If you operate an online service accessible to minors and do business in South Carolina, you're facing a compliance deadline that might have caught you off guard. The South Carolina Age Appropriate Design Code Act took effect immediately in February 2026, with the first independent audit reports due to the South Carolina Attorney General by July 1, 2026.
This law is unlike typical privacy regulations. There's no grace period or phased enforcement, and your audit report will be publicly posted on the Attorney General's website. Personal liability provisions for "willful and wanton" violations mean compliance officers and executives face individual exposure beyond corporate penalties.
This checklist guides you through the technical and operational requirements you need to document before your auditor arrives.
Prerequisites
Before starting the checklist, confirm your organization meets the threshold criteria:
Scope determination: You're a covered entity if you do business in South Carolina AND meet any of these thresholds: (a) annual gross revenue above $25 million; (b) buy, receive, sell, or share personal data of 50,000 or more consumers, households, or devices (including affiliates, subsidiaries, or parent company); or (c) derive at least 50% of annual revenue from selling or sharing consumer personal data.
Minor access assessment: Your online service is "reasonably likely to be accessed by minors" if you either: (a) have actual knowledge a consumer is under 18, or (b) direct the service to children under 13 under the Children's Online Privacy Protection Act. If you attribute an age to a consumer for advertising or any other purpose, you're presumed to have actual knowledge of that age.
Data exemptions: Personal data covered by the Gramm-Leach-Bliley Act or Health Insurance Portability and Accountability Act of 1996 is exempt, but this doesn't categorically exempt financial institutions, HIPAA-covered entities, or nonprofits that otherwise meet the threshold triggers.
Compliance Checklist
User Controls for All Users (Adults and Minors)
☐ 1. Disable non-necessary design features
Provide a control that lets users turn off design features not required for your core service. This includes autoplay, push notifications, infinite scroll, or gamification elements.
☐ 2. Implement time-limit controls
Offer tools for users to cap their session duration or daily usage. Configurable timers should trigger logout or pause functionality.
☐ 3. Set monetary transaction limits
Allow users to establish spending caps on purchases or in-app transactions. Implement a parent-controlled or self-imposed dollar limit that blocks transactions exceeding the threshold.
☐ 4. Opt-out for personalized recommendations
Enable users to disable automated content suggestion systems. Provide a toggle that switches recommendation algorithms to chronological or category-based sorting.
☐ 5. Restrict social connectivity features
Let users limit likes, comments, clicks, views, location sharing, and user connections. Offer granular privacy controls for each social feature.
Default Settings for Minors Under 18
☐ 6. Disable non-necessary features by default
For accounts identified as minors, set privacy-protective options as the default state. New minor accounts should launch with autoplay off and notifications disabled.
☐ 7. Restrict social connectivity by default
Turn off social features for minors until they or their parents opt in. Minor profiles should default to private.
☐ 8. Disable personalized recommendations by default
Set recommendation systems to off for minors unless they request activation for a specific service they're actively engaged in.
Targeted Advertising and Profiling Restrictions
☐ 9. Block targeted advertising to minors
Implement controls that prevent ad targeting based on minor user data. Age-gated ad serving logic should deliver only contextual ads to users under 18.
☐ 10. Prohibit profiling of minors
Stop generating inferences about minors' preferences or behavior, except when a minor requests profiling in connection with a service they're actively using.
Parental Controls
☐ 11. Account and privacy settings management
Provide parents tools to configure their child's account settings and privacy preferences. Offer a parent dashboard accessible via verified credentials.
☐ 12. Purchase restriction controls
Allow parents to block or cap spending on their child's account. Implement parent-set transaction limits with real-time notifications.
☐ 13. Time management tools
Enable parents to view total time spent and impose usage limits or time-of-day restrictions. Provide a usage dashboard with configurable lockouts.
Transparency and Data Minimisation
☐ 14. Comprehensive feature descriptions
Document design features, privacy protections for minors, and parental controls in plain language with usage instructions.
☐ 15. Recommendation system disclosure
If you use personalized recommendations, explain how the system works for minors and how to opt out.
☐ 16. Data minimisation tied to engaged features
Collect and process only the personal data necessary for features with which a minor "knowingly engages."
Harm Reporting and Response
☐ 17. Notification mechanism for parents, schools, and minors
Create a system for receiving reports that your service is causing harm to minors. Include acknowledgment and case-tracking functionality.
☐ 18. Response logging and documentation
Track each harm notification received and document your response. Use a ticketing system to record the report date, alleged harm, and remediation actions.
Independent Audit Preparation
☐ 19. Retain an independent third-party auditor
Engage an auditor with no financial or operational ties to your organization. Ensure they have privacy audit experience.
☐ 20. Prepare audit report components
Compile documentation showing how you implement required controls, the number of harm notifications received, your responses, and descriptions of algorithms used.
☐ 21. Submit audit report to the Attorney General by July 1
File your completed independent audit report with the South Carolina Attorney General's office before the deadline. Retain a copy for your records.
Common Mistakes
Treating this as a consent-based regime. The Act prohibits targeted advertising to minors outright. You can't offer an opt-in to make it compliant.
Scoping data minimisation to "necessary for the service." The Act requires minimisation tied to features the minor "knowingly engages" with, which is narrower than service-level necessity standards in other privacy laws.
Assuming HIPAA or GLBA exemptions are entity-wide. The exemptions apply to specific data types, not your entire organization. If you process non-exempt personal data and meet the threshold criteria, you're covered.
Using internal staff for the audit. The Act requires an independent third party. Your internal audit team or a consulting firm with other service relationships won't meet the independence requirement.
Missing the public disclosure implication. Your audit report will be posted on the Attorney General's website. Write it assuming regulators, plaintiffs' attorneys, and competitors will read it.
Next Steps
If you're not confident you can document compliance across this checklist by the audit deadline, prioritize items 9, 10, and 16 (advertising restrictions, profiling prohibitions, and data minimisation). These are the highest-risk areas for enforcement and the hardest to retrofit after the fact.
For controls you can't fully implement before the audit, document your remediation timeline and interim compensating controls. Your auditor needs to see evidence of a compliance program in motion, not just a plan on paper.
Finally, if you're waiting for the preliminary injunction ruling in the NetChoice case, know that the South Carolina Attorney General hasn't indicated any enforcement pause. Compliance deadlines remain in effect until a court orders otherwise.
