Bill Text - AB-1856 Age verification signals: software applications and online services.

>>

>>

Bill Text

AB-1856 Age verification signals: software applications and online services. (2025-2026)

Bill Start

LEGISLATIVE COUNSEL'S DIGEST

Digest Key

Bill Text

The people of the State of California do enact as follows

SECTION 1.

1798.500.  For the purposes of this title: (a) (1) “Account holder” means an individual who is at least 18 years of age or a parent or legal guardian of a user who is under 18 years of age in the state. (2) “Account holder” does not include a parent of an emancipated minor or a parent or legal guardian who is not associated with a user’s device. (b) “Age bracket data” means nonpersonally identifiable data derived from a user’s birth date or age for the purpose of sharing with developers of applications that indicates the user’s age range, including, at a minimum, the

following: (1) Whether a user is under 13 years of age. (2) Whether the user is at least 13 years of age and under 16 years of age. (3) Whether the user is at least 16 years of age and under 18 years of age. (4) Whether the user is at least 18 years of age. (c)  (1) “Application” means a software application that may be run or directed by a user on a computer, a mobile device, or any other general purpose computing device that can access a covered application store or download an application. (2) “Application” does not include software components that are not themselves offered to consumers as a stand-alone executable application through a covered application store. (d) “Browser” means an application that enables a user to visit an internet website. (e) “Browser provider” means a person or entity that controls or operates a browser for use on a computer, mobile device, or any other general purpose computing device. (f) “Child” means a natural person who is under 18 years of age. (g) (1) “Covered application...

SEC. 2.

1798.501.  (a) If an operating system provider’s operating system has an account setup feature with respect to the use of the operating system on a particular device, an operating system provider shall do all of the following: (1) Provide an accessible interface, at account setup, that requires an account holder to indicate the birth date, age, or both, of the primary user of that device for the purpose of providing a signal regarding the primary user’s age bracket to all of the following: (A) A covered application store. (B) A developer. (C) A browser provider. (D) An internet website operator. (2) Provide a developer, covered application store, or browser provider who has requested a signal with respect to a particular user with a digital signal via a reasonably consistent real-time application programming interface that identifies, at a minimum, which of the following categories pertains to the user: (A) Under 13 years of age. (B) At least 13 years of age and under 16 years of age. (C) At least 16 years of age and under 18 years of age. (D) At least 18 years of age. (3) Send only the minimum amount of information necessary to comply with this title. (b) An operating system provider shall not share the digital signal information with a third party for a purpose not required by this title. (c) (1) A covered application store shall do both of the following with respect to a user of the covered application store: (A) Request a signal from the user’s operating system provider. (B) Provide the signal received pursuant to subparagraph (A) to a developer upon request. (2) A brow...

SEC. 3.

1798.502.  (a) With respect to a device for which account setup was completed before January 1, 2027, an operating system provider shall, before July 1, 2027, provide an accessible interface that allows an account holder to indicate the birth date, age, or both, of the primary user of that device for the purpose of providing a signal regarding the primary user’s age bracket to applications available in a covered application store. (b) If an application last updated with updates on or after January 1, 2026, was downloaded to a device before January 1, 2027, and a developer has not requested a signal with respect to the user of the device on which the application was downloaded, the developer

shall request a signal from a covered application store or an operating system provider with respect to that user before July 1, 2027.

SEC. 4.

1798.503.  (a) A person that violates this title shall be subject to an injunction and liable for a civil penalty of not more than two thousand five hundred dollars ($2,500) per affected child for each negligent violation or not more than seven thousand five hundred dollars ($7,500) per affected child for each intentional violation, which shall be assessed and recovered only in a civil action brought in the name of the people of the State of California by the Attorney General. (b) An operating system provider, browser provider, or covered application store that makes a good faith effort to comply with this title, taking into consideration available technology and any reasonable technical

limitations or outages, shall not be liable for an erroneous signal indicating a user’s age range or any conduct by a developer or internet website operator that receives a signal indicating a user’s age range.

SEC. 5.

1798.504.  (a) This title does not modify, impair, or supersede the operation of any antitrust law. (b) This title does not require the collection of additional personal information from device owners or device users other than that which is necessary to comply with Section 1798.501. (c) An operating system provider or a covered application store shall comply with this title in a nondiscriminatory manner, including, but not limited to, by complying with both of the following: (1) An operating system provider or a covered application store shall impose at least the same

restrictions and obligations on its own applications and application distribution as it does on those from third-party applications or application distributors. (2) An operating system provider or a covered application store shall not use data collected from a third party in the course of compliance with this title to compete against that third party, give the covered application store’s services preference relative to those of a third party, or to otherwise use this data or consent mechanism in an anticompetitive manner. (d) The protections provided by this title are in addition to those provided by any other applicable law, including, but not limited to, the California Age-Appropriate Design Code Act (Title 1.81.47 (commencing with Section 1798.99.28)). (e) If any provision of this title, or application thereof, to any person or circumstance is held invalid, that invalidity shall not affect other provisions or applications of this title that can be given effect without the invalid provision or application,...