;
(5) Do not display a minor's friends, followers, or contacts; and
(6) Disable search engine indexing of a minor's account profile and media.
(c) A covered entity shall not display the location of any minor to another consumer by
default; provided, however, that a covered entity may display a minor's location to another
consumer when the minor has explicitly chosen to share his or her location with a specific
consumer.
(d) A covered entity shall not send push notifications to any minor by default or provide
a single setting that enable all push notifications.
(e) A covered entity shall provide minors with settings to enable or disable each specific
category of push notification offered by the covered entity's online service, product, or
feature, such as marketing notifications, direct message notifications, media interaction
notifications, and any other category of notification pushed by the product or service.
(f) A covered entity shall:
(1) Disable by default all interaction counts, including counts of reactions and comments,
on all of a minor's media;
(2) Offer settings to minors to enable or disable specific types of interaction counts, such
as comments, reactions, reshares, or other categories of interactions; and
(3) Offer to minors a single setting to enable all interaction counts at once only if the
settings to enable specific interactions are equally or more prominent and accessible.
(g) A covered entity shall not undermine consumer autonomy in settings by:
(1) Providing a minor with a single setting that makes more than one default privacy
setting less protective at once; or
(2) Requesting or prompting a minor to make any setting less protective, unless the
change is strictly necessary for the minor to access a service, product, or feature explicitly
requested by the minor.
(h)(1) A covered entity that facilitates communications between consumers shall provide
a prominent, accessible, and responsive tool that gives minors the option to block specific
consumers from taking, at minimum, each of the following actions:
(A) Accessing the minor's media;
(B) Interacting with the minor's media;
(C) Communicating with the minor through their media;
(D) Communicating with the minor through direct messaging; and
(E) Communicating with the minor through any other means offered by the covered
entity through its product or service.
(2) The tool described in paragraph (1) of this subsection shall provide a minor with the
option to prevent media from a blocked consumer from appearing in the minor's feed.
(3) The tool described in paragraph (1) of this subsection shall, at a minimum, be
accessible from a feature located:
(A) Proximate to every instance of another consumer's username or avatar;
(B) On all media shared by another consumer;
(C) On every direct message or direct message thread; and
(D) In a first-level settings menu labeled 'Blocked Users.'
(4) The features listed in subparagraphs (A), (B), and (C) of paragraph (3) of this
subsection shall provide a minor with the ability to:
(A) Block the other consumer, which shall trigger all of the settings in paragraphs (1)
and (2) of this subsection; or
(B) Go to the settings feature to select more granular block settings for the other
consumer.
(i) A covered entity offering an algorithmic feed to a minor that uses the minor's personal
data to select, recommend, or prioritize media in the feed shall provide a prominent and
accessible interface that enables the minor to:
(1) Explicitly communicate preferences about the types of media to be recommended and
to be blocked in the output of the relevant algorithmic recommendation system;
(2) Access, review, and make changes to any personal data the covered entity uses to
determine the output of the relevant algorithmic recommendation system; and
(3) Ensure that the relevant algorithmic recommendation system is informed by these
preferences.
(j) A covered entity offering an algorithmic feed to a minor that uses the minor's personal
data to select, recommend, or prioritize media in the feed shall provide the minor with the
choice of an algorithmic feed that only selects media from sources the minor affirmatively
chose to follow or otherwise include in the feed.
(k)(1) A covered entity shall provide a prominent and accessible tool to allow:
(A) A minor to request that the covered entity delete any account profiles, media, and
personal data provided by, or obtained about, the minor, including personal data the
minor provided to the covered entity, personal data the controller obtained from another
source, and derived data; and
(B) The parent or legal guardian of a minor to make such a request on the minor's
behalf.
(2) A request made pursuant to this subsection shall be honored no later than 15 days
after a covered entity receives the request.
10-1-975.
