Four American states have enacted App Store Accountability Acts. Texas, Utah, Louisiana and now Alabama have all passed laws requiring app stores to verify a user's age at account creation, obtain parental consent for minors, and pass both signals down to the developer of every app that user downloads.1
Most of the industry guidance written about these laws describes a compliance cliff arriving through 2026 - Texas on 1 January, Utah on 6 May, Louisiana on 1 July. That guidance is now wrong.
As of June 2026, exactly one of the four laws is operative. Two were pushed into 2027 by legislative amendment. The fourth does not begin until January 2027.1
Three of the four deadlines the industry has been planning around moved. The one that did not move is the one nobody expected to survive.
How Texas ended up first
Texas Senate Bill 2420 was signed on 27 May 2025 with an effective date of 1 January 2026. Days before it was to take effect, a federal district court entered an injunction blocking it.1,2
On 28 May 2026 the Fifth Circuit administratively stayed that injunction, and the law took immediate effect. On 5 June 2026 the same court ruled it may remain in force for the duration of the appeal.1
So the statute is operative and enforceable by the Texas Attorney General, while the First Amendment challenge to it is still being litigated. A developer serving Texas users has live obligations under a law whose constitutionality is unresolved.
The Utah paradox
Utah amended its Act through H.B. 498. The amendment did two things. It extended the operational compliance deadline to 6 May 2027, and it removed the Attorney General's enforcement authority, leaving a private right of action as the exclusive enforcement mechanism.1
Then something structurally odd happened. The constitutional challenge to the Utah law was voluntarily dismissed - because with the Attorney General removed, there was no state enforcer left to sue.1
Worth sitting with
Utah's law became harder to strike down by becoming less enforceable by the state. The challenge did not fail on the merits. It was withdrawn for want of a defendant. The statute now stands unreviewed, and the parties who can enforce it are private plaintiffs rather than a state agency with prosecutorial discretion and a public enforcement policy.
Whether that is better or worse for a developer depends entirely on your view of private litigation. An Attorney General publishes guidance, sets priorities and can be negotiated with. A plaintiffs' bar does none of those things.
Louisiana reversed itself on the point that mattered most
In its original form, Louisiana's Act was the harshest of the three for developers: it explicitly rejected the safe harbour that Texas and Utah granted for reasonable reliance on information supplied by an app store.2 A developer acting correctly on a signal the store got wrong was exposed anyway.
H.B. 977 changed that. The amendment pushed the effective date to 1 July 2027 and added two provisions that run the other way: it limits a developer's obligation to verify age using other sources, generally allowing reliance on the app store's age signal, and it permits reliance on the store's parental consent signal without independent verification.1
| State | Operative | Enforced by | Developer safe harbour |
|---|---|---|---|
| Texas (SB 2420) | In force since 5 June 2026, during appeal | Attorney General; violation framed as a deceptive trade practice | Yes - reasonable reliance on app store information |
| Alabama | 1 January 2027 | Attorney General, with a rulemaking process for age verification methods | Largely tracks Louisiana |
| Utah (as amended, H.B. 498) | 6 May 2027 | Private right of action only - Attorney General authority removed | Yes - reasonable reliance |
| Louisiana (as amended, H.B. 977) | 1 July 2027 | Attorney General | Reversed by amendment - reliance on store signals now permitted |
What the laws actually ask a developer to build
The obligations are not primarily about age gates in the user interface. They are about ingesting, acting on and then destroying a data signal that originates outside your product.
Read obligation 03 next to obligation 04 and the structural problem appears. The developer must rate their own app for suitability and carries liability for getting it wrong. The developer must act on an age determination they did not make and cannot audit. And the developer must delete the evidence.
The store makes the determination. The developer carries the liability. And the record that would prove the developer acted correctly is the record the statute requires them to destroy.
Wiley's guidance addresses this directly, advising developers to build compliance logging that demonstrates age gates and consent checks executed successfully while not retaining the underlying personal data.1 That is a solvable engineering problem. It is not a problem most app teams currently have anyone assigned to.
The second-order effect
Apple has shipped a Declared Age Range API so developers can request age signals and parental consent status.3 Google has equivalent tooling. Both are the mechanism by which the statutory duty is discharged.
They are also, incidentally, a new age-declaration channel on the platform - one that exists because four state legislatures required it, and that returns a bracket the platform has now verified rather than a value the user typed.
This is an inference and we mark it as one. A verified age bracket is a better signal than a self-declared one. Where a regime obliges the store to establish it and the developer to act on it, the accuracy of age data in that market goes up. What happens to that accuracy commercially is constrained by the same statutes - Texas requires deletion after use, Utah prohibits commercial use - but the signal now exists, verified, at the platform layer, and it did not before.
Feature 39 of this edition describes the opposite outcome in Australia, where a removal duty produced 4.7 million closed accounts and roughly 70% of under-16s still reaching the platforms. The American statutes are not removal laws. They are identity laws, and they are addressed to a different party.
What to do about it
Re-read your compliance calendar. If it says Louisiana 1 July 2026 or Utah 6 May 2026, it predates the amendments and is describing a landscape that no longer exists. Only Texas is live.
Build for the signal, not the state. Four laws, four dates, four enforcement theories, and one binary shipping to all of them. The stable requirement across every version is the same: ingest an age bracket and a consent status from the store, act on it, log that you acted, retain nothing. Build that once.
Treat the age rating as a legal artefact. In Utah and Louisiana the rating is an assessment of suitability, and an inaccurate one creates exposure. That moves rating decisions out of the marketing function and into a review that someone signs.
Instrument "significant change" in your release process. Introducing new in-app purchases or advertising triggers a consent refresh. That is a release-checklist item, not a quarterly review, and the trigger lives in the same place your feature flags do.
Watch Texas, not the calendar. The Fifth Circuit allowed the law to operate during the appeal. If the First Amendment challenge succeeds, the compliance architecture stays useful - three more states are behind it. If it fails, Texas becomes the template. Neither outcome argues for waiting.
How we did this
What this doesn't prove
- That the current dates will hold. Three of four moved by amendment within a year. There is no reason to treat the 2027 dates as more durable than the 2026 ones were.
- The outcome of the Texas appeal. The Fifth Circuit permitted the law to operate during the appeal. That is a procedural posture, not a ruling on the merits, and the First Amendment question is open.
- Anything about compliance rates. We have no data on how many developers have implemented the age APIs, in Texas or anywhere. The obligations are documented; the response to them is not.
- That the Alabama law matches Louisiana's. Our source describes it as largely tracking Louisiana and notes one clear divergence, the Attