Utah’s App Store Accountability Act Goes into Effect

By: Elena Miller and John Pavolotsky

With the passage of Senate Bill 142, the App Store Accountability Act (the “Act”), Utah became the first state to pass legislation requiring app store providers to verify users’ ages and block minors from downloading apps or making in-app purchases without parental consent. The law went into effect on May 7, 2025. App store providers and developers have until May 6, 2026 to comply with the Act’s obligations. The Act’s private right of action, which allows parents to sue app store providers and developers for certain violations, will take effect on December 31, 2026. 

A “developer” is “a person that owns or controls an app made available through the app store in [Utah].” An “app store provider” is “a person that owns, operates, or controls an app store that allows users in [Utah] to download apps onto a mobile device.” Key provisions include:

Requirements for Developers: Developers must age-rate their apps and notify app store providers of a “significant change” to the app. Developers must also, through the app store’s data sharing methods, verify the age category of Utah users and confirm verifiable parental consent if the user is a minor. Developers must request age verification (or parental consent for a minor user) when a user downloads or purchases an app, when the developer implements a significant change to the app, or to comply with applicable laws or regulations.

Age Verification: App store providers must request age information and verify a user’s age category when they create an account. If the age verification method determines that the individual is a minor, the app store provider must require the account to be affiliated with a parent account.

Protection of Age Verification Data: App store providers must transmit personal age verification data to developers only for the purposes described in the Act using industry-standard encryption protocols and limit the collection and sharing of such data.

Parental Consent: App store providers must obtain verifiable parental consent if a user is a minor to download or purchase apps or to make in-app purchases. Before giving consent, parents must be shown a “parental consent disclosure” that displays (1) the app’s age rating and content description given by the developer; (2) the personal data the app collects and shares; and (3) how the developer protects user data.

Protection of Minors from Unfair Contracts: Developers and app store providers must have verifiable parental consent to enforce contracts against minors.

Notification of Significant Changes to Apps: App store providers must notify the affiliated parent account and obtain renewed parental consent if there is a “significant change” to the app. A “significant change” would include changes in how the data is collected, stored, or shared and changes to an app’s age rating or content description.

Violations and Private Right of Action: An app store provider or developer knowingly mispresenting the information in the parental consent disclosure would be a “deceptive trade practice” under Utah law enforceable by the Utah Attorney General.  A minor, or their parent, would have a private right of action against a developer or app store provider if their child is harmed from certain violations. For a developer, these would be violations arising from enforcing a contract or terms of service against a minor without verifying that verifiable parental consent had been obtained, knowingly misrepresenting information in the parental consent disclosure, or sharing age category data with unauthorized [users]. For an app store provider, these would be violations arising from enforcing a contract or terms of service against a minor without obtaining verifiable parental consent, knowingly misrepresenting information in the parental consent disclosure, or sharing personal age verification data except as required by the Act or otherwise by law.  Parents could receive the greater of $1,000 per violation or actual damages, and reasonable attorneys’ fees and litigation costs. However, developers are not liable for violations if they rely in good faith on personal age verification data provided by an app store provider.

Risks for developers include difficulty in implementing compliant systems because there is a lack of clear compliance standards. While the Act directs the Utah Division of Consumer Protection to establish age verification standards, there is no timeline or detailed guidance provided. Further, developers may need to collect and verify sensitive personal information, which is risky in the face of potential data breaches.

Similar bills have been introduced in states such as Alabama, Alaska, California, Hawaii, Kentucky, New Mexico, South Carolina, South Dakota, and West Virginia. A patchwork of state laws seems possible in the near term, creating compliance challenges for developers. In practice, developers will likely align their processes with the most stringent law, which may create additional, but different, compliance overhead. At the federal level, the App Store Accountability Act has been reintroduced in Congress[1], and would require all users to verify their age before accessing an app store and would also require minors’ devices with access to an app store to have parental controls. Stay tuned.

[1] See Press Release, Rep. John James, “John James Introduces Landmark App Store Accountability Act” (May 1, 2025), https://james.house.gov/news/documentsingle.aspx?DocumentID=247.