Utah App Store Accountability Act (SB 142)

First state app-store age verification law; effective 6 May 2026 with enforcement provisions from 31 December 2026. Developers get a safe harbour for reasonable reliance on store-provided age signals.

JurisdictionUtah
CategoryPrivacy & Data Protection
StatusPhased
Effective date
Latest development

Analysis

Utah’s App Store Accountability Act (SB 142, 2025 General Session) is a state law that imposes age verification, parental consent, and app developer obligations on app store providers and app developers, with phased effective dates starting May 7, 2025 and major operational obligations effective May 6, 2026 and later.Enrolled SB 142 PDF Utah Code Title 13, Chapter 76 (App Store Accountability Act) Utah House “Social Media and Child Safety” overview Inside Privacy analysis

Below is a structured, requirement-by-requirement analysis with direct links throughout.

Key Requirements

1. Age Verification by App Store Providers

  • App stores must request age information and verify a user’s age category when an individual located in Utah creates an app store account.
  • Utah Code Chapter 76 provides that an “app store provider shall… request age information… and verify the individual’s age category using commercially available methods reasonably designed to ensure accuracy” at account creation.Utah Code Title 13, Chapter 76
  • The enrolled bill SB 142 describes these age verification obligations as part of provisions “governing app store operations” and requiring age verification and parental consent.Enrolled SB 142 PDF
  • Legislative summaries confirm that SB 142 “requires app store providers to verify user age categories” at the point of download and account creation.Utah House overview Loeb & Loeb update
  • Age verification methods must be “commercially available” and reasonably designed to ensure accuracy.
  • Utah Code specifies that age verification must use “commercially available methods that are reasonably designed to ensure accuracy” or a method allowed by rule.Utah Code Title 13, Chapter 76
  • Commentary from law firms highlights this “commercially available” standard and the requirement that methods be reasonably accurate.Morrison Foerster analysis Inside Privacy analysis

2. Parental Consent and Parent Account Affiliation for Minors

  • If age verification indicates the user is a minor (under 18), the account must be affiliated with a parent account and verifiable parental consent must be obtained before app downloads or purchases.
  • Utah Code requires that, when the process determines an individual is a minor, the app store must “require the account to be affiliated with a parent account” and “obtain verifiable parental consent” before allowing app downloads, purchases, or in‑app purchases.Utah Code Title 13, Chapter 76
  • SB 142’s text similarly states that the act “creates requirements for age verification and parental consent.”Enrolled SB 142 PDF
  • Utah House commentary notes that parents must approve app downloads and purchases by minors and that minor accounts must be linked to a parent account.Utah House overview
  • App stores must maintain data on whether parental consent has been obtained for accounts associated with minors.
  • Utah Code provides that app store providers maintain “age category data… and, for a minor account, whether verifiable parental consent has been obtained”.Utah Code Title 13, Chapter 76, Section 202 PDF
  • Legal analyses emphasize that app stores need to track consent status per minor account to comply with download and purchase restrictions.Inside Privacy analysis Loeb & Loeb update

3. Age Rating and Obligations for App Developers

  • App developers must provide age ratings and comply with app store age‑related controls.
  • Legislative summaries explain that app developers must age‑rate their products and that parents must be notified when significant changes alter an app’s content.Utah House overview
  • Substituted versions of SB 142 detail that developers must verify age category and consent status through the app store and notify app stores of “significant changes” to their applications.6th Sub. SB 142 PDF 5th Sub. SB 142 PDF
  • Legal commentary notes that developers inherit obligations tied to app store age signals and must rely on those signals when restricting features or content for minors.Inside Privacy analysis Morrison Foerster analysis
  • Developers must notify app stores of “significant changes” and ensure parental disclosure updates when content or monetization changes.
  • Substitute bill language defines “significant change” and requires developers to notify app stores, triggering updated parental disclosures.6th Sub. SB 142 PDF
  • A 2026 amendment narrows this definition to changes in data collection, age rating, or monetization (as described in industry analysis of the amendment).Frankfurt Kurnit Technology Law update

4. Safe Harbour for Developers Relying on App Store Age Signals

  • Developers receive a “safe harbour” when they reasonably rely on age category and consent data provided by app stores.
  • Utah Code provisions describe age category data and allow developers, beginning May 6, 2027, to request age category data from app stores, with obligations linked to accuracy and continued account use within the verified age category.Utah Code Title 13, Chapter 76, Section 202 PDF
  • Legal commentary interprets this structure as effectively creating a safe harbour for developers who reasonably rely on app store‑provided age signals rather than independently verifying all users.Morrison Foerster analysis Inside Privacy analysis

5. Prohibitions and Contract‑Related Requirements

  • App stores are prohibited from enforcing certain contracts against minors without parental consent and from misrepresenting parental content disclosures.
  • Substituted bill text indicates SB 142 prohibits app store providers from enforcing contracts against minors without parental consent and from misrepresenting parental content disclosures.6th Sub. SB 142 PDF
  • Industry commentary notes that this restricts unilateral enforcement of app store terms against minors absent verifiable parental involvement.Inside Privacy analysis

6. Effective Dates and Enforcement Structure

  • Operational obligations effective May 6, 2026 (core age verification/parental consent obligations).
  • Utah Code Chapter 76 notes that provisions governing app store operations are effective 5/6/2026, establishing the main operational compliance date.Utah Code Title 13, Chapter 76
  • Legal analysis states that the law “goes into effect on May 7, 2025, and the obligations on app store providers and developers are not effective until May 6, 2026.”Inside Privacy analysis
  • Later date for developer access to age category data (May 6, 2027).
  • Utah Code Section 202 provides that beginning May 6, 2027, a developer may request age category data from app stores under specified conditions.Utah Code Title 13, Chapter 76, Section 202 PDF
  • Enforcement via Utah consumer protection / deceptive trade practices authorities.
  • The Loeb & Loeb update notes that the Utah Attorney General is authorized to enforce the law under Utah’s deceptive trade practice laws.Loeb & Loeb update
  • Reporting on litigation describes enforcement authority being challenged in federal court by industry groups.Utah News Dispatch article

