Rep. Norm Thurston — Voting Record

Bill

Number

S.B. 142 (2025GS)

Sponsor

Sen. Weiler, Todd

Final action

Governor Signed 3/26/2025

Outcome

Became law — signed by Gov. Spencer J. Cox

Summary

What it does

• This bill:
• defines terms;
• requires app store providers to:
• verify a user's age category;
• obtain parental consent for minor accounts;
• notify users and parents of significant changes;
• share age category and consent data with developers; and
• protect age verification data;
• prohibits app store providers from:
• enforcing contracts against minors without parental consent; and
• misrepresenting parental content disclosures;
• requires developers to:
• verify age category and consent status through app stores; and
• notify app stores of significant changes;

Every vote on this bill

Bill text

35
13-75-101
13-75-201
13-75-202
13-75-301
13-75-401
13-75-402
13-75-403
13-75-404
13-75-101
13-75-201
13-75-202
13-75-301
13-75-401
13-75-402
13-75-403
13-75-404
0
App Store Accountability Act
2025 GENERAL SESSION
STATE OF UTAH
Chief Sponsor: Todd Weiler
House Sponsor: James A. Dunnigan
LONG TITLE
General Description:
This bill enacts provisions governing app store operations and creates requirements for age 
verification and parental consent.
Highlighted Provisions:
This bill:
defines terms;
requires app store providers to:
verify a user's age category;
obtain parental consent for minor accounts;
notify users and parents of significant changes;
share age category and consent data with developers; and
protect age verification data;
prohibits app store providers from:
enforcing contracts against minors without parental consent; and
misrepresenting parental content disclosures;
requires developers to:
 verify age category and consent status through app stores; and
notify app stores of significant changes;
prohibits developers from:
enforcing contracts against minors without verified parental consent; and
misrepresenting parental content disclosures;
designates violations of certain provisions as deceptive trade practices;
requires the Division of Consumer Protection to establish standards for age verification 
methods;
creates a private right of action for parents of harmed minors;
provides a safe harbor for compliant developers; and
includes a severability clause.
Money Appropriated in this Bill:
None
Other Special Clauses:
This bill provides a special effective date.
Utah Code Sections Affected:
ENACTS:
13-75-101
, 
Effective 
05/07/25
 Utah Code Annotated 1953
13-75-201
, 
Effective 
05/06/26
 Utah Code Annotated 1953
13-75-202
, 
Effective 
05/06/26
 Utah Code Annotated 1953
13-75-301
, 
Effective 
05/07/25
 Utah Code Annotated 1953
13-75-401
, 
Effective 
12/31/26
 Utah Code Annotated 1953
13-75-402
, 
Effective 
05/07/25
 Utah Code Annotated 1953
13-75-403
, 
Effective 
05/07/25
 Utah Code Annotated 1953
13-75-404
, 
Effective 
05/07/25
 Utah Code Annotated 1953
Be it enacted by the Legislature of the state of Utah:
Section 1, Section 
13-75-101
 is enacted to read:
75. APP STORE ACCOUNTABILITY ACT
1. General Provisions
13-75-101
Effective 
05/07/25
. Definitions.
As used in this chapter:
(1)
"Age category" means one of the following categories of individuals based on age:
(a)
"child" which means an individual who is under 13 years old;
(b)
"younger teenager" which means an individual who is at least 13 years old and under 
16 years old;
(c)
"older teenager" which means an individual who is at least 16 years old and under 18 
years old; or
(d)
"adult" which means an individual who is at least 18 years old.
(2)
"Age category data" means information about a user's age category that is:
(a)
collected by an app store provider; and
(b)
shared with a developer.
(3)
"Age rating" means a classification that provides an assessment of the suitability of an 
app's content for different age groups.
(4)
"App" means a software application or electronic service that a user may run or direct 
on a mobile device.
(5)
"App store" means a publicly available website, software application, or electronic 
service that allows users to download apps from third-party developers onto a mobile 
device.
(6)
"App store provider" means a person that owns, operates, or controls an app store that 
