Home › Intelligence › Brief
BREACH BRIEF 🟠 High ThreatIntel

California Law Targets Autoplay & Personalized Feeds for Under‑16s; Google, Meta, TikTok Sue to Block Restrictions

California’s AB 1709 will ban autoplay and algorithmic feeds for users under 16, forcing platforms to implement age‑verification or delete accounts. The move triggers a legal fight with Google, Meta, and TikTok, highlighting the need for auditable privacy controls around minors. Organizations should map these requirements to their control frameworks to stay audit‑ready.

Verisq™ Intelligence · 📅 November 07, 2026 · 📰 malwarebytes.com
Get the weekly threat digestBreaches, exploited vulnerabilities and advisories that matter to your vendors, every Friday. Free.
🟠
Severity
High
TI
Type
ThreatIntel
🎯
Confidence
High
🏢
Affected
2 sector(s)
✅
Actions
2 recommended
📰
Source
malwarebytes.com

California Law Targets Autoplay & Personalized Feeds for Under‑16s; Google, Meta, TikTok Sue to Block Restrictions

What Happened — California’s Assembly Bill 1709 (AB 1709), signed by Gov. Gavin Newsom in September 2026, will prohibit covered platforms from offering “psychologically exploitative” features—specifically personalized recommendation feeds and autoplay—to users under 16. The law also requires age‑verification before those features can be shown and mandates deletion of accounts that cannot be re‑configured. On Nov 4 2026, Google, Meta, and TikTok filed separate federal lawsuits seeking to block the rule, arguing that the restrictions infringe on First‑Amendment editorial rights and overstep state authority. The companies contend that feed curation and autoplay are protected editorial functions, not harmful product designs.

Why It Matters for Trust & Control Assurance — The dispute spotlights the need for robust privacy‑by‑design controls around age verification and feature‑level consent, a core control objective that maps to many frameworks.

Who Is Affected — Social‑media platforms, video‑sharing services, and any online content provider that delivers algorithmic feeds or autoplay to U.S. users.

Recommended Actions —

  1. Perform a gap analysis of age‑verification and feed‑personalization processes against AB 1709 requirements.
  2. Document evidence of consent, age‑gate enforcement, and feature‑restriction logic in a centralized Trust Center for audit readiness.

Technical Notes — The law does not ban child accounts; it forces platforms to either strip the restricted features or delete the account and associated personal data. Age‑verification mechanisms must be verifiable and auditable, and any data collected for verification must be handled in compliance with existing privacy statutes (e.g., CCPA, GDPR). Source: Malwarebytes Labs

📰 Original Source
https://www.malwarebytes.com/blog/news/2026/11/big-tech-sues-over-california-plan-to-limit-kids-scrolling ↗

This Verisq Intelligence Brief is an independent analysis. Read the original reporting at the link above.

Third-party risk

Does this breach reach you?

Verisq continuously monitors your vendors for breach and ransomware activity, so the question stops being whether it happened and becomes whether it reaches you.

See a live Trust Center →