Here's who it applies to directly from the bill[1]:

    A business that provides an online service, product, or feature likely to be accessed by children.

Child is being defined as[1]:

    "Child" or "children," unless otherwise specified, means a consumer or consumers who is are under 18 years of age.

Meaning all websites, including your blog. No one will be capable of making a bullet-proof argument their site is unlikely to be accessed by a child.

[1] https://leginfo.legislature.ca.gov/faces/billTextClient.xhtm...

You should also quote the following section:

  (4) “Likely to be accessed by children” means it is reasonable to expect, based on the following indicators, that the online service, product, or feature would be accessed by children:
    (A) The online service, product, or feature is directed to children as defined by the Children’s Online Privacy Protection Act (15 U.S.C. Sec. 6501 et seq.).
    (B) The online service, product, or feature is determined, based on competent and reliable evidence regarding audience composition, to be routinely accessed by a significant number of children.
    (C) An online service, product, or feature with advertisements marketed to children.
    (D) An online service, product, or feature that is substantially similar or the same as an online service, product, or feature subject to subparagraph (B).
    (E) An online service, product, or feature that has design elements that are known to be of interest to children, including, but not limited to, games, cartoons, music, and celebrities who appeal to children.
    (F) A significant amount of the audience of the online service, product, or feature is determined, based on internal company research, to be children.

I can't speak for the GP poster, but my own personal blog meets none of these criteria.

I didn't quote it because I provided the direct link to the original bill, and felt it would be too messy to quote directly.

None-the-less, the above applies to all websites unless you want to chance being a test case (and no one does). Child is defined as anyone from 0-18 years old, which is an incredibly broad category.

Ever once talk about music on your blog? Talk about food? Cars? Games? Math? School? Clothing? Programming? TV Shows? Upcoming movies? Flying airplanes?

All of these things are of interest to folks 18 and under too... you don't have to have a blog about Blue's Clues to fall under this deliberately vague, ultra-wide net.

It's very unclear to me which specific paragraph A-E would be triggered by the act of publishing writing about food or music on a personal blog. Perhaps if I kept detailed metrics about my users and discovered a significant number were children, it would be different, but I certainly don't do that. Based on that data, I'm pretty comfortable not changing any piece of my own personal website in response to this legislation.

Don't get me wrong, this looks like a garbage law and I truly hope every California resident is writing or calling their elected representatives to complain about it in specific and excruciating detail, but acting like every nerd's low traffic weblog is putting them at risk of civil action from the State of California strikes me as somewhat hyperbolic and misleading.

C, D, and E are killers.

    (C) An online service, product, or feature with advertisements marketed to children.

Run ads on your site? Dead...

    (D) An online service, product, or feature that is substantially similar or the same as an online service, product, or feature subject to subparagraph (B).

Have some element on you site that is similar to any other site that might target children? Dead...

    (E) An online service, product, or feature that has design elements that are known to be of interest to children, including, but not limited to, games, cartoons, music, and celebrities who appeal to children.

This literally covers anything in the world you might talk about. Remember, "Child" is defined as someone 18 or younger... which is a huge and broad category that encompasses all interests and topics.

Take a look at Michael Dominick's SE blog: https://dominickm.com/

The home page alone violates all of the above.

Lastly, "Business" is not defined here, which is odd since these consumer protection laws always define explicitly who they apply to.

I have extensive experience with P65 and ADA compliance - so vague laws like this one really scare me. The only saving grace here is there is no Citizen Enforcement provision - ie. the AG has to bring suit. Which also means voluntary compliance will be low until the AG makes an example of a few unlucky website operators...

> An online service, product, or feature that has design elements that are known to be of interest to children, including, but not limited to, games, cartoons, music, and celebrities who appeal to children.

So if you write an extremely technical blog that happens to include a cartoon avatar, is your blog directed at children? Example: everything on this blog https://gankra.github.io/blah/deinitialize-me-maybe/

I'm not an content segmentation expert, but this does not look like it's child-related content at all. The legislation clauses may seem fuzzy but if this were my blog I wouldn't be worried.

> does not look like it's child-related content at all

If you're defining "child" to mean 5 year olds, I completely agree. But I'm almost certain that there are 17 year olds out there who are world-class Rust programmers who are reading that blog.

Ever seen a kid post a question to Stack Overflow because they're learning programming and have a question, and they make the mistake of mentioning their age?

"Sorry kid. We're deleting your question and banning you."

Yeah, maybe. I certainly hope that, given how great Gankra's writing is, the business that is running their blog does not end up fined many thousands of dollars due to some stupid California law.

You're going to fall under (B), if nothing else.

Kids are curious. They go places to see what's there. Kids visit your blog, whether you intend for them to or not. (They may not come back for a second visit, but a number have come for a first...)

It's very unclear to me who, exactly, is going to be able to determine that significant numbers of children are accessing my website if I'm not tracking any sort of analytics beyond hits/day. Even taking into account section (D), it's hard to imagine the California AG, even if acting in bad faith, is going to be able to find a blog that is "substantially similar" to mine which has analytics data pointing to traffic showing those sorts of demographics.

Also, to be clear, I'm not trying to be pedantic or split hairs here, I'm trying to explain my own actual thought process in reading the law and considering my own risk/exposure. As I mentioned in a reply to a sibling comment, this law looks genuinely awful, but I'm not going to lose any sleep over the likelihood of getting sued by the state of California for a personal website where I mainly make a half-assed effort to write about the nerdiest shit possible (i.e. computer programming and board games that are best played with the aid of a spreadsheet).

I think it's unclear from the text of this bill whether your own personal blog continues to meet none of these criteria if you become a schoolyard meme and children flock to your site of their own volition.

> "A business that provides an online service, product, or feature likely to be accessed by children"

This seems stupidly vague.

As with many of these types of laws in California, I suspect they are deliberately vague.

If people/businesses have to guess at what's compliant, then they will often choose the most restrictive form of compliance out of an abundance of legal caution.

Possibly even unconstitutionally vague.[0] If a law requires someone to accurately predict the future actions of large numbers of people they've never met, then that seems (to my non-expert understanding) like an unreasonable burden on citizens.

[0] https://en.wikipedia.org/wiki/Vagueness_doctrine

Frankly put, and regardless of your personal views on the subject - if the California Pro-2nd Amendment folks haven't been able to get anywhere with this "Vagueness Doctrine", then neither will website operators.

I’m not personally a business, so a plain reading of the line you posted pretty clearly wouldn’t cover my blog if I had one.

Also of note is "Business" is not defined here, which is odd since these types of laws always do.

Deliberately vague...

Does your personal blog collect information about users? If so, then maybe?

Personal information like IP address, that is used to enforce troll bans?

and, do you have settings that limit such collection that you have enabled by default?

If you are collecting and storing personal identifying information about users (who may happen to be under 18) then yes.

Only if you have a nexus in California.