AB 2007 narrows how programs that serve children outside regular school hours can use youth images and other identifying information. It defines covered entities (out‑of‑school programs), covered information (photos, recordings, likenesses, attributed statements, and other identifiers), and forbids use of that information except where the parent or guardian grants express written or electronic consent on a clearly worded, standalone notice.
The bill also forbids selling or sharing youth covered information under any circumstances, forbids conditioning enrollment on consent, and gives parents a private right of action with statutory damages up to $5,000 per affected youth plus injunctive relief and attorney’s fees. For compliance officers and program managers, the measure creates a narrow exemption framework but expands litigation and recordkeeping exposure for youth‑serving organizations that rely on promotional materials.
At a Glance
What It Does
AB 2007 prohibits out‑of‑school youth programs from using a child’s photo, video, audio, likeness, attributed statements, or other identifying information unless the parent or guardian provides an express written or electronic signature on a single, separate notice that lists the specific uses and media. The bill additionally bars selling or sharing covered information and prevents programs from making participation conditional on consent.
Who It Affects
The statute targets non‑school programs offered primarily to youth—expanded learning, arts, athletics, recreation, and similar providers that operate outside school hours. It does not apply to public or private elementary or secondary schools as defined in the text, but it does apply to charter or community organizations, after‑school providers, camps, and third‑party vendors that create promotional content.
Why It Matters
This creates a new, enforceable privacy regime focused on children's imagery in the youth‑program sector and shifts compliance burden to programs that market via brochures, social media, or newsletters. The private right of action and per‑child damages raise the stakes for routine promotional practices and for organizations that manage large rosters of participants.
More articles like this one.
A weekly email with all the latest developments on this topic.
What This Bill Actually Does
AB 2007 draws a clear line between schools and other youth programs: if the activity is offered primarily to youth outside school hours and is not run by an elementary or secondary school, the program falls within the bill’s scope. The covered information list is broad — pictures, video, audio, likenesses, attributed quotes, and any other identifying data — so routine uses such as team photos, recital clips, or social‑media shoutouts are likely included unless the program obtains the specified consent.
To use a child’s covered information for marketing, a program must obtain an express parent or guardian signature — written or electronic — on a single document or webpage that is separate from enrollment materials. That notice must clearly explain why the program wants the material and include a detailed list of all places the content will appear (websites, brochures, social feeds, etc.).
Consent is purpose‑limited: programs may use the material only for the uses the parent explicitly approved, and they may not sell or share the material at all, even with consent.The bill also protects family choice: programs cannot condition enrollment or participation on giving marketing consent. Enforcement is private: parents can sue and recover up to $5,000 per child whose covered information was disclosed, seek injunctive relief, and recover attorney’s fees.
For operational teams this means updating intake forms, creating standalone consent notices, mapping where imagery appears across vendors and platforms, retaining signed consents, and removing already‑published material if consent was not properly obtained or its scope was exceeded.
The Five Things You Need to Know
The bill applies to programs offered primarily to youth outside school hours that are not operated by an elementary or secondary school, including expanded learning, arts, athletics, and similar activities.
A program may use a youth’s picture, video, audio, likeness, attributed statements, or other identifying information for marketing only after obtaining an express written or electronic signature from the parent or guardian on a single, standalone notice.
That notice must clearly state the reason for the request and provide a detailed list of all websites, brochures, or other materials where the youth’s information will be used; consent is limited to the specified uses.
Programs are forbidden from selling or sharing youth covered information under any circumstances and may not make enrollment or participation contingent on parental consent to marketing.
Parents have a private right of action; prevailing plaintiffs may recover up to $5,000 per affected youth (or a lesser amount set by the court), plus injunctive relief and attorney’s fees.
Section-by-Section Breakdown
Every bill we cover gets an analysis of its key sections.
Definitions: covered entity, covered information, and scope
These subsections set the statute’s boundaries. Covered entity identifies programs offered primarily to youth outside school hours that are not run by elementary or secondary schools; the definition explicitly lists expanded learning, arts, athletics, recreation, and enrichment as examples. Covered information is defined broadly to include pictures, videos, audio, likenesses, attributed statements, and any other identifying information, which brings common promotional assets squarely within the law. Practically, organizations must first determine whether they are exempt as a school or captured as a covered entity before applying the rest of the statute.