A covered entity shall prominently and clearly provide on its website or mobile application:
(1) The covered entity's privacy information, terms of service, policies, and community
standards;
(2) The purpose of the feed and the algorithmic recommendation system used to
determine the feed for each algorithmic feed in use by the covered entity;
(3) For each algorithmic recommendation system in use by the covered entity:
(A) The purpose of the system;
(B) A description of any personal data of minors that is used as an input or to inform
an input;
(C) The source of the personal data;
(D) The purpose of using the personal data; and
(E) How each personal data input is measured and determined, if it is derived data and
is weighed relative to the other inputs reported in this paragraph, and if it is categorized
into one of four quartile groups according to the input's relative importance in
contributing to the system's output; and
(4) For every other feature of the product or service that uses the personal data of minors,
descriptions of:
(A) The purpose of the feature;
(B) The personal data collected by the feature;
(C) The personal data used by the feature;
(D) How the personal data are used by the feature;
(E) Any personal data transferred to or shared with a processor or third party by the
feature, the identity of the processor or third party, and the purpose of the transfer or
sharing; and
(F) How long personal data are retained.
10-1-976.
(a) During the process of conducting age assurance, covered entities and processors shall:
(1) Only collect personal data of a consumer that is strictly necessary for determining a
consumer's age status;
(2) Immediately upon determining that a consumer is a minor, delete any personal data
collected of such consumer for age assurance, except the determination of the consumer's
age status;
(3) Not use any personal data of a consumer collected for age assurance for any other
purpose;
(4) Not combine personal data of a consumer collected for age assurance, except the
determination of the consumer's age status, with any other personal data of the consumer;
(5) Not disclose personal data of a consumer collected for age assurance to a third party
that is not a processor; and
(6) Implement a review process to allow consumers to appeal age status determinations.
(b) A covered entity or processor that complies with all of the provisions of this article
shall not be liable for any inaccuracies in a consumer's age status.
(c) Subject to subsection (d) of this Code section, the Attorney General shall adopt rules
and regulations:
(1) Identifying commercially reasonable and technically feasible methods for covered
entities and processors to determine if a consumer is a minor;
(2) Describing the appropriate review process for consumers appealing age status
determinations;
(3) Describing transparency measures that would increase consumer trust in
age-assurance methods; and
(4) Providing any additional privacy protections for personal data collected for age
assurance.
(d) The Attorney General shall periodically review and update such rules and regulations
as necessary to keep pace with emerging technology.
(e) In adopting such rules and regulations, the Attorney General shall:
(1) Prioritize consumer privacy and accessibility;
(2) Consider the size, financial resources, and technical capabilities of covered entities
and processors;
(3) Consider the costs and effectiveness of available age-assurance methods;
(4) Consider the impact of age-assurance methods on consumers' safety, utility, and
experience;
(5) Consider the efficacy of requiring covered entities and processors to use previously
collected data to determine the age status of some or all consumers or adopting
interoperable age assurance methods; and
(6) Provide consumers with multiple options for age assurance.
10-1-977.
(a) A violation of this article shall constitute an unfair or deceptive act or practice in the
conduct of consumer transactions under Part 2 of Article 15 of this chapter, the 'Fair
Business Practices Act of 1975,' and the enforcement against any such violation shall be
by public enforcement by the Attorney General and shall be enforceable through private
action.
(b) Whenever it may appear to the Attorney General that any covered entity is using or has
used any method, act, or practice declared by this article to be unlawful and that
proceedings would be in the public interest, the Attorney General may bring action in a
court of competent jurisdiction. Upon a showing by the Attorney General that a covered
entity has violated this article, the court may enter or grant any or all of the relief provided
for in Code Section 10-1-397.
(c) Any person who suffers injury or damages as a result of a violation of this article may
bring an action individually against the person or persons engaged in such violation under
the rules of civil procedure to seek equitable injunctive relief and to recover his or her
general and exemplary damages sustained as a consequence thereof in any court having
jurisdiction over the defendant. Such relief may include:
(1) Restitution to any person or persons adversely affected by a defendant's actions in
violation of this article;
(2) Punitive damages in an amount equal to $50,000.00 or three times the combined total
of damages, costs, and fees, whichever is greater;
(3) Expenses of litigation, including reasonable attorney's fees; and
(4) Other relief as the court deems just and equitable.
(d) A covered entity that has violated a provision of this article shall be liable for damages
of $5,000 per violation, as adjusted annually to reflect an increase in the Consumer Price
Index, or actual damages, whichever is greater;
(e) Except as otherwise provided, this article is cumulative with other laws and is not
exclusive.
