Newsom has until September 30, 2026, to sign the bill, veto it, or let it lapse into law. Coming two weeks after Utah’s SB 73 took effect and days after Rep. Darrell Issa introduced the American Copyright Protection Act at the federal level, AB 1709 is the third piece of the same broader move: state and federal lawmakers building a new layer of internet regulation that reaches through platforms, ISPs, and identity itself. If Newsom signs, the enforcement architecture that ships with it changes what every California adult’s online session looks like, not just their kids’.
What AB 1709 Actually Does
The bill targets “addictive features” on covered platforms. In practice, that means the personalized algorithmic feeds that power TikTok’s For You page, Instagram’s home tab, YouTube’s recommendations, and similar surfaces on Snapchat and Reddit. It also targets autoplay of the next video and push notifications sent outside a defined nighttime window. When a user is identified as under 16, those features would have to be turned off by default. The knowing-violation penalty is set at up to $50,000 per affected minor. For a platform with millions of teen users in California, the math scales fast.
How the Platforms Know Who’s a Minor
The mechanism is what makes this bill different. AB 1709 does not require users to upload an ID. It relies on the OS-level age signal established by a separate California law, AB 1043, which takes effect January 1, 2027. Under AB 1043, Apple, Google, and Microsoft would collect age information during device setup and pass a simple minor-or-adult signal to installed apps. AB 1709 then requires apps to act on that signal.
A companion measure, AB 1856, adds a narrow open-source exemption to AB 1043. Illinois passed a broader device-level law (P.A. 104-0664, effective 2028) unanimously in both chambers, and Colorado’s SB26-051 lands the same year with its own open-source carveout. The pattern is clear: identity verification is moving from the website to the phone.
Why Adults Should Care About a Bill Aimed at Teens
The stated target is under-16 users. The practical footprint is bigger. Building the OS-level infrastructure that identifies minors also builds the infrastructure that identifies everyone else, and that infrastructure feeds a growing list of state and federal laws layered on top of it: age-verified adult sites in Utah and Texas, the Issa piracy-site blocking bill, and the ongoing FTC probe into surveillance pricing that keys off the same personal signals.
Once your device broadcasts an authenticated age signal to every app, that signal becomes another data point that platforms can log, cross-reference, and hand to advertisers or data brokers. The EFF and other civil-liberties groups have raised exactly this concern in their public comments on California’s device-level bills.
Where a VPN Actually Fits, and Where It Doesn’t
Direct on the limits: a VPN does not intercept the OS-level age signal AB 1709 would rely on. That signal comes from the device you’re using, not from your IP address. If you’re logged into your Apple ID or Google account and the OS has flagged your age, no VPN changes that at the app layer.
Where a VPN does help is on the layers that sit around the age signal. NordVPN masks your IP address from every site you visit, which cuts the geolocation signal used by adjacent age-verification schemes (state-level porn laws, geo-fenced compliance zones) and by the pricing engines flagged in the FTC’s ongoing study. Threat Protection Pro, included in the higher tiers, blocks the trackers and ad-tech beacons that pair your identifiers across sites. NordVPN sits near the top of most best VPN guides for that layered approach.
NordVPN Basic at $3.49 per Month
NordVPN’s Basic plan is available at $3.49/month, which works out to $94.23 billed once for 27 months of service (24 + 3 free). That is a 69% discount off the standard rate, with annual renewal at $139.08/year, cancelable at any time. The plan covers up to 10 devices with apps for Windows, macOS, Linux, iOS, Android, browsers, and router installation. Threat Protection Pro sits in the Advanced and Ultra tiers rather than in Basic.
Every plan is backed by a 30-day money-back guarantee, refunded through 24/7 chat support within 5 to 10 business days.