California's Digital Age Assurance Act (the "DAAA") has been top of mind for me lately as its January 1, 2027 effective date approaches. Broadly, the law requires operating system providers to collect age information and provide developers with age-band signals. Plus, California recently amended the DAAA to clarify, among other things, the law's scope and signal requirements.
The DAAA is one of the most sweeping age-assurance laws enacted to date, with the potential to fundamentally reshape the tech world. While the law technically targets operating system providers and software application developers, its practical effects are likely to be felt across virtually all industries – basically any company with a mobile app and beyond.
Below is a quick breakdown of what to expect and some practical considerations for compliance.
The Countdown to January 1, 2027
Last year, we wrote about California's Digital Age Assurance Act ("DAAA"), enacted through AB 1043. Unlike other similar state laws (such as Texas' App Store Accountability Act), the DAAA creates a system in which operating system providers, rather than app stores alone, collect age information during account setup, place users into age bands, and make those age signals available to developers (of both software applications and mobile apps – the definition is pretty broad).
Historically, many apps have relied on self-reported birthdates, age gates, or the assumption that they operate as general-audience services. Under the DAAA, however, developers can expect to receive age signals from app stores and/or operating system providers. Perhaps most importantly, developers are deemed to have "actual knowledge" of a user's age range once they receive those signals.
As a practical matter, this makes it functionally impossible for companies to argue that they do not know whether their users are children, particularly in the context of COPPA, which applies not only to child-directed services but also to operators with actual knowledge that they are collecting personal information from children under the age of 13. Ignorance is no longer bliss, because under this new law, ignorance will be non-existent.
The Lookback Window
There's one additional date to pay attention to. While the DAAA takes effect on January 1, 2027 for new accounts, the law gives operating system providers until July 1, 2027 to implement a system for collecting age information from users with existing accounts. As a result, age signals will likely arrive in phases rather than all at once.
For at least part of 2027, companies will likely be operating in a mixed environment where some users are associated with age-band signals and others are not. Developers should start thinking now about how they will handle users who have not yet been age-banded and how newly received age signals will interact with age information already collected.
Covered App Stores
The DAAA applies to three categories of regulated entities: operating system providers, covered application stores, and application developers. Operating system providers may transmit age signals to covered application stores, which in turn may provide those signals to developers as permitted by the statute. Otherwise, where the operating system providers will send signals directly to developers where they have a direct relationship to the developers.
The law also includes restrictions on how age signals may be requested, used, disclosed, and retained. Subsequent amendments further clarified the interaction between operating system providers, covered application stores, and developers, including when parties may rely on age-related information obtained through the DAAA framework.
What Companies Should Be Doing Now
Companies should evaluate:
- Whether they qualify as an operating system provider, covered application store, developer, or some combination of the three;
- What obligations attach to each role under the DAAA;
- How they will send, receive, process, and use age signals, including implementing any platform-specific APIs, such as with Apple's and Google's recent rollout;
- How age signals will interact with existing account systems and age-gating measures already maintained by the company; and
- Whether app ratings, privacy disclosures, child-safety features, and COPPA compliance programs are still compliant.
With January 1, 2027 now in sight, companies should treat compliance planning as a current project rather than a future one. The first step is implementation, and it is a big step.
This alert provides general coverage of its subject area. We provide it with the understanding that Frankfurt Kurnit Klein & Selz is not engaged herein in rendering legal advice, and shall not be liable for any damages resulting from any error, inaccuracy, or omission. Our attorneys practice law only in jurisdictions in which they are properly authorized to do so. We do not seek to represent clients in other jurisdictions.
