5/7/2025App Store Accountability ActGeneral Provisions

Amended by Chapter 95, 2026 General Session2026Definitions.As used in this chapter:"Account holder" means an individual who is associated with a mobile device."Age category" means one of the following categories of individuals based on age:"child" which means an individual who is under 13 years old;"younger teenager" which means an individual who is at least 13 years old and under 16 years old;"older teenager" which means an individual who is at least 16 years old and under 18 years old; or"adult" which means an individual who is at least 18 years old."Age category data" means information about a user's age category that is:collected by an app store provider; andshared with a developer."Age rating" means a classification that provides an assessment of the suitability of an app's content for different age groups."App" means a software application or electronic service that a user may run or direct on a mobile device."App store" means a publicly available website, software application, or electronic service that allows users to download apps from third-party developers onto a mobile device."App store provider" means a person that owns, operates, or controls an app store that allows users in the state to download apps onto a mobile device."Content description" means a description of the specific content elements that informed an app's age rating."Developer" means a person that owns or controls an app made available through an app store in the state."In-app purchase" means a charge associated with any user conduct within an app and billed by an app store for the acquisition of virtual currency, digital goods, digital services, or other apps."Knowingly" means to act with actual knowledge or to act with knowledge fairly inferred based on objective circumstances."Minor" means an individual under 18 years old that:has not been emancipated as that term is defined in Section 80-7-102; orhas not been married."Minor account" means an account with an app store provider that:is established by an individual who the app store provider has determined is under 18 years old through the app store provider's age verification methods; andrequires affiliation with a parent account."Mobile device" means a phone or general purpose tablet that:provides cellular or wireless connectivity;is capable of connecting to the internet;runs a mobile operating system; andis capable of running apps through the mobile operating system."Mobile operating system" means software that:manages mobile device hardware resources;provides common services for mobile device programs;controls memory allocation; andprovides interfaces for applications to access device functionality."Parent" means, with respect to a minor, an individual who is reasonably believed to be:an individual who has a parent-child relationship, as defined in Section 81-5-102, with the minor;a legal guardian; an individual with legal custody; orany other individual who has legal authority to make decisions on behalf of a minor."Parent account" means an account with an app store provider that:is verified to be established by an individual who the app store provider has determined is not a minor through the app store provider's age verification methods; andmay be affiliated with one or more minor accounts."Parental consent disclosure" means the following information that an app store provider is required to provide to a parent before obtaining verifiable parental consent:if the app store provider has an age rating for the app, the app's age rating;if the app store provider has a content description for the app, the app's content description;a description of:the personal data collected by the app from a user; andthe personal data shared by the app with a third party; andif personal data is collected by the app, the methods implemented by the developer to protect the personal data."Pre-installed application" means an app, or portion of an app, that is present on a mobile device at the time of:purchase;initial activation; orfirst use by a consumer."Pre-installed application" includes:an app, or portion of an app, installed or partially installed by:the device manufacturer;a wireless service provider;a retailer; orany other party before purchase, initial activation, or first use by the consumer; andbrowsers, search engines, and messaging applications."Pre-installed application" does not include:core operating system functions;essential device drivers;applications necessary for basic device operation, including:phone applications;settings applications; oremergency services applications; orsecurity or system maintenance applications essential to device functionality."Significant change" means a material modification to an app's terms of service or privacy policy that:changes the categories of data collected, stored, or shared;alters the app's age rating or content descriptions;introduces in-app purchases where no in-app purchases were previously present in the app; orintroduces advertisements where no advertisements were previously present in the app."Verifiable parental consent" means authorization that:is provided by an individual who the app store provider has verified is an adult;is given after the app store provider has clearly and conspicuously provided the parental consent disclosure to the individual; andrequires the parent to make an affirmative choice to:grant consent; ordecline consent.

App Store Provider and Developer Requirements

Amended by Chapter 157, 2026 General Session2026App store provider requirements.Beginning May 6, 2027, an app store provider shall:at the time an individual who is located in the state creates an account with the app store provider, or for an existing account, within 12 months after the day on which the obligations described in this section take effect:request age category information from the individual; andverify the individual's age category using commercially available methods that are reasonably designed to ensure accuracy, which for a minor shall include affirmative age attestation by a parent together with other age information collected as part of the creation or use of an account;if the age verification method or process described in Subsection (1)(a) determines the individual is a minor:require the account to be affiliated with a parent account; andobtain verifiable parental consent from the holder of the affiliated parent account before allowing the minor to:download an app;purchase an app; ormake an in-app purchase;after receiving notice of a significant change from a developer:notify the account holder of the significant change; andfor a minor account:notify the holder of the affiliated parent account; andobtain renewed verifiable parental consent;provide to a developer, in response to a request authorized under Section 13-76-202:age category data for a user located in the state; andthe status of verified parental consent for a minor located in the state;notify a developer when a parent revokes parental consent; protect age category data and any associated verification data by:limiting collection and processing to data necessary for:verifying an account holder's age;obtaining verifiable parental consent; ormaintaining compliance records; andtransmitting age category data using industry-standard encryption protocols that ensure:data integrity; anddata confidentiality;for a pre-installed application:provide available age category information in response to a request from a developer; andtake reasonable measures to facilitate verifiable parental consent for use of the app in response to a request from a developer; andcomply with a developer's request made in accordance with Subsection 13-76-202(6) to prevent minor accounts from downloading or purchasing the developer's app.Beginning May 6, 2027, an app store provider may not:enforce a contract or terms of service against a minor unless the app store provider has obtained verifiable parental consent;knowingly misrepresent the information in the parental consent disclosure; orshare age category data or any associated verification data except:between an app store provider and a developer as required by this chapter; oras required by law.

