Rules
How California and New York youth ad laws differ from Utah's
Gen Z and youth marketing compliance splits three ways: California, New York and Utah police minor ads and data differently, so national campaigns need one matrix.
What to take away
- California's Age-Appropriate Design Code Act took effect on 1 July 2024 and has been blocked by a preliminary injunction since September 2023.
- New York split the work between two laws. The SAFE for Kids Act covers feeds and overnight notifications, and the Child Data Protection Act covers collection and use of minors' data.
- Utah rewrote its framework with HB 464 in 2024, trading ad-targeting rules for residency checks and parental controls.
- No single signup flow clears all three states. Utah's residency test is the gap a birth-date field cannot close.
- Penalties are counted per affected minor, so a state-blind media plan multiplies exposure instead of averaging it.
Effective dates, amendments and enforcement status
A compliance memo built from the original 2023 Utah text is already stale. Two regimes are partly paused, and the third was rewritten once.
Effective dates and enforcement
California
- Statute
- Age-Appropriate Design Code Act (AB 2273)
- Signed
- September 2022
- Effective
- 1 July 2024
- Status
- Injunction since September 2023, on appeal
- Maximum penalty
- $2,500 per affected minor for a negligent violation, $7,500 if intentional
New York
- Statute
- SAFE for Kids Act and Child Data Protection Act
- Signed
- June 2024 and December 2024
- Effective
- Staggered; SAFE for Kids stayed until Attorney General rules land
- Status
- Rulemaking pending, challenge filed in late 2024
- Maximum penalty
- Up to $5,000 per violation
Utah
- Statute
- Social Media Regulation Act, replaced by HB 464
- Signed
- March 2023
- Effective
- 1 October 2024 for the replacement text
- Status
- Enforcement stayed; 2025 amendments moved deadlines
- Maximum penalty
- Administrative fines; confirm the current schedule
Treat the status column as perishable and confirm which provisions are live before each launch. The Cornell Legal Information Institute keeps a state law directory with links to current state codes.
Teams tracking these amendments usually watch two more states. The Gen Z marketing rules in Texas and Illinois comparison shows why.
How the three regimes treat age assurance and minor defaults
Age assurance is where the three states stop being interchangeable. California wants an estimate proportionate to the risk, while Utah adds a residency test on top of age. New York sits between them and expects verification it would accept in an enforcement action.
Age assurance and minor defaults
California
- Age assurance
- Risk-based estimate
- Default settings
- High privacy by default
- Ad targeting
- Behavioral targeting to minors hard to defend
New York
- Age assurance
- Reasonable verification
- Default settings
- Consent before data use
- Ad targeting
- Targeted ads need consent
Utah
- Age assurance
- Residency plus age
- Default settings
- Privacy defaults plus parental controls
- Ad targeting
- Delivery limited by platform design
[figure 1]
Named options in current use include Yoti and Persona for age estimation or ID matching, k-ID for youth compliance flows, and Apple's Declared Age Range API, which returns a band instead of a birth date. None is a safe harbour alone.
Federal rules sit underneath all three. The COPPA Rule covers under-13s. The 13 to 17 band is where the states do the work, and the guide to where COPPA and teen data stop US Gen Z marketing maps that boundary.
Seven steps for a campaign that runs in all three states
Sequence matters here. Each step produces the record the next one depends on.
[figure 2]
- Map the audience by state and age band from your own analytics, not platform estimates.
- Choose an age-assurance method per state and write down why it fits the risk.
- Rebuild the consent flow so it captures consent where required and stores a timestamp.
- Set minor accounts to private by default and record the rationale for any exception.
- Split the media plan into contextual placements and audience-based placements.
- Exclude minors from behavioral and lookalike targeting at the audience level.
- Keep one file per campaignassessment, age method, consent records, settings rationale, targeting logic.
Penalties explain why step 7 exists. California counts violations per affected minor, so one flawed audience produces thousands of units. New York sets a per-violation figure, and Utah issues administrative fines.
Disclosure review belongs in that same file. The FTC's guidance on influencer disclosures applies nationwide, and the FTC endorsement guides article for Gen Z influencer campaigns shows how federal disclosure records sit beside state consent records.
Example: a lookalike audience that fills with 16-year-olds
A national brand builds a lookalike from its 18 to 24 customer file. The model reaches 16 and 17 year olds in all three states, and each state treats that reach differently.
California: the audience triggers an impact assessment before launch, and the assessment has to explain why interest-based targeting is safe for minors. New York: those minors' data cannot be used without consent. Utah: the platform may already have restricted the accounts.
The fix is to exclude under-18s at the audience level and confirm with the age signals the platform returns. A planning range of 10 to 25 percent lower minor-eligible inventory in New York and Utah is a reasonable placeholder. No public benchmark exists, so label it as an assumption.
Building a compliance matrix that survives an audit
A matrix turns three statutes into one operating document. These columns are the minimum.
Building a compliance matrix
- State and statute version date
- Age threshold
- Age-assurance method and vendor
- Consent type and where the record lives
- Default settings for new minor accounts
- Targeting permitted on minor inventory
- Effective date and enforcement status
- Penalty exposure
Example row:
Compliance matrix
Age assurance
- California
- Risk-based estimation
- New York
- Reasonable verification
- Utah
- Residency plus age
Consent before processing
- California
- Impact assessment before launch
- New York
- Required
- Utah
- Required for minor accounts
Targeting on minor inventory
- California
- Contextual only
- New York
- None without consent
- Utah
- Limited by account restrictions
Status
- California
- Enjoined, on appeal
- New York
- Rules pending
- Utah
- Enforcement stayed
Cost planning sits next to the matrix, because state splits change creative and media budgets. The breakdown of Gen Z campaign costs by city and creator rate gives the ranges to plug in.
