South Carolina’s new Age-Appropriate Design Code Act is shaping up to be one of the most demanding privacy laws in the country for companies whose products can be reached by people under 18. It pairs prescriptive “privacy by design” requirements, meaning child-safety and data-minimization choices have to be built into the product itself rather than bolted on later, with limits on targeted advertising to minors. It also requires parental tools that let a parent manage a minor’s account settings, restrict purchases, see time spent, and set time limits.
Two features stand out for small teams. First, covered services must obtain an annual review by an independent outside auditor and file that report with the South Carolina Attorney General, and those reports are posted publicly. Second, penalties are unusually aggressive and can reach individual officers and employees personally where violations are willful and wanton.
