1. (a) A developer shall do all of the following:

   1. (1) Verify through the app store’s data sharing methods: (i) the age category of users located in this state; and (ii) for a minor account, whether verifiable parental consent has been obtained.
   2. (2) Notify app store providers of any significant change to an app.
   3. (3) Limit use of age category data received from an app store provider to: (i) enforce developer-created age-related restrictions, protections, or defaults; (ii) ensure compliance with applicable laws or regulations; or (iii) implement safety-related features or defaults.

   4. (4) Request age category data or verifiable parental consent in all of the following scenarios:

      1. a. Whenever an account holder does any of the following:

         1. 1. Downloads an app.
         2. 2. Purchases an app.
         3. 3. Launches a pre-installed app for the first time.
      2. b. When implementing a significant change to an app.
      3. c. To comply with applicable law.
   5. (5) When implementing any developer-created age-related restrictions, safety-related features, or defaults, use the lowest age category indicated by either: (i) age category data received through the app store’s data sharing methods; or (ii) age data independently collected by the developer.

2. (b) A developer may request age category data in any of the following scenarios:

   1. (1) No more than once during each 12-month period to verify either of the following:

      1. a. The accuracy of age category data associated with an account holder.
      2. b. Continued account use within the age category.

   2. (2) When there is reasonable suspicion of either of the following:

      1. a. Account transfer.
      2. b. Misuse outside of the age category.
   3. (3) At the time an account holder creates a new account with the developer.

3. (c) A developer may not do any of the following:

   1. (1) Enforce a contract or terms of service against a minor unless the developer has verified through the app store provider that verifiable parental consent has been obtained.
   2. (2) Knowingly misrepresent any information in the parental consent disclosure.
   3. (3) Share age category data with any person.

(Act 2026-59, §9.)