allows users in the state to download apps onto a mobile device.
(7)
"Content description" means a description of the specific content elements that informed 
an app's age rating.
(8)
"Developer" means a person that owns or controls an app made available through an 
app store in the state.
(9)
"Division" means the Division of Consumer Protection, established in Section 
13-2-1
.
(10)
"Knowingly" means to act with actual knowledge or to act with knowledge fairly 
inferred based on objective circumstances.
(11)
"Minor" means an individual under 18 years old.
(12)
"Minor account" means an account with an app store provider that:
(a)
is established by an individual who the app store provider has determined is under 18 
years old through the app store provider's age verification methods; and
(b)
requires affiliation with a parent account.
(13)
"Mobile device" means a phone or general purpose tablet that:
(a)
provides cellular or wireless connectivity;
(b)
is capable of connecting to the Internet;
(c)
runs a mobile operating system; and
(d)
is capable of running apps through the mobile operating system.
(14)
"Mobile operating system" means software that:
(a)
manages mobile device hardware resources;
(b)
provides common services for mobile device programs;
(c)
controls memory allocation; and
(d)
provides interfaces for applications to access device functionality.
(15)
"Parent" means, with respect to a minor, any of the following individuals who have 
legal authority to make decisions on behalf of the minor:
(a)
an individual with a parent-child relationship under Section 
78B-15-201
;
(b)
a legal guardian; or
(c)
an individual with legal custody.
(16)
"Parent account" means an account with an app store provider that:
(a)
is verified to be established by an individual who the app store provider has 
determined is at least 18 years old through the app store provider's age verification 
methods; and
(b)
may be affiliated with one or more minor accounts.
(17)
"Parental consent disclosure" means the following information that an app store 
provider is required to provide to a parent before obtaining parental consent:
(a)
if the app store provider has an age rating for the app or in-app purchase, the app's or 
in-app purchase's age rating;
(b)
if the app store provider has a content description for the app or in-app purchase, the 
app's or in-app purchase's content description;
(c)
a description of:
(i)
the personal data collected by the app from a user; and
(ii)
the personal data shared by the app with a third party; and
(d)
if personal data is collected by the app, the methods implemented by the developer to 
protect the personal data.
(18)
"Significant change" means a material modification to an app's terms of service or 
privacy policy that:
(a)
changes the categories of data collected, stored, or shared;
(b)
alters the app's age rating or content descriptions;
(c)
adds new monetization features, including:
(i)
in-app purchases; or
(ii)
advertisements; or
(d)
materially changes the app's:
(i)
functionality; or
(ii)
user experience.
(19)
"Verifiable parental consent" means authorization that:
(a)
is provided by an individual who the app store provider has verified is an adult;
(b)
is given after the app store provider has clearly and conspicuously provided the 
parental consent disclosure to the individual; and
(c)
requires the parent to make an affirmative choice to:
(i)
grant consent; or
(ii)
decline consent.
Section 2, Section 
13-75-201
 is enacted to read:
2. App Store Provider and Developer Requirements
13-75-201
Effective 
05/06/26
. App store provider requirements.
(1)
An app store provider shall:
(a)
at the time an individual who is located in the state creates an account with the app 
store provider:
(i)
request age information from the individual; and
(ii)
verify the individual's age category using:
(A)
commercially available methods that are reasonably designed to ensure 
accuracy; or
(B)
an age verification method or process that complies with rules made by the 
division under Section 
13-75-301
;
(b)
if the age verification method or process described in Subsection 
(1)
(a) determines 
the individual is a minor:
(i)
require the account to be affiliated with a parent account; and
(ii)
