App Stores, Device Makers Thrust Into Age Verification Battle

A wave of legislation seeking to force app store providers and device makers to verify the ages of their users represents a shift in policymaking efforts, now addressing technical and accountability changes to create an internet more responsive to the age of users.

The question in policy circles is no longer whether we should or can treat kids differently than adults online, but who should be responsible for knowing which users are children — and what should happen if they do not.

While Utah and Texas have pioneered a new model combining mandatory app store age verification with a private enforcement mechanism, California has recently charted an entirely different course that would largely preserve the status quo where users self-declare their age and the state attorney general is tasked with exclusive enforcement.

A dozen other states, including Alabama, Hawaii and South Dakota, are considering related bills, most of which mirror the Utah/Texas model at this point. Federal proposals, meanwhile, would resolve state conflicts by nationalizing one approach, forcing a choice between two incompatible visions of how to best protect kids and families online.

Utah became the first state to implement comprehensive app store age verification when Governor Spencer Cox (R) signed SB142 on March 26, with compliance obligations beginning in May and private lawsuits possible next December. Texas quickly followed with Governor Greg Abbott signing SB2420 on May 27, taking effect next year.

These laws are fundamentally similar in their core approach. Both require app store providers to verify the age of all users and categorize them into four brackets: child (under 13), younger teenager (13-15), older teenager (16-17) and adult (18+). Both mandate that minors have affiliated parent accounts and require verifiable parental consent before allowing app downloads, in-app purchases or app purchases. Both designate violations as deceptive trade practices, enabling both state attorney general enforcement and private lawsuits by parents.

The technical requirements are meaningful and nearly identical. Both laws require app stores to: (1) actually verify how old users are when they sign up using “commercially reasonable methods” (e.g., ID, credit card, biometric scan), (2) link children’s accounts to their parents’ accounts, (3) get permission from parents before children can download apps or make purchases, (4) tell app developers how old each user is and whether parents gave permission, (5) notify parents when apps make major changes (like new data collection) and get permission again, and (6) securely transmit age information to developers in encrypted form.

The key innovation of the Utah/Texas model is combining mandatory age verification with private rights of action. Rather than relying solely on state attorney general enforcement, these laws enable individual parents to sue platforms directly.

Texas designates violations as deceptive trade practices under state consumer protection law, which allows both the Texas attorney general to take enforcement action and individual parents to sue app stores or developers directly. If parents win these lawsuits, they can recover monetary damages, get court orders requiring companies to change their practices and have the company pay their attorney's fees. Utah creates similar enforcement through its consumer protection laws, allowing parents to sue for violations.

California’s AB1043 represents a fundamentally different regulatory philosophy. Passed by both legislative chambers with strong bipartisan support and awaiting Governor Gavin Newsom’s (D) signature, the bill would take effect in January 2027 if signed.

Rather than mandatory identity verification, California focuses on self-reported age information transmitted through digital signals. The technical requirements are minimal compared to Utah and Texas. California requires: (1) a simple screen during device setup asking users to enter their age or birth date, (2) the operating system to automatically share this age information with apps when they’re downloaded, and (3) for app stores to get parental permission before children under 16 can download apps. Importantly, California does not require any verification that the age information is accurate — users can simply type in whatever age they want.

California also eliminates private enforcement entirely. The bill provides enforcement exclusively through the California attorney general, with civil penalties of $2,500 per affected child for negligent violations or $7,500 per affected child for intentional violations. No private right of action is included, eliminating the distributed litigation framework that characterizes the Utah/Texas approach.

Major tech companies like Google have supported California's bill, with Google’s senior director of government affairs & public policy calling it “one of the most thoughtful approaches we’ve seen thus far,” while opposing the comprehensive verification requirements in Utah and Texas. App developers like Meta have supported both efforts saying the California law “would centralize age verification within app stores and operating systems … In doing so, it would give teens a better, age-appropriate online experience while giving parents peace of mind.” Along with X and Snap, the company also praised the Utah bill, saying, “Parents want a one-stop shop to verify their child’s age and grant permission for them to download apps in a privacy-preserving way. The app store is the best place for it.”

The debate is headed to Capitol Hill.

The congressional App Store Accountability Act, introduced in May by Rep. John James (R-MI) and Sen. Mike Lee (R-UT), would resolve the state law conflict by nationalizing the Utah/Texas approach.

The bill would apply to app stores, require age verification using commercially reasonable methods and mandate parental consent for all minors using the same basic age categories. Most significantly, the federal measure would preempt state laws and centralize enforcement under the Federal Trade Commission. This eliminates the private litigation frameworks in Texas and Utah, while also overriding California’s minimal signaling approach. As the issue gains prominence, more bills modeled after the California law could enter the federal arena.

If any federal bill passes, it would likely end state-level policy experimentation by imposing a uniform national standard for ascertaining user age.