Baseline prohibition on using youth covered information
This provision establishes the default rule: covered entities may not use a youth’s covered information for any purpose unless an exception in the statute applies. That creates a presumption against use and flips common practice for many programs that operate on implied or blanket parental consent. The compliance implication is immediate — organizations should halt non‑consented marketing uses until valid consents are in place.
Consent mechanics and limits for marketing uses
These clauses specify the narrow path to lawful marketing use: the program must obtain an express written or electronic signature on a single document or website separate from enrollment and liability waivers; the notice must clearly explain the requested uses and list the specific media where the content will appear; and consent may not be coerced by making participation conditional. For operational teams, this requires designing standalone consent forms, inventorying every outlet where imagery appears (including third‑party platforms), and ensuring technical processes capture and retain signatures that meet the bill’s standard.
Absolute ban on sale or sharing
This short but consequential clause prohibits any selling or sharing of a youth’s covered information for any reason — consent does not authorize commercial transfer or dissemination beyond the approved uses. Organizations that engage vendors for marketing, archival, or analytics purposes must review contracts and technical flows to confirm no downstream sale or unauthorized sharing occurs.
Private right of action and remedies
The statute gives parents or guardians a direct civil claim for violations and enumerates remedies: statutory damages up to $5,000 per youth (subject to the court reducing the amount), injunctive or declaratory relief, attorney’s fees and costs, and other equitable relief. This structure makes litigation a realistic enforcement tool and increases financial exposure for programs that mishandle imagery or fail to maintain clear consent records.
This bill is one of many.
Codify tracks hundreds of bills on Privacy across all five countries.
Explore Privacy in Codify Search →Who Benefits and Who Bears the Cost
Every bill creates winners and losers. Here's who stands to gain and who bears the cost.
Who Benefits
- Youth and parents — The bill strengthens control over how children’s images and identifying information are used, reducing unconsented exposure in marketing and public forums.
- Privacy‑focused advocacy groups — Creates a sector‑specific privacy protection that aligns with broader child privacy priorities and provides an enforceable remedy.
- Programs that already obtain granular consents — Organizations that already maintain clear, standalone consent processes avoid compliance changes and gain a competitive advantage by demonstrating best practices.
Who Bears the Cost
- Out‑of‑school youth programs and community organizations — Must overhaul consent forms, track consents per media outlet, audit existing online content, and negotiate vendor contracts to prevent sale or sharing.
- Marketing and production vendors — Agencies and platform providers may face restrictions on receiving and reusing youth imagery, requiring contractual and technical safeguards to comply.
- Small, volunteer‑run programs — Lack of legal and technical resources makes implementing standalone consent tracking and records retention burdensome and increases litigation risk for routine mistakes.
Key Issues
The Core Tension
The bill pits two legitimate aims against each other: protecting children’s privacy and preventing commercial exploitation of youth imagery versus the operational and promotional needs of youth programs that rely on photos and videos for outreach and fundraising; resolving that tension forces trade‑offs between strict parental control and the administrative and financial capacity of smaller, community‑based providers.
Several implementation questions will matter in practice. First, the bill’s broad definition of “covered information” captures a wide range of material, but it does not state how to treat low‑resolution group photos, incidental background images, or aggregated materials that don’t identify a particular child; programs will need guidance on de minimis exceptions and identification thresholds.
Second, requiring a single, separate consent document that enumerates every outlet creates a high administrative burden: organizations must continuously update consent inventories as new social channels, third‑party event recaps, or sponsor materials emerge.
The private right of action and per‑child damages create a litigation risk that scales with program size and roster turnover. Because damages are calculated per youth, a single compliance lapse affecting many participants could generate significant exposure.
The absolute ban on selling or sharing is clear but raises contract and vendor management challenges — organizations will need to verify that subcontractors or cloud providers do not engage in behaviors that the statute treats as sharing or selling, which may be technically or commercially complex to control.
Try it yourself.
Ask a question in plain English, or pick a topic below. Results in seconds.