Compliance Challenges

1. Implementing Robust Age Verification at Scale

  • Accuracy vs. usability:
  • Utah’s requirement for “commercially available methods… reasonably designed to ensure accuracy” creates tension between frictionless sign‑up and robust identity checks, especially for global platforms.Utah Code Title 13, Chapter 76
  • Legal analysis highlights concerns about operationalizing age verification across large user bases while maintaining privacy and minimizing false positives/negatives.Morrison Foerster analysis Inside Privacy analysis
  • Existing accounts migration:
  • Commentary notes that app stores must not only verify new accounts but also eventually request age category information for existing accounts, creating a significant remediation and communication challenge.Loeb & Loeb update

2. Verifiable Parental Consent and Parent Account Linkage

  • Verifiable consent mechanisms:
  • Utah requires verifiable parental consent for minors’ downloads and purchases, which typically necessitates mechanisms similar to COPPA‑style consent (e.g., payment card, government ID, or other verification).Utah Code Title 13, Chapter 76
  • Industry commentary compares Utah’s consent requirements to Federal Trade Commission expectations under COPPA for “verifiable parental consent,” raising implementation complexity.Morrison Foerster analysis Inside Privacy analysis
  • Managing parent–child linked accounts globally:
  • App stores with global operations must adapt account structures (parent/child linkages) specifically for Utah residents, raising challenges in geolocation, residency detection, and cross‑border account handling.Inside Privacy analysis Loeb & Loeb update

3. Coordination Between App Stores and Developers

  • Data sharing and reliance on age signals:
  • Utah Code Section 202 establishes mechanisms for developers to request age category data and sets conditions on accuracy and continued account use.Utah Code Title 13, Chapter 76, Section 202 PDF
  • Legal analysis notes that developers must design their apps’ behavior based on these age signals, yet have limited ability to independently validate them—creating a dependency on app store implementation quality.Morrison Foerster analysis Inside Privacy analysis
  • Pre‑installed applications and bundled software:
  • A 2026 amendment expands obligations to pre‑installed applications like browsers and messaging apps bundled on devices, creating complexities for OEMs and OS vendors.Frankfurt Kurnit Technology Law update

4. Litigation and Regulatory Uncertainty

  • Industry lawsuits challenging constitutionality and enforcement.
  • Tech companies, through groups like the Computer & Communications Industry Association (CCIA), filed lawsuits against Utah’s age verification law, arguing constitutional and practical concerns.Utah News Dispatch article
  • Legal commentary notes that enforcement timelines may be affected by ongoing litigation, creating uncertainty for compliance planning.Loeb & Loeb update

5. Maintaining Up‑to‑Date Parental Disclosures and “Significant Changes”

  • Monitoring content, monetization, and data collection changes.
  • SB 142 and its amendment require developers to notify app stores of “significant changes,” such as changes in data collection, age rating, or monetization, so parental disclosures can be updated.6th Sub. SB 142 PDF Frankfurt Kurnit Technology Law update
  • Utah House commentary stresses that parental consent should not be a one‑time checkbox, increasing the requirement for continuous monitoring and re‑notification.Utah House overview

Implementation Best Practices

1. Establish a Utah‑Specific Age Verification and Parental Consent Flow

  • Design a configurable age verification stack aligned with Utah’s “commercially available” standard.
  • Use age‑assurance tools (e.g., document verification, credit‑card checks, authoritative databases) that meet the Utah standard of “commercially available methods… reasonably designed to ensure accuracy.”Utah Code Title 13, Chapter 76
  • Align with broader age‑verification guidance from bodies like the UK Information Commissioner’s

Recent developments

  • — This item reflects continued industry and political attention to Utah’s app-store age-verification model, with supporters praising the law as a child-safety measure. It is less directly about a new policy change than about ongoing public reaction to SB 142. (source)
  • — CCIA’s Utah challenge remains a key industry-reaction source, describing SB 142 as unconstitutional and arguing it imposes a sweeping age-verification and parental-consent regime. The association said the law would burden lawful speech and intrude on privacy. (source)
  • — A regulatory tracker says Utah’s March 2026 amendment pushed the compliance deadline to May 6, 2027, expanded the law to pre-installed applications, removed the Attorney General from enforcement, and banned sharing age data with third parties. It also says the law is now in effect and private enforcement continues to phase in. (source)
  • — This update says the App Store Accountability Act’s operative compliance date remained tied to the May 2026 deadline, while the private right of action was scheduled to take effect on December 31, 2026. It also notes the earlier compliance structure and the law’s age-verification and parental-consent requirements. (source)
  • — A legal update reports that CCIA agreed to a stipulated dismissal of its constitutional challenge to Utah’s App Store Accountability Act after Utah amended the statute. The dismissal followed changes that altered the law’s enforcement framework. (source)
  • — Utah’s amended App Store Accountability Act was updated to expand coverage to pre-installed apps, narrow what counts as a “significant change,” and add new data-use restrictions for age-category information. The post says the amendments also removed a prior rulemaking path for alternative age-verification methods. (source)
  • — An industry group representing Apple, Google, Meta, and Amazon withdrew its complaint against Utah’s App Store Accountability Act after lawmakers changed the law so it is enforced only through private lawsuits. The article frames the move as a major industry response to Utah’s revised enforcement structure. (source)

Related regulations

Put it into practice

Browse all regulations · Compliance deadlines · Latest updates