Commentary Addressing Risks and Opportunities Through the Life Cycle of Data, Technology, Advertising and Innovation

Data Counsel

Home | Data Counsel

If your company has a mobile application, you should be ready to address new age-assurance requirements, starting Jan. 1, 2026.

core/paragraph

In 2025, four states enacted laws that will require app stores to implement age-assurance processes to support the online safety and privacy of minors under the age of 18. While the core requirements of these laws are directed at the app stores themselves, there are significant obligations for app developers as well, both directly under these laws and as a result of <a href="https://developer.apple.com/news/?id=2ezb6jhj" target="_blank" rel="noreferrer noopener">Apple</a>’s and <a href="https://support.google.com/googleplay/android-developer/answer/16569691?hl=en" target="_blank" rel="noreferrer noopener">Google</a>’s implementation of the app-store requirements. Because these laws apply to all apps – not just those intended for minors – app developers and the businesses that hire them should be aware of these laws and ready to comply with them.

So, here’s what you need to know about age assurance if you publish mobile apps in an app store.

core/heading

As of the date of this post, the following states have passed an app age-assurance law:

<a href="https://capitol.texas.gov/tlodocs/89R/billtext/html/SB02420F.htm" target="_blank" rel="noreferrer noopener">Texas – App Store Accountability Act</a> (effective Jan. 1, 2026)

core/list-item

<a href="https://le.utah.gov/~2025/bills/static/SB0142.html" target="_blank" rel="noreferrer noopener">Utah – App Store Accountability Act</a> (effective May 6, 2026)

<a href="https://www.legis.la.gov/Legis/ViewDocument.aspx?d=1427667" target="_blank" rel="noreferrer noopener">Louisiana – Online Protections for Minors</a> (effective July 1, 2026)

<a href="https://leginfo.legislature.ca.gov/faces/billTextClient.xhtml?bill_id=202520260AB1043" target="_blank" rel="noreferrer noopener">California – Digital Age Assurance Act</a> (effective Jan. 1, 2027)

core/list

Generally, the Texas, Utah, and Louisiana laws require app stores to:

Verify user age at account creation in order to distinguish minors from adult users.

Classify minor accounts into specific brackets: children (under 13), younger teens (13-15), older teens (16-17), and adults (18+).

Obtain parental consent for app downloads, app purchases, and in-app purchases.

The California law is similar but with a greater focus on design and technical solutions rather than the explicit obligations listed above. For example, app stores must provide an accessible interface for users to indicate their age at account setup and must provide app developers with a signal containing the user’s age bracket via APIs.

These laws do not just place obligations on app stores. While there are nuances distinguishing these laws, at a high level, app developers must:

Publish an age rating.In Texas, Utah, and Louisiana, app developers must assign their apps and in-app purchases an age rating corresponding to the age brackets that app stores maintain under these laws.

Verify age and consent through the app store. Utah and Louisiana require that app developers verify, through the app store, the user’s age bracket and whether verifiable parental consent has been obtained for minor accounts. California requires app developers to request a signal containing the user’s age from the app store when the app is downloaded. Louisiana, notably, requires minor accounts to be affiliated with a parent account.

Notify the app store of a “significant change” to an app. Texas, Utah, and Louisiana require that the app developer notify the app store before making a “significant change” to an app. “Significant change” is defined in these laws and generally refers to a specific material modification of the app’s terms of service, privacy policy, content or age rating, monetization features, or user experience.

Obtain age or consent directly from user. Utah and Louisiana require that app developers request personal age verification data or parental consent when a user downloads or purchases an app, or when implementing a “significant change” to the app.

Engage in age design minimization. Both Utah and Louisiana require that app developers, when working with contradictory age data, use the lowest age bracket for implementing any developer-created safety-related features or defaults.

Both <a href="https://developer.apple.com/news/?id=2ezb6jhj" target="_blank" rel="noreferrer noopener">Apple</a> and <a href="https://support.google.com/googleplay/android-developer/answer/16569691?hl=en" target="_blank" rel="noreferrer noopener">Google</a> recently announced how their app stores will handle age signaling from a technical standpoint. App developers should familiarize themselves with these technical standards and prepare to implement the required APIs into their apps in advance of the Texas law’s Jan. 1, 2026, effective date.

Fortunately for app developers, the laws generally provide a safe harbor from liability when relying on age information received from the app stores. For example, the Texas, Utah, and Louisiana laws explicitly state that app developers are not liable when they (a) use widely adopted industry standards to determine the age rating and specific content for an app and apply those standards consistently and in good faith, (b) rely in good faith on age category and consent information received from an app store, and (c) otherwise comply with the app age-assurance law. However, this is not to say that app developers may turn a blind eye to evidence that contradicts the age information received from an app store. For example, California’s law states that if an app developer has internal clear and convincing information that a user’s age is different than the age indicated by the app store’s age signal, the developer can then use the internal information as the primary indicator of the user’s age.

How Do These Laws Interact with Existing Children’s Privacy Rules?

These state laws do not replace existing laws protecting minors, such as those requiring parental consent before processing personal information. They layer on top of and expand existing frameworks such as the Children’s Online Privacy Protection Act (COPPA), state comprehensive privacy laws, state age-appropriate design codes, state online safety laws, state social media laws and state addictive feed laws. App developers should note the overlapping requirements and be prepared to address follow-on compliance under other laws. For example, apps targeting children under 13 must obtain parental consent for data collection and provide clear notices as required under COPPA and the provisions governing collection of personal data from a “known child” under the Texas Data Privacy and Security Act and the Utah Consumer Privacy Act. Businesses should also prepare for potential implications regarding the requirement to obtain opt-in consent for “sales” and “sharing” of personal information about consumers under 16 under the California Consumer Privacy Act.

Are There Other Age-Assurance Laws to Be Aware Of?

More states are considering similar laws, and a federal App Store Accountability Act was also proposed earlier this year. Further, these laws are not unique to the U.S. For example, Brazil’s Digital Statute of the Child and Adolescent (“Digital ECA”) , which also passed this year, includes age-assurance requirements for both app stores and app developers, including implementing and receiving a technical age signal. As discussed in a <a href="https://www.bakerlaw.com/insights/trick-or-track-age-signals-in-new-yorks-childrens-privacy-law/" target="_blank" rel="noreferrer noopener">previous post</a>, New York’s Child Data Protection Act also included age-signal requirements. These laws are part of the continued expansion of online safety and privacy legislation related to minors that shows no sign of slowing down.<a id="_msocom_1"></a>

An App Developer’s Guide to App Store Age-Assurance Laws