A wave of US state "App Store Accountability Acts" now requires app stores to verify a user's age and get parental consent for minors — and pushes specific duties onto developers. Texas is live, Utah and Louisiana have slipped to 2027, Alabama takes effect in 2027, and a federal bill is pending. If your app has any users in these states, you need to read the store's age signal and act on it. See how this stacks on top of the amended COPPA Rule →
What these laws do, in one paragraph
Each App Store Accountability Act works the same way. The app store (Apple, Google) must determine an account holder's age category and, for a minor, obtain verifiable parental consent before that user downloads an app, makes an in-app purchase, or receives a "significant" app update. The store exposes the resulting age category to developers through an API. Developers must request and honour that signal, must not misrepresent their app's age rating, and must re-request consent when they ship a significant change. Most versions give developers a liability shield if they rely in good faith on the store's signal. This is a summary of fast-moving legislation, not legal advice.
The 2026 state map
| State | Law | Status and date that matters to developers |
|---|---|---|
| Utah | SB 142, amended by HB 498 | SB 142 signed March 2025 (first in the nation). HB 498, signed March 18, 2026, pushed the operative provisions to May 6, 2027, removed the Attorney General's enforcement power (leaving only a private right of action), and extended the rules to pre-installed browsers, search and messaging apps. |
| Texas | SB 2420 | Signed May 27, 2025; original effective date January 1, 2026. A federal court preliminarily blocked it on December 23, 2025; the Fifth Circuit stayed that injunction; the Supreme Court declined to vacate the stay on July 6, 2026. The law is being enforced now while the constitutional appeal continues, so treat Texas as live but subject to change. |
| Louisiana | HB 570 (2025), repealed and re-enacted by HB 977 | HB 977, signed May 15, 2026, reset the effective date to July 1, 2027 and narrowed developer obligations to acting on store-provided signals. |
| Alabama | HB 161, App Store Accountability Act | Enacted in early 2026; effective January 1, 2027. App stores have until October 1, 2027 to verify accounts that existed before October 2, 2026, which makes Alabama's version partly retroactive. |
| Federal | App Store Accountability Act (S. 1586 / H.R. 3149) | Introduced May 1, 2025 by Senator Mike Lee and Representative John James. Still in committee; not enacted. |
More than a dozen other states introduced similar bills during the 2025 and 2026 sessions. Most stalled or are still pending. Because dates and injunctions are moving almost monthly, verify the current status for any state you care about against that state's legislature site before you rely on it.
What the laws require of developers specifically
- Receive and use the age category from the store API. The statutory categories in Texas are under 13 (child), 13 to 15 (younger teenager), 16 to 17 (older teenager), and 18 or older (adult). Utah, Louisiana and Alabama use the same or very similar bands.
- Rely on store-brokered parental consent. The store collects consent from the parent or guardian for a minor's download and purchases. Developers generally do not run their own consent flow for the download itself, but they must respect a consent that is granted or later revoked.
- Re-request consent on a "significant" change or update. The developer decides what counts as significant for their app — a new data practice, a jump in age rating, a materially new feature — and must notify the store so it can re-prompt the parent. Underplaying this is where enforcement risk sits.
- Do not misrepresent the age rating or content. Setting a low age rating to dodge the verification path is a violation of both the state law and store policy (Apple Guideline 2.3, Google Play Families policy).
- Limit how you use the age data. Utah's HB 498 restricts developer use of store age-category data to three purposes: enforcing age restrictions, complying with law, and providing safety features. Google's and Apple's API terms already ban using the signal for advertising, marketing, profiling or analytics.
Apple's Declared Age Range API
Apple introduced the Declared Age Range API at WWDC 2025 as part of its "age-appropriate experiences" tooling. It ships in iOS 26, iPadOS 26 and macOS 26 and is gated by the com.apple.developer.declared-age-range entitlement.
