Utah's App Store Accountability Act: Age Categories, Parent Accounts and the May 2027 Start Date

What SB 142 (2025) Requires of App Stores

SB 142 of the 2025 General Session, App Store Accountability Act, was sponsored by Senator Todd Weiler and Representative James A. Dunnigan. The bill passed the Senate 24 to 1 on February 10, 2025, passed the House 64 to 3 on March 4 with an amendment, won Senate concurrence 25 to 1 on March 5, and was signed March 26, 2025. The codified history notes record it as chapter 446 of the 2025 session. The enrolled text placed the Act at chapter 75 of Title 13; it is codified at chapter 76.

The Act's premise is a shift in where age checks happen. Instead of each app asking a user's age, the operator of the app store does it once, at the account level, and passes the result to developers on request. An app store provider is a person that owns, operates or controls a publicly available website, application or service from which users in Utah download apps from third-party developers onto a mobile device, and a mobile device is a phone or general-purpose tablet with connectivity and a mobile operating system. The duties attach to accounts of individuals located in the state.

As enacted, the provider and developer duties were to start May 6, 2026, and the enforcement section on December 31, 2026. A year later, HB 498 of the 2026 General Session, Utah App Store Accountability Act Amendments, by the same sponsors, rewrote most of the chapter before any of it applied. HB 498 passed the House on February 24, 2026, passed the Senate on March 5, won House concurrence on March 6, and was signed March 18, 2026; the codified sections show it in effect from that day. The account below follows the chapter as amended.

Age Categories and Verification

Section 13-76-101 defines four age categories: a child is under 13, a younger teenager is 13 to 15, an older teenager is 16 or 17, and an adult is 18 or older. A minor is an unemancipated, unmarried individual under 18. Age category data is information about a user's category that the app store collects and shares with a developer.

Under section 13-76-201(1)(a), beginning May 6, 2027, a provider requests age category information when an individual located in Utah creates an account, or, for an existing account, within 12 months after the obligations take effect. It then verifies the category "using commercially available methods that are reasonably designed to ensure accuracy," which for a minor include "affirmative age attestation by a parent together with other age information collected as part of the creation or use of an account." The parental-attestation clause came in with HB 498, which also removed the 2025 option of verifying through a method approved by Division rule.

The section limits what happens to the data. Collection and processing of age category data and associated verification data are confined to verifying age, obtaining parental consent and maintaining compliance records, and the data travels under industry-standard encryption. A provider may not share it except with a developer as the chapter requires or as law requires.

Parental Consent Linked to a Parent Account

If verification shows an individual is a minor, the provider requires the account to be affiliated with a parent account, one the provider has verified belongs to an adult, and obtains verifiable parental consent from that account holder before the minor may download an app, purchase an app or make an in-app purchase. Verifiable parental consent means authorization from a verified adult, given after the provider "clearly and conspicuously" presents the parental consent disclosure, through an affirmative choice to grant or decline. The disclosure covers the app's age rating and content description where the provider has them, the personal data the app collects and shares with third parties, and the developer's methods for protecting that data.

• When a developer reports a significant change, the provider notifies the account holder and, for a minor account, notifies the parent account and obtains renewed consent
• A significant change is a material change to terms or privacy policy that alters the data collected or shared, changes the age rating or content descriptions, or introduces in-app purchases or advertising where there were none
• The provider notifies the developer when a parent revokes consent
• From May 6, 2027, a provider may not enforce a contract or terms of service against a minor without verifiable parental consent, and may not knowingly misrepresent the parental consent disclosure

HB 498 added rules for pre-installed applications, defined as apps present on a device at purchase, activation or first use, including browsers, search engines and messaging apps, but not core operating system functions, phone, settings or emergency apps, or security tools. For those, the provider supplies available age category information and takes reasonable measures to facilitate parental consent when a developer asks. Section 13-76-404 provides that the chapter does not require blocking an app downloaded before the duties begin unless a parent revokes consent or the app makes a significant change.