10-1-978.
(a) Nothing in this article shall be interpreted or construed to:
(1) Impose liability in a manner that is inconsistent with 47 U.S.C. Section 230;
(2) Impose liability in a manner that is inconsistent with the First Amendment to the
United States Constitution;
(3) Force any consumer to undergo age assurance as a condition of accessing the online
services, products, or features of a covered entity;
(4) Prevent any consumer from accessing any consumer generated media; or
(5) Preempt or otherwise affect any right, claim, remedy, presumption, or defense
available at law or in equity, including but not limited to antidiscrimination, consumer
protection, labor, and civil rights laws.
10-1-979.
This article shall not apply to:
(1) Any federal, state, tribal, or local government entity in the ordinary course of its
operation;
(2) Protected health information that a covered entity or its affiliate processes in
accordance with the federal Health Insurance Portability and Accountability Act
(HIPAA) of 1996, P.L. 104-191, or documents that a covered entity or its affiliate creates
for the purpose of complying with HIPAA;
(3) Information used only for public health activities and purposes described in 45 C.F.R.
Section 164.512;
(4) Information that identifies a consumer with:
(A) Activities that are subject to the federal policy for the protection of human subjects
as set forth in 45 C.F.R. Part 46;
(B) Research on human subjects undertaken in accordance with good clinical practice
guidelines issued by the International Council for Harmonisation of Technical
Requirements for Pharmaceuticals for Human Use;
(C) Activities that are subject to the protections provided in 21 C.F.R. Part 50 and
21 C.F.R. Part 56; or
(D) Research conducted in accordance with the requirements set forth in
subparagraphs (A) through (C) of this paragraph or otherwise in accordance with state
or federal law;
(5) Any entity whose primary purpose is journalism and has a majority of its workforce
consisting of persons engaging in journalism; or
(6) Any financial institution subject to Title V of the federal Gramm-Leach-Bliley Act,
P.L. 106-102, and regulations adopted to implement that act.
10-1-980.
A covered entity shall not discriminate or retaliate against any consumer, including denying
products or services, charging different prices or rates for products or services, or providing
lower quality products or services to the consumer, for receiving any of the protections
contained in this chapter, for exercising any of the rights contained in this article, for
refusing to change privacy and safety settings, or for refusing to agree to the collection or
processing of personal data or to the use of any design feature."
SECTION 2.
It is the intent of the General Assembly that nothing in this article may be construed to
infringe on the existing rights and freedoms of minors or be construed to discriminate against
minors based on race, ethnicity, sex, disability, sexual orientation, gender identity, gender
expression, religion, or national origin.
SECTION 3.
This Act shall become effective upon its approval by the Governor or upon its becoming law
without such approval for purposes of promulgating rules and regulations and shall become
effective on January 1, 2027, for all other purposes.
SECTION 4.
All laws and parts of laws in conflict with this Act are repealed.
## Summaries written by Georgia Commons
The following was written by claude-sonnet-5 from the text above and is not part of the bill. Quote the text, not the summary.
Senate Bill 495 would create Georgia's 'Age-Appropriate Design Code Act,' setting new rules for online platforms that limit data collection, algorithmic feeds, and design features aimed at minors, with enforcement by the Attorney General.
### Plain-language summary
Georgia law currently has no specific rules governing how websites and apps design their products and handle data for users under 18. This bill would add a new article to Georgia's trade practices code (O.C.G.A. Title 10, Chapter 1) creating the Age-Appropriate Design Code Act.
The bill defines 'covered entities' as profit-driven online businesses likely to be accessed by minors, and bars them from certain high-risk data practices, like collecting unnecessary personal data, letting adults be recommended to connect with minors, sending push notifications to minors overnight, or using design features meant to cause compulsive use. It requires risk assessments before design changes, independent audits, strong default privacy settings for minors, easy account deletion tools, and public disclosure of data practices. Small businesses under certain revenue and data thresholds are exempted. Violations would be enforced as unfair or deceptive practices under Georgia's Fair Business Practices Act, by both the Attorney General and private lawsuits. Rulemaking could begin once the Governor signs the bill, but most requirements would take effect January 1, 2027.
