H.R. 3149 — App Store Accountability Act

This section cites the Act as the “App Store Accountability Act” and sets forth its table of contents.

This section defines 19 terms for purposes of the Act, including four age categories—adult (18 years of age or older), teenager (16 through 17 years of age), child (13 through 15 years of age), and young child (under 13 years of age)—and minor (under 18 years of age). It further defines covered app store provider as a person controlling an app store available in the U.S. with more than 5 million U.S. users; personal data as having the same meaning as personal information under the Children's Online Privacy Protection Act of 1998 (15 U.S.C. 6501); and verifiable parental consent as authorization provided by a parental account in response to a clear and conspicuous parental consent disclosure signifying a parent's freely given, specific, informed, and unambiguous agreement.

This section requires each covered app store provider to (1) request and verify a user's age category at account creation using a commercially available method reasonably designed for accuracy; (2) for users determined to be minors, affiliate the account with a parental account and obtain verifiable parental consent prior to app downloads, purchases, or in-app purchases; (3) upon notice of a significant change from an app developer, notify the user (and the affiliated parent for minor accounts) and obtain new parental consent for minors; (4) provide app developers with the user's age category and, for minors, verified parental consent status; (5) notify app developers when a parent revokes consent; (6) limit collection, processing, and storage of age verification data to what is strictly necessary and protect it with reasonable safeguards including industry-standard encryption; (7) clearly and prominently display any age ratings or content descriptions in plain, concise language; and (8) enable app developers to access in real time a user's age category and, for minors, parental consent status. This section includes rules of construction clarifying that it does not prevent providers from blocking unlawful or obscene material, spam, or threats to security; limit disclosures to developers beyond age category and consent status; authorize arbitrary, capricious, anti-competitive, or unlawful measures; or restrict political, religious, or other viewpoints.

This section establishes obligations for app developers of apps distributed through covered app stores. Specifically, it requires app developers to (1) verify users' age categories and, for minors, verifiable parental consent using the app store's methods; (2) notify the app store provider of significant app changes; and (3) request age category data or parental consent upon app download or purchase, significant app changes, or to comply with law. It further permits such requests once every 12 months for verification, upon suspicion of misuse or account transfer, or for new accounts; limits permissible uses of age category data to enforcing age restrictions, legal compliance, and app features; and prohibits enforcing contracts or terms of service against minors without verified parental consent, misrepresenting information in parental consent disclosures, or sharing age data with unaffiliated third parties (except service providers or processors). Additionally, it requires app age ratings or content descriptions to use plain, concise language and mandates use of the app store provider's age signal, which constitutes actual knowledge of a user's age category.

This section directs the Commission to (1) issue non-binding guidance within one year of enactment to assist covered app store providers and app developers in complying with the Act, clarifying that enforcement actions must allege specific violations of sections 3 or 4 rather than inconsistencies with the guidance; (2) establish a mechanism for covered app store providers to request review of their section 3 compliance policies, issue public certifications of compliance valid for one year within 30 days if compliant (with no circumvention methods), and require notification of significant policy changes; and (3) establish a complaint mechanism regarding section 3 compliance and regularly review complaints to evaluate certifications as needed.

This section authorizes the Federal Trade Commission (FTC) to enforce this Act by treating violations of the Act or regulations promulgated thereunder as violations of a rule defining an unfair or deceptive act or practice under FTC's UDAP rulemaking authority (15 U.S.C. 57a(a)(1)(B)). It applies all applicable terms of the FTC Act (15 U.S.C. 41 et seq.) for enforcement—including jurisdiction, powers, duties, penalties, privileges, and immunities—and preserves the FTC's authority under other laws.

This section authorizes a state attorney general, as parens patriae on behalf of state residents, to bring a civil action in federal district court against any person violating this Act to enjoin the practice, enforce compliance, obtain damages or restitution, or seek other appropriate relief. It requires the attorney general to provide prior written notice and a copy of the complaint to the Commission (unless not feasible, in which case notice is provided concurrently with filing); grants the Commission intervention rights, including appeal; preserves state attorneys general's investigative powers under state law; and prohibits state actions under this section during any pending Commission enforcement against the same defendant for the same violation. It specifies venue in any U.S. district court meeting requirements under 28 U.S.C. §1391 and service of process in any district where a defendant resides or may be found.

This section establishes a safe harbor from liability under the Act for app developers who demonstrate that they (1) relied in good faith on age verification data or a minor signal from a covered app store provider, (2) complied with section 4 requirements, and (3) reasonably conformed to industry standards or best practices—or those identified by the Commission—for age ratings and app content descriptions, applied consistently and in good faith. The safe harbor applies only to actions under this Act and does not limit liability under other laws.

This section preempts any state or local law, rule, regulation, requirement, standard, or other provision related to this Act. It clarifies that this preemption does not affect contract or tort law.

This section provides a severability clause, stating that if any provision of the Act, or its application to any person or circumstance, is held invalid, the remainder of the Act and the application of that provision to other persons or circumstances remains unaffected.