During the 2025 legislative session, Louisiana, Utah, and Texas all enacted statutes imposing new regulatory obligations on app store providers and software developers with respect to minors and, in the case of Utah, include a private right of action. These laws—Louisiana House Bill 570 (effective July 1, 2026, if signed by the governor), Utah's App Store Accountability Act (effective May 7, 2025), and Texas' App Store Accountability Act (effective January 1, 2026)—establish requirements for age verification, parental consent, data minimization, and enhanced transparency. While the statutes share a common structure, each introduces state-specific nuances.
Applicability and Covered Entities
All three statutes apply to both app store providers (entities operating digital distribution platforms like the Apple App Store and Google Play Store) and developers (entities controlling applications available through such platforms) offering services to residents of the enacting state. The laws uniformly define "minors" as individuals under 18, segmenting consumers into four age cohorts: children (under age 13), younger teenagers (aged 13–15), older teenagers (aged 16–17), and adults (aged 18+).
Core Requirements
Age Verification and Parental Consent
Under all three statutes, app store providers are now required to verify the age of users at account creation using commercially reasonable or approved methods. For minors, accounts must be linked to a verified parent account, and verifiable parental consent is necessary before allowing downloads, purchases, or in-app transactions. This parental consent must be renewed whenever there are significant changes to app terms, privacy policies, or monetization features. Additionally, app stores are obligated to share a user's age category and parental consent status with developers upon request and must notify developers if parental consent is revoked.
Data Protection and Minimization
The collection and processing of personal data by app store providers is limited strictly to what is necessary for age verification, obtaining parental consent, and maintaining compliance records. Even this use is limited, as Louisiana allows requests for age verification or parental consent only once every 12 months unless there is reasonable suspicion of misuse; Utah and Texas permit more frequent requests if commercially reasonable or necessary. All three statutes mandate the use of industry-standard encryption for the transmission of such data.
Developer Obligations
Developers are required to verify the age of users and the status of parental consent using data provided by the app store. They also must assign appropriate age ratings to their applications and promptly notify app stores of any significant changes to their apps. Significant changes include modifying the type or category of personal data collected, stored, or shared; affecting or changing the app's rating or the content that led to that rating; adding new monetization features; or making material changes to the app's functionality or user experience. The use of age category data by developers is strictly limited to purposes such as enforcing age-related restrictions, ensuring legal compliance, or implementing safety features.
Additionally, developers are prohibited from enforcing contractual agreements against minors unless verified parental consent has been obtained. They are also barred from making false or misleading disclosures.
Transparency
Texas requires conspicuous display of age ratings and the rationale for those ratings, while Louisiana and Utah require adherence to widely adopted or reasonable rating systems without mandating public disclosure of rating rationales.
Enforcement and Remedies
Enforcement and remedies under these statutes vary by state. Of particular note is Utah, where violations are considered a deceptive trade practice, and parents are given a private right of action, allowing them to recover either actual damages or $1,000 per violation, along with attorney fees and costs. This could create significant liability, as the floor for a violation is likely to be $1,000 per child utilizing an app (and may be considered to be $1,000 per use by a minor), and we anticipate a number of plaintiffs' counsel bringing suits against a variety of app stores and app providers under the statute.
In Louisiana, enforcement authority is granted to the Attorney General, who must provide a mandatory 45-day period for the alleged violator to cure any issues before initiating civil action. Penalties can reach up to $10,000 per violation, with an additional $5,000 imposed for failure to comply with enforcement orders.
Texas incorporates enforcement into its existing deceptive trade practices framework, offering a broad range of remedies such as injunctive relief, civil penalties, and restitution, and does not require a statutory cure period. All three statutes, however, include liability protections for entities that act in good faith to comply with the law.
Conclusion
The Louisiana, Utah, and Texas statutes collectively establish a new baseline for app makers and app store accountability and minor protection. App store providers and developers, most of whom will have users in these states, should promptly assess their compliance programs and update contractual arrangements to avoid potential enforcement actions and suits.
Our team will continue to monitor the implementation and enforcement of these acts and any future specific state laws. If you have any questions about these statutes and how they could affect your business, please contact the authors.
The authors wish to thank summer associate Nicholas Bovenzi for his contributions to this content.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