### What it does
- Creates a new legal category of 'covered entity' for profit-seeking online businesses whose products are reasonably likely to be used by minors, and applies new duties to them.
- Bans specific high-risk practices such as collecting unnecessary personal data, using minors' data for undisclosed algorithmic recommendations, and sending push notifications to minors between midnight and 6 a.m.
- Requires covered entities to assess the risk of compulsive use before launching or changing a design, document findings for ten years, and submit records to an independent auditor annually.
- Sets strict default privacy and safety settings for minors, including disabling location sharing, disabling search indexing, and preventing adults from being algorithmically matched with minors.
- Requires covered entities to let minors (or their parents) request deletion of their data within 15 days and to publicly post details about their data practices, feeds, and algorithms.
- Makes violations enforceable as unfair or deceptive trade practices under the Fair Business Practices Act, allowing Attorney General action and private lawsuits with damages of at least $5,000 per violation or actual damages, whichever is greater.
### Who it affects
The bill affects for-profit online companies (websites and apps) whose services are likely to be used by people under 18, especially social media and content platforms, as well as their processors and independent auditors. It also affects minors and their parents or guardians, who gain new privacy tools and data deletion rights, and the Attorney General's office, which gains new enforcement and rulemaking duties.
### Why it matters
If enacted, Georgia teenagers and children using covered online platforms would get stronger default privacy settings, limits on late-night notifications, and easier ways to delete their data or block other users. Companies would face new compliance costs, audits, and potential lawsuits or fines if they fail to follow the rules, while journalism outlets, financial institutions, and small businesses under set revenue thresholds are exempt.
### Key provisions
- Section 1 (O.C.G.A. § 10-1-971) defines key terms including 'minor,' 'covered entity,' 'algorithmic feed,' and 'compulsive use,' setting the scope of who and what the law covers.
- Section 1 (§ 10-1-972) lists banned high-risk data practices and design features, such as unnecessary data collection, undisclosed use of personal data in feeds, and design meant to cause compulsive use, unless a verified adult explicitly requests them.
- Section 1 (§ 10-1-973) requires risk assessments before deploying or changing designs, documentation retained for ten years, and independent annual audits of compliance records; exempts small businesses under $25 million average revenue or 50,000 users.
- Section 1 (§ 10-1-974) mandates strict default privacy settings for minors, including disabling location sharing, interaction counts, and adult-to-minor connection recommendations.
- Section 1 (§ 10-1-975) requires public disclosure of privacy policies, algorithmic feed purposes, and data usage details for features affecting minors.
- Section 1 (§ 10-1-976) sets rules for age-assurance data collection, requiring deletion of age-verification data once age status is determined and an appeals process for age determinations.
- Section 1 (§ 10-1-977) makes violations enforceable under the Fair Business Practices Act, allowing Attorney General enforcement and private lawsuits with damages of $5,000 per violation, punitive damages up to $50,000 or triple damages, and attorney's fees.
- Section 3 sets the effective date: rulemaking authority begins once the Governor signs the bill, while most substantive requirements take effect January 1, 2027.
## Status
- Status: Introduced (2026-02-11)
- Last action: Senate Read and Referred (2026-02-12)
- Sponsors: Sally Harrell, Shawn Still, Ed Setzler, Bo Hatchett, Marty Harbin, Carden Summers, Frank Ginn, Ricky Williams, Lee Anderson, Elena Parent, Harold Jones, Ben Watson, Clint Dixon, Nikki Merritt, Nan Orrock, Russ Goodman, Nabilah Islam Parkes, Josh McLaurin, Max Burns, Blake Tillery, Brian Strickland, Chuck Payne, Mike Hodges, Billy Hickman, Chuck Hufstetler, Sonya Halpern, Jason T. Dickerson, Kenya Wicks, Gail Davenport, Tonya Anderson, Jaha Howard, Sam Watson, Freddie Sims, RaShaun Kemp, Kim Jackson, Ed Harbison, Randal Mangham, Drew Echols, Derek Mallow, Donzella James
- Official page: https://www.legis.ga.gov/legislation/73129
> The history, votes, and amendments (95 characters) are at https://georgiacommons.org/bills/2025-2026/sb495.md?full=1