S. 1586 — App Store Accountability Act

This section designates the Act as the “App Store Accountability Act” and sets forth the table of contents.

This section establishes definitions for 19 terms used in the Act, including four age categories—young child (under 13 years of age), child (13 through 15 years of age), teenager (16 through 17 years of age), and adult (18 years of age or older)—and "minor" (under 18 years of age). It further defines app-related terms such as "app," "app store," "app developer," and "covered app store provider" (i.e., an app store owner or controller available in the United States with more than 5 million U.S. users); parental consent mechanisms including "verifiable parental consent," "parental account," and "parental consent disclosure"; and other terms such as "age category data," "signal," "significant change," and "personal data" (same meaning as "personal information" under the Children's Online Privacy Protection Act of 1998, 15 U.S.C. 6501).

This section requires each covered app store provider to (1) request and verify a user's age category at account creation using a commercially available method; (2) for minors, affiliate the account with a parental account and obtain verifiable parental consent prior to app downloads, purchases, or in-app purchases; (3) upon notice of a significant app change from a developer, notify the user and—for minor accounts—the affiliated parent and obtain new parental consent; (4) provide app developers with the user's age category and—for minors—parental consent status; (5) notify developers when a parent revokes consent; (6) limit collection, processing, and storage of age verification data to what is strictly necessary and protect it with reasonable safeguards including industry-standard encryption; (7) clearly and prominently display any app age ratings or content descriptions in plain, concise language; and (8) enable developers to access in real time a user's age category and—for minors—parental consent status. The section states that these requirements do not prevent providers from blocking unlawful or obscene material, spam, or threats to security; do not require disclosing additional user information to developers; do not authorize arbitrary, anti-competitive, or unlawful measures; and do not restrict political, religious, or other viewpoints.

This section establishes obligations for app developers on covered app stores, requiring them to (1) verify users' or potential users' age categories—and verifiable parental consent for minor accounts—through the app store's methods or processes; (2) notify covered app store providers of significant app changes; and (3) request age category data or parental consent upon app download or purchase, significant app changes, or to comply with applicable law. App developers may make such requests no more than once per 12-month period for verification, upon reasonable suspicion of account transfer or misuse outside the verified age category, or upon new account creation; they may use age category data only to enforce age-related restrictions, ensure legal compliance, or implement app features or defaults. The section further prohibits app developers from enforcing contracts or terms of service against minors without verified parental consent, knowingly misrepresenting information in parental consent disclosures, or sharing age category data with unaffiliated third parties other than service providers or processors; requires any provided app age ratings or content descriptions to use plain and concise language; and mandates use of covered app store provider signals to determine user age categories (with receipt serving as actual knowledge).

This section directs the Commission to issue non-binding guidance within one year of enactment to assist covered app store providers and app developers in complying with the Act, clarifying that enforcement actions must allege specific violations of sections 3 or 4 rather than inconsistencies with the guidance. The section further requires the Commission to (1) establish a mechanism for covered app store providers to request review of policies relevant to section 3 requirements, with compliance determinations and public certifications (valid for one year) issued within 30 days if no circumvention methods exist; (2) require notification of significant policy changes affecting certifications; and (3) establish a complaint mechanism regarding section 3 compliance, with regular reviews that may evaluate existing certifications.

This section establishes Federal Trade Commission (FTC) enforcement authority for violations of this Act. Specifically, it (1) treats such violations as unfair or deceptive acts or practices under FTC rulemaking authority (15 U.S.C. 57a(a)(1)(B)); and (2) directs the FTC to enforce the Act using all applicable terms, jurisdiction, powers, duties, penalties, privileges, and immunities of the Federal Trade Commission Act (15 U.S.C. 41 et seq.), without limiting any other FTC authorities.

This section authorizes a state attorney general to bring a civil action in federal district court, as parens patriae on behalf of the state's residents, against any person violating the Act to enjoin the practice, enforce compliance with the Act, obtain damages, restitution, or other compensation, or secure other appropriate relief. It requires the attorney general to provide prior written notice and a copy of the complaint to the Commission (or concurrently if prior notice is not feasible); permits the Commission to intervene; preserves the attorney general's state-law powers to investigate, administer oaths, and compel evidence; prohibits a state action against any defendant named in a pending Commission action for the same violation; and specifies venue under general federal civil venue rules (28 U.S.C. § 1391) with service of process permitted in any judicial district where a defendant resides or may be found.

This section establishes a safe harbor from liability under this Act for app developers who demonstrate that they (1) relied in good faith on age verification data or a minor signal from a covered app store provider, (2) complied with section 4 requirements, and (3) reasonably conformed to and consistently applied widely accepted industry standards or best practices—or those identified by the Commission—for age ratings and app content descriptions. The safe harbor applies only to actions under this Act and does not limit liability under other laws.

This section preempts any state or political subdivision law, rule, regulation, requirement, standard, or other provision related to this Act. It specifies that this preemption does not displace or supplant contract or tort law.

This section establishes a severability clause, providing that the invalidation of any provision of the Act, or its application to any person or circumstance, does not affect the remainder of the Act or the application of that provision to other persons or circumstances.