Duties on Developers

Section 13-76-202 applies to a developer, meaning a person that owns or controls an app made available through an app store in Utah. From May 6, 2027, a developer verifies through the app store's data sharing methods the age category of account holders located in Utah and, for a minor account, whether consent has been obtained. It requests that information when an account holder downloads or buys the app or first launches a pre-installed app, when it implements a significant change, or to comply with law, and it notifies app stores of significant changes. Further requests are allowed once every 12 months, on reasonable suspicion of account transfer or misuse, or when a user opens a new account with the developer.

• When first implementing developer-created safety features or defaults, the developer uses the lowest age category indicated by the app store's data or its own age data, and a parent may customize settings after that
• Age category data received from the app store may be used only to enforce developer-created age restrictions, to comply with law, or to implement safety features or defaults, and may not be shared with any person
• A developer may not enforce a contract or terms of service against a minor unless it has verified through the app store that consent was obtained, and may not knowingly misrepresent the parental consent disclosure
• A developer may ask a provider to prevent minor accounts from downloading or buying its app, and the provider complies

Section 13-76-402 gives developers a safe harbor for actions under the chapter if they relied in good faith on age category data and consent notifications received through the app store and complied with section 13-76-202. HB 498 deleted a 2025 provision that had treated a developer as compliant with the age-rating disclosure duty if it applied widely adopted industry standards, and section 13-76-404 now states that the chapter does not require anyone to create or adopt an age rating system.

Effective Dates and the Private Right of Action

The enforcement scheme changed the most. The 2025 text of section 13-75-401 made a knowing misrepresentation of the parental consent disclosure a deceptive trade practice under section 13-11a-3, and section 13-75-301 directed the Division of Consumer Protection to make rules on age verification methods. The enrolled text of HB 498 deletes the deceptive-trade-practice subsection and repeals the rulemaking section outright.

What remains is section 13-76-401. Beginning May 6, 2027, only a minor, or the parent of that minor, harmed by a violation of section 13-76-201(2) may sue an app store provider, and only a minor or parent harmed by a violation of section 13-76-202(4) may sue a developer. The court awards a prevailing parent the greater of actual damages or $1,000 for each violation, plus reasonable attorney fees and litigation costs. Section 13-76-404 adds that the chapter displaces no other state or federal remedy.

The 2026 rewrite tracked litigation. The Computer & Communications Industry Association, whose members include app store operators Google, Apple and Amazon, filed a First Amendment challenge against the Attorney General and the Division director on February 5, 2026, No. 2:26-cv-00094 (D. Utah), and three minors suing through next friends brought a related case, No. 2:26-cv-00125, later reassigned to the same judge. On April 21, 2026 both ended in stipulated dismissals (CCIA; M.M.) reciting that the Act as amended by HB 498 "does not authorize government enforcement of any of its provisions; rather, it creates only a private cause of action," and that the defendants "do not have the authority, and will not seek, to enforce the Act directly or as an asserted basis for liability under any other statute."

Similar Laws in Other States

This article reads one other state's enacted text. Texas SB 2420 of the 89th Legislature, also titled the App Store Accountability Act and codified as chapter 121 of the Business and Commerce Code, passed the Senate 30 to 1 and the House 120 to 9 and took effect January 1, 2026. Section 121.021 uses the same four age categories as Utah, and the statute pairs app store verification and parental consent with developer age-rating duties. Unlike Utah's amended law, section 121.101 makes a violation a deceptive trade practice actionable under the Texas Deceptive Trade Practices Act.

On December 23, 2025, Judge Robert Pitman of the Western District of Texas preliminarily enjoined the Attorney General from enforcing SB 2420, holding it a content-based law that failed strict scrutiny. On June 4, 2026, a Fifth Circuit motions panel stayed that injunction and a companion one pending appeal in a published order, concluding that Texas had made a strong showing that the district court likely erred in applying strict scrutiny because app store listings propose commercial transactions. The consolidated appeals, Nos. 25-51073 and 26-50001, were argued on August 4, 2026; no merits decision appeared in the docket entries retrieved for this article.

Frequently Asked Questions