Amended by Chapter 157, 2026 General Session2026Developer requirements.Beginning May 6, 2027, a developer shall:verify through the app store's data sharing methods:the age category data of account holders located in the state; andfor a minor account, whether verifiable parental consent has been obtained;notify app store providers of a significant change to the app; andrequest age category data or parental consent:at the time an account holder:downloads an app; purchases an app; orlaunches a pre-installed application for the first time;when implementing a significant change to the app; orto comply with applicable laws or regulations.Beginning May 6, 2027, a developer may request age category data:no more than once during each 12-month period to verify:accuracy of age category data associated with an account holder; orcontinued account use within the verified age category;when there is reasonable suspicion of:account transfer; ormisuse outside the verified age category; orat the time an account holder creates a new account with the developer.Beginning May 6, 2027, when initially implementing any developer-created safety-related features or defaults, a developer shall use the lowest age category indicated by:age verification data provided by an app store provider; orage data independently collected by the developer.Subsection (3)(a) does not prohibit a developer from allowing a parent to customize age-related restrictions, safety-related features, or content settings for individual users within a minor account after the initial defaults described in Subsection (3)(a) are set.Beginning May 6, 2027, a developer may not:enforce a contract or terms of service against a minor unless the developer has verified through the app store's data sharing methods that verifiable parental consent has been obtained;knowingly misrepresent any information in the parental consent disclosure; orshare age category data with any person.Beginning May 6, 2027, a developer may only use age category data received through the app store's data sharing methods to:enforce any developer-created age-related restrictions;ensure compliance with applicable laws and regulations; orimplement any developer-created safety-related features or defaults.Beginning May 6, 2027, a developer may request that an app store provider prevent minor accounts from downloading or purchasing the developer's app.

Enforcement and Safe Harbor

Amended by Chapter 157, 2026 General Session2026Enforcement.Beginning May 6, 2027, only a minor, or the parent of that minor, who has been harmed by a violation of Subsection 13-76-201(2) may bring a civil action against an app store provider.Beginning May 6, 2027, only a minor, or the parent of that minor, who has been harmed by a violation of Subsection 13-76-202(4) may bring a civil action against a developer.In an action described in Subsection (1), the court shall award a prevailing parent:the greater of:actual damages; or$1,000 for each violation;reasonable attorney fees; andlitigation costs.

Amended by Chapter 157, 2026 General Session2026Safe harbor.A developer is not liable for a violation of this chapter if the developer demonstrates that the developer:relied in good faith on:age category data received through an app store's data sharing methods; andnotification from an app store provider that verifiable parental consent was obtained if the age category data indicates that the account holder is a minor; andcomplied with the requirements described in Section 13-76-202.The safe harbor described in this section:applies only to actions brought under this chapter; anddoes not limit a developer or app store provider's liability under any other applicable law.

Enacted by Chapter 446, 2025 General Session2025Severability.If any provision of this chapter or the application of any provision to any person or circumstance is held invalid by a final decision of a court of competent jurisdiction, the remainder of this chapter shall be given effect without the invalid provision or application.The provisions of this chapter are severable.

Amended by Chapter 157, 2026 General Session2026Application and limitations.Nothing in this chapter shall be construed to:prevent an app store provider or developer from taking reasonable measures to:block, detect, or prevent distribution to minors of:unlawful material;obscene material; orother harmful material;block or filter spam;prevent criminal activity; orprotect app store or app security;require an app store provider to disclose user information to a developer beyond:age category data; orverification of parental consent status;allow an app store provider or developer to implement measures required by this chapter in a manner that is:arbitrary;capricious;anticompetitive; orunlawful;require a developer to collect, retain, reidentify, or link any information beyond what is:necessary to verify age categories and parental consent status as required by this chapter; andcollected, retained, reidentified, or linked in the developer's ordinary course of business;require an app store provider or developer to block access to an application that an account holder has downloaded or installed onto a mobile device before the day on which the obligations described in Sections 13-76-201 and 13-76-202 take effect, except to the extent that:a parent account revokes verifiable parental consent for an affiliated minor account; ora significant change to the application has occurred;require a developer or app store provider to create, adopt, or implement an app age rating system or content classification framework; ordisplace any other available remedies or rights authorized under the laws of this state or the United States.