Utah Becomes First State to Enact App Store Accountability Act

Elena Miller and John Pavolotsky of Stoel Rives report that Utah has become the first state to enact legislation regulating access to app stores for minors: Senate Bill 142, the App Store Accountability Act.

The law mandates age verification and parental consent for minors to download apps or make in-app purchases. The law places obligations on both app developers and app store providers. Phased enforcement culminates in a private right of action, effective December 31, 2026.

This legislation represents a significant expansion of digital child protection measures, potentially setting a precedent for similar laws nationwide. Bills have been introduced in several states.

The Act defines key roles: a “developer” is anyone who owns or controls an app available in Utah, while an “app store provider” operates the platform that distributes apps.

Both must implement robust age verification mechanisms and obtain parental consent before granting access to minors. Developers are also responsible for updating age ratings and notifying app store providers of any significant changes to their content.

App store providers must establish parental account affiliations for minors and present clear disclosures to parents before consent. The App Store Accountability Act enforces strict data protection rules, limiting how age verification data is handled and shared.

Developers must trigger age checks during key user interactions, and app stores must handle parental disclosures and consent renewals. Enforcement includes penalties for misrepresentation and the misuse of data.

Parents can sue for violations, with damages starting at $1,000 per incident. However, compliance remains complex due to undefined state guidance and the risk of mishandling sensitive data.

Attorneys advising on data privacy should prepare for multi-state compliance challenges and a likely trend toward nationwide age verification standards. Legal counsel will be critical in navigating implementation risks, interpreting vague regulatory requirements, and mitigating potential liability under Utah’s private right of action framework.