Age verification signals: software applications and online services.

Assembly Member Wicks, along with principal coauthor Senator Umberg and several colleagues, advances a Digital Age Assurance Act that would require operating system providers and covered application stores to furnish real-time age-bracket signals to developers at the moment an application is downloaded and launched, with a rollout targeted for January 1, 2027. The core objective is to convey, in a standardized form, whether a user falls into one of four age brackets, enabling apps to tailor their behavior in alignment with age-related protections and settings.

The act creates a new Civil Code title and defines key terms to govern the signaling framework. An “account holder” is an adult or a parent/guardian of a user under 18 in California. “Age bracket data” comprises nonpersonal data indicating whether the user is under 13, at least 13 but under 16, at least 16 but under 18, or at least 18. A “covered application store” distributes and facilitates downloads of third-party applications but excludes stores that distribute extensions or apps that run exclusively within a host application. A “signal” is the age-bracket data transmitted via a real-time API from the OS to an application, and a “developer” is the owner or controller of an application. The obligation framework centers on the OS providing an accessible account-setup interface to collect birth date or age and delivering a signal to requesting developers; developers must request signals at download and launch and shall treat the signal as the primary indicator of a user’s age unless internal information indicates a different age.

Transitional provisions and enforcement details define how the regime takes effect. For devices with account setup completed before the operative date, the OS must provide the age-indication interface by mid-2027. If an app updated after 2026 was downloaded before 2027 and the developer has not yet requested a signal, the developer must request one from a covered store by mid-2027. Violations may lead to injunctive relief and civil penalties up to $2,500 per affected child for negligent violations or up to $7,500 per affected child for intentional violations, with the Attorney General enforcing remedies. The act includes a good-faith defense for OS providers or stores that make a reasonable compliance effort, and it imposes nondiscrimination and anti-competitive safeguards, prohibiting use of signals to undermine third parties or to privilege the provider’s own services. It explicitly operates in addition to, and does not modify, the California Age-Appropriate Design Code Act, while offering severability, and it preserves exemptions for broadband internet access, certain telecommunications services, and the delivery or use of a physical product.

Framing the broader context, the proposal positions age signaling as a privacy- and design-focused tool within California’s consumer-protection regime. The framework aims to minimize data collection to what is necessary, restrict cross-party sharing of signals, and ensure that changes in age information are respected across platforms. By requiring parity in restrictions and prohibiting anticompetitive uses of signaling data, the measure engages with ongoing debates about platform power, data portability, and minors’ protections, while clearly noting its additive relationship to existing laws. Stakeholders—including OS providers, covered stores, developers, and guardians of minors—face implementation timelines, potential compliance costs, and a new enforcement dynamic centered on the Attorney General’s office, with the intent of aligning age-verification practices with specified design and data-use constraints.