13-76-201. App store provider requirements.

470 words·~2 min read·/ut/title-13/chapter-76/13-76-201

A research copy — for the controlling text, always check the official state or federal source. Not legal advice.

Effective 3/18/2026

(1)Beginning May 6, 2027, an app store provider shall:

(a)at the time an individual who is located in the state creates an account with the app store provider, or for an existing account, within 12 months after the day on which the obligations described in this section take effect:

(i)request age category information from the individual; and

(ii)verify the individual's age category using commercially available methods that are reasonably designed to ensure accuracy, which for a minor shall include affirmative age attestation by a parent together with other age information collected as part of the creation or use of an account;

(b)if the age verification method or process described in Subsection (1)(a) determines the individual is a minor:

(i)require the account to be affiliated with a parent account; and

(ii)obtain verifiable parental consent from the holder of the affiliated parent account before allowing the minor to:

(A)download an app;

(B)purchase an app; or

(C)make an in-app purchase;

(c)after receiving notice of a significant change from a developer:

(i)notify the account holder of the significant change; and

(ii)for a minor account:

(A)notify the holder of the affiliated parent account; and

(B)obtain renewed verifiable parental consent;

(d)provide to a developer, in response to a request authorized under Section 13-76-202 :

(i)age category data for a user located in the state; and

(ii)the status of verified parental consent for a minor located in the state;

(e)notify a developer when a parent revokes parental consent;

(f)protect age category data and any associated verification data by:

(i)limiting collection and processing to data necessary for:

(A)verifying an account holder's age;

(B)obtaining verifiable parental consent; or

(C)maintaining compliance records; and

(ii)transmitting age category data using industry-standard encryption protocols that ensure:

(A)data integrity; and

(B)data confidentiality;

(g)for a pre-installed application:

(i)provide available age category information in response to a request from a developer; and

(ii)take reasonable measures to facilitate verifiable parental consent for use of the app in response to a request from a developer; and

(h)comply with a developer's request made in accordance with Subsection 13-76-202(6) to prevent minor accounts from downloading or purchasing the developer's app.

(2)Beginning May 6, 2027, an app store provider may not:

(a)enforce a contract or terms of service against a minor unless the app store provider has obtained verifiable parental consent;

(b)knowingly misrepresent the information in the parental consent disclosure; or

(c)share age category data or any associated verification data except:

(i)between an app store provider and a developer as required by this chapter; or

(ii)as required by law.

Amended by Chapter 157 , 2026 General Session