The API returns a coarse age range only if the user or their parent chooses to share it. Alongside the range, it exposes signals your code should branch on:
- whether an age-related regulatory requirement applies to this user;
- whether the user is required to share an age range;
- whether you must obtain a parent or guardian's permission before delivering a significant app update to a child.
Supporting pieces: the Significant Change API under PermissionKit (SignificantAppUpdateTopic) for the re-consent prompt, a new age-rating property in StoreKit (appstore/ageRatingCode) so you can detect rating changes on device, and App Store Server Notifications that tell your backend when a parent revokes consent. Apple began sharing age categories for new Apple Accounts tied to specific jurisdictions on a rolling basis (Texas, then Louisiana from July 1, 2026, with Utah announced for May 6, 2026 before that state's law was delayed). Test in the sandbox now; the exact go-live per state is tied to the litigation and should be re-checked.
Google's Play Age Signals API
Google's equivalent is the Play Age Signals API, currently in beta and documented at developer.android.com/google/play/age-signals. Default buckets are 0 to 12, 13 to 15, 16 to 17, and 18 or older, with custom ranges available on request. The response also tells you the basis for the signal: parental management, self-declaration, or age estimation and verification.
It is a client-side API that only works while your app is open, it collects no data itself, and you must declare that you use it in your Play Data safety form. You notify Google of significant changes through Play Console, and Google seeks parental approval through its existing supervised-account and Family Link controls. Rollout so far: Brazil from March 17, 2026, Texas accounts created after late May 2026, Australia and Canada from mid-August 2026, and a stated plan to reach all users worldwide during 2026.
How this interacts with COPPA and the Kids Category
These state laws sit on top of existing rules; they do not replace them.
- COPPA still governs data collection from under-13s. The FTC's amended COPPA Rule reaches full compliance on April 22, 2026. A "child" signal from the store helps you gate features, but it does not stand in for the verifiable parental consent COPPA requires before you collect personal information from a child. See what a kids-app privacy policy must now say.
- The Kids Category / Designed for Families programmes are separate. Their rules on ads, analytics and content still apply on their own terms. The store age signal is a runtime tool for age-gating, not a change to category eligibility.
- Do not use age ratings as a workaround. Rating a genuinely teen or child app 17+ to avoid the minor flow breaks the state law and gets the app pulled under store policy.
What to do now
1. List the states your app reaches. Texas is live; Utah, Louisiana,
Alabama are 2027; a federal bill is pending.
2. Adopt the store APIs:
- iOS: Declared Age Range API + PermissionKit Significant Change
API + StoreKit age-rating property + App Store Server Notifications.
- Android: request Play Age Signals API (beta) access.
3. Write down, in your own docs, what counts as a "significant change"
for your app. Wire the re-consent prompt to those events.
4. Handle all four age bands, including the case where the user
declines to share a range.
5. Handle consent revocation: degrade to an age-appropriate mode,
do not hard-crash or lock the user out with no explanation.
6. Restrict age-signal data to age-gating, legal compliance and
safety. Never feed it to ads, attribution or analytics.
7. Confirm your store age rating is honest for every region.
8. Update your privacy policy to describe the age-signal usage,
the parental-consent flow, and revocation handling.
9. Update the Play Data safety form to declare Age Signals API use.
10. Re-check each state's status and each store's per-state go-live
date quarterly. They are still moving.Uncertain and moving
Treat these as live risks, not settled facts: Texas is enforced but under active appeal and could be re-enjoined; Utah's operative date moved from 2026 to May 6, 2027 and its enforcement model changed; Louisiana moved to July 1, 2027; Apple's originally announced per-state signal dates predate some of those delays. This post reflects the picture in 2026 and is not legal advice — confirm with counsel before you ship a compliance design.
Related
Pair this with COPPA 2026: what your kids-app privacy policy must say, EU DSA trader status for app developers for the other store-mediated identity rule, Android developer verification 2026, and the Google Play Data safety form walkthrough. Use the privacy policy page generator to add the age-signal and parental-consent disclosures your policy now needs.