obtain verifiable parental consent from the holder of the affiliated parent account 
before allowing the minor to:
(A)
download an app;
(B)
purchase an app; or
(C)
make an in-app purchase;
(c)
after receiving notice of a significant change from a developer:
(i)
notify the user of the significant change; and
(ii)
for a minor account:
(A)
notify the holder of the affiliated parent account; and
(B)
obtain renewed verifiable parental consent;
(d)
provide to a developer, in response to a request authorized under Section 
13-75-202
:
(i)
age category data for a user located in the state; and
(ii)
the status of verified parental consent for a minor located in the state;
(e)
notify a developer when a parent revokes parental consent; and
(f)
protect personal age verification data by:
(i)
limiting collection and processing to data necessary for:
(A)
verifying a user's age;
(B)
obtaining parental consent; or
(C)
maintaining compliance records; and
(ii)
transmitting personal age verification data using industry-standard encryption 
protocols that ensure:
(A)
data integrity; and
(B)
data confidentiality.
(2)
An app store provider may not:
(a)
enforce a contract or terms of service against a minor unless the app store provider 
has obtained verifiable parental consent;
(b)
knowingly misrepresent the information in the parental consent disclosure; or
(c)
share personal age verification data except:
(i)
between an app store provider and a developer as required by this chapter; or
(ii)
as required by law.
Section 3, Section 
13-75-202
 is enacted to read:
13-75-202
Effective 
05/06/26
. Developer requirements.
(1)
A developer shall:
(a)
verify through the app store's data sharing methods:
(i)
the age category of users located in the state; and
(ii)
for a minor account, whether verifiable parental consent has been obtained;
(b)
notify app store providers of a significant change to the app;
(c)
use age category data received from an app store provider to:
(i)
enforce any developer-created age-related restrictions;
(ii)
ensure compliance with applicable laws and regulations; and
(iii)
implement any developer-created safety-related features or defaults;
(d)
request personal age verification data or parental consent:
(i)
at the time a user:
(A)
downloads an app; or
(B)
purchases an app;
(ii)
when implementing a significant change to the app; or
(iii)
to comply with applicable laws or regulations.
(2)
A developer may request personal age verification data or parental consent:
(a)
no more than once during each 12-month period to verify:
(i)
accuracy of user age verification data; or
(ii)
continued account use within the verified age category;
(b)
when there is reasonable suspicion of:
(i)
account transfer; or
(ii)
misuse outside the verified age category; or
(c)
at the time a user creates a new account with the developer.
(3)
When implementing any developer-created safety-related features or defaults, a 
developer shall use the lowest age category indicated by:
(a)
age verification data provided by an app store provider; or
(b)
age data independently collected by the developer.
(4)
A developer may not:
(a)
enforce a contract or terms of service against a minor unless the developer has 
verified through the app store provider that verifiable parental consent has been 
obtained;
(b)
knowingly misrepresent any information in the parental consent disclosure; or
(c)
share age category data with any person.
Section 4, Section 
13-75-301
 is enacted to read:
3. Division Rulemaking
13-75-301
Effective 
05/07/25
. Division rulemaking.
In accordance with Title 63G, Chapter 3, Utah Administrative Rulemaking Act, the 
division shall make rules establishing processes and means by which an app store provider 
may verify whether an account holder is a minor in accordance with Subsection 
13-75-201(1)(a)(ii)
.
Section 5, Section 
13-75-401
 is enacted to read:
4. Enforcement and Safe Harbor
13-75-401
Effective 
12/31/26
. Enforcement.
(1)
A violation of Subsection 
13-75-201(2)(b)
 or Subsection 
13-75-202(4)(b)
 constitutes a 
deceptive trade practice under Section 
13-11a-3
.
(2)
(a)
Only a minor, or the parent of that minor, who has been harmed by a violation of 
Subsection 
13-75-201(2)
 may bring a civil action against an app store provider.
(b)
