California Turned Your GA Checklist Into Statute
The obligations are enumerable, which makes them a sprint; the hard part is that most of them key off a user's age, and the vendors who sell age proof are the ones getting breached.
Why this is scopeable, and where it stops being scopeable
Every prior wave of platform regulation policed what users post. This one polices what you built, and it does it by naming interaction patterns. That is unusually good news for planning: a named list is an inventory, and an inventory is a sprint. Walk each consumer surface, list every scroll loop, autoplay trigger, streak and re-engagement notification, and pick one of three outcomes per item — block for under-16, degrade, or default off.
Then you hit the variable that makes it expensive. Almost every obligation keys off a user's age, and most products do not know it. MIT Technology Review's Download frames this precisely: unknown-age users are where age assurance stops being a backlog item and becomes an infrastructure dependency. The moment you need an age signal, someone in a procurement meeting starts shopping for a document-scanning vendor.
That is the trap. Techpresso notes that IDScan confirmed a breach exposing more than 150 million driver's licenses, as these rules push platforms toward verification. If regulation routes you into an identity vendor, you inherit that liability class permanently. Specify age assurance that retains as little as possible — attestation, on-device signals, delete-after-match — before the vendor choice is made for you on a compliance deadline.
Where the two accounts agree, and what neither settles
Both reads converge on the same relocation: this is product surface area, not trust-and-safety overhead. Techpresso emphasizes the mechanism — a documented assessment completed before launch, plus the independent-auditor registry Anthropic backed, which means an outside party will define what "adequate" looks like. The Download emphasizes the category: companion chatbots are a regulated product class in the US, and reporting indicates federal appetite is rising.
What neither settles is timing. No effective date, no enforcement posture, no guidance on what a sufficient assessment contains. Treat that asymmetry the way you would any dependency with a known requirement and an unknown date: build the artifact once, build it globally, and stop guessing at the calendar.
A named prohibited pattern is a backlog item. An unknown user age is an infrastructure dependency.
The failure mode that has no retrofit
The Download also carries the sharpest cautionary case: Meta AI allegedly used years of Facebook posts to identify creator Kalie Roberts' children and locate where her family lives. That is not a breach — nothing leaked. It is retroactive inference over legacy user content, and it is far more sympathetic to a jury and a feed than any data-loss story. It also cost nothing to prevent at design time and cannot be fixed after launch.
The cheap counter is a template change, not a program: any feature that trains on or infers from existing user-generated content requires explicit opt-in for historical data and a hard exclusion for anything depicting minors. Pair it with the posture that separates pre-compliers from retrofitters — Meta agreed to pay up to $18 billion settling child-addiction claims brought by California and 28 other states, then publicly argued that tailored experiences make its apps valuable for teens. Teams that ship youth-safety credentials get to market them; teams that don't get to build them under a deadline someone else sets.
What to do
Add a documented pre-launch AI risk assessment to the GA checklist for every conversational, generative or personalized surface now, before your next release locks a date.
Inventory every scroll loop, autoplay trigger, streak and re-engagement notification this sprint, and mark each one block, degrade or default-off for users whose age you cannot establish.
Specify age assurance that retains no ID images — attestation or on-device signals with delete-after-match — this quarter, before procurement selects a document-scanning vendor.