App Store Accountability Act
Utah ASAA
Children
Enacted by 2025 S.B. 142 and amended by 2026 H.B. 498, it requires app stores to verify age category, affiliate minor accounts with a parent, and obtain parental consent for downloads and purchases, with a parental consent disclosure about the app's data practices. The chapter is enacted but its duties begin May 6, 2027. Industry challenges (CCIA v. Brown, M.M. v. Brown, D. Utah) were terminated on April 21, 2026.
- Where
- Utah
- Citation
- Utah Code Title 13, Chapter 76 (13-76-101 to 13-76-404)
- Status
- Enacted, not yet in force
- In force since
- 2027-05-06
- Last amended
- 2026-05-06
- Enforced by
- None; private action by a harmed minor or parent only (public enforcement removed by 2026 H.B. 498)
- People can sue
- Yes
- Penalties
- From May 6, 2027, a harmed minor or parent may recover the greater of actual damages or $1,000 per violation of 13-76-201(2) or 13-76-202(4), plus fees and costs (13-76-401); developer good-faith safe harbor (13-76-402).
- Applies to
- App store providers whose store lets users in Utah download apps to mobile devices (13-76-101(7))
- Developers of apps available through an app store in Utah (13-76-101(9))
What a privacy notice must say
- Before verifiable parental consent, clearly and conspicuously provide a parental consent disclosure: the app's age rating and content description if available, personal data the app collects and shares with third parties, and the developer's data protection methods.Utah Code 13-76-101(18), (21)(b) · Only if: App store provider · From 2027-05-06
Practices it requires
- Do not knowingly misrepresent the parental consent disclosure (providers and developers).Utah Code 13-76-201(2)(b), 13-76-202(4)(b) · From 2027-05-06
- App store providers must verify age category, affiliate minor accounts with a parent account, obtain parental consent for downloads and purchases, and notify of significant changes, including material privacy-policy changes.Utah Code 13-76-101(20), 13-76-201 · Only if: App store provider · From 2027-05-06
- Developers must verify age and consent through the store, notify stores of significant changes, apply the lowest age category for safety defaults, and never share age-category data.Utah Code 13-76-202 · Only if: Developer · From 2027-05-06
Security duties
- Minimize and encrypt age-verification data and do not share it except as the chapter requires.Utah Code 13-76-201 · Only if: App store provider · From 2027-05-06
Sources
- Official text
- Utah Code 13-76-101 (Utah Legislature, version C13-76-S101_2026050620260506)
- Utah Code 13-76-201 (Utah Legislature, version C13-76-S201_2026031820260318)
- Utah Code 13-76-202 (Utah Legislature, version C13-76-S202_2026031820260318)
- Utah Code 13-76-401 (Utah Legislature, version C13-76-S401_2026031820260318)
- 2025 S.B. 142 enrolled bill (Utah Legislature)
- 2026 H.B. 498 enrolled bill (Utah Legislature)
Checked against these sources on 2026-09-23 by research agent (Claude), primary sources.
Unverified: The CCIA v. Brown (2:26-cv-00094) and M.M. v. Brown (2:26-cv-00125) dismissal orders were not read; termination on 2026-04-21 is from docket metadata and the reason (voluntary dismissal after H.B. 498) is from secondary sources. | effective_date is the date duties begin (2027-05-06); the chapter itself was enacted effective 2025-05-07.
Research reference, not legal advice.