Only a minor, or the parent of that minor, who has been harmed by a violation of 
Subsection 
13-75-202(4)
 may bring a civil action against a developer.
(3)
In an action described in Subsection (2), the court shall award a prevailing parent:
(a)
the greater of:
(i)
actual damages; or
(ii)
$1,000 for each violation;
(b)
reasonable attorney fees; and
(c)
litigation costs.
Section 6, Section 
13-75-402
 is enacted to read:
13-75-402
Effective 
05/07/25
. Safe harbor.
(1)
A developer is not liable for a violation of this chapter if the developer demonstrates 
that the developer:
(a)
relied in good faith on:
(i)
personal age verification data provided by an app store provider; and
(ii)
notification from an app store provider that verifiable parental consent was 
obtained if the personal age verification data indicates that the user is a minor; and
(b)
complied with the requirements described in Section 
13-75-202
.
(2)
For purposes of setting the age category of an app and providing content description 
disclosures to an app store provider, a developer complies with Subsection 
13-75-202(4)(b)
 if the developer:
(a)
uses widely adopted industry standards to determine:
(i)
the app's age category; and
(ii)
the content description disclosures; and
(b)
applies those standards consistently and in good faith.
(3)
The safe harbor described in this section:
(a)
applies only to actions brought under this chapter; and
(b)
does not limit a developer or app store provider's liability under any other applicable 
law.
(4)
Nothing in this chapter shall displace any other available remedies or rights authorized 
under the laws of this state or the United States.
Section 7, Section 
13-75-403
 is enacted to read:
13-75-403
Effective 
05/07/25
. Severability.
(1)
If any provision of this chapter or the application of any provision to any person or 
circumstance is held invalid by a final decision of a court of competent jurisdiction, the 
remainder of this chapter shall be given effect without the invalid provision or 
application.
(2)
The provisions of this chapter are severable.
Section 8, Section 
13-75-404
 is enacted to read:
13-75-404
Effective 
05/07/25
. Application and limitations.
Nothing in this chapter shall be construed to:
(1)
prevent an app store provider or developer from taking reasonable measures to:
(a)
block, detect, or prevent distribution to minors of:
(i)
unlawful material;
(ii)
obscene material; or
(iii)
other harmful material;
(b)
block or filter spam;
(c)
prevent criminal activity; or
(d)
protect app store or app security;
(2)
require an app store provider to disclose user information to a developer beyond:
(a)
age category; or
(b)
verification of parental consent status;
(3)
allow an app store provider or developer to implement measures required by this 
chapter in a manner that is:
(a)
arbitrary;
(b)
capricious;
(c)
anticompetitive; or
(d)
unlawful;
(4)
require an app store provider or developer to obtain parental consent for an app that:
(a)
provides direct access to emergency services, including:
(i)
911;
(ii)
crisis hotlines; or
(iii)
emergency assistance services legally available to minors;
(b)
limits data collection to information necessary to provide emergency services in 
compliance with 15 U.S.C. Sec. 6501 et seq., Children's Online Privacy Protection 
Act;
(c)
provides access without requiring:
(i)
account creation; or
(ii)
collection of unnecessary personal information; and
(d)
is operated by or in partnership with:
(i)
a government entity;
(ii)
a nonprofit organization; or
(iii)
an authorized emergency service provider; or
(5)
require a developer to collect, retain, reidentify, or link any information beyond what is:
(a)
necessary to verify age categories and parental consent status as required by this 
chapter; and
(b)
collected, retained, reidentified, or linked in the developer's ordinary course of 
business.
Section 9. 
Effective Date.
(1)
Except as provided in Subsections (2) and (3), this bill takes effect May 7, 2025.
(2)
The actions affecting the following sections take effect on May 6, 2026:
(a)
Section 
13-75-201
 (Effective 05/06/26); and
(b)
Section 
13-75-202
 (Effective 05/06/26).
(3)
The actions affecting Section 
13-75-401
 (Effective 12/31/26) take effect on December 
31, 2026.
3-14-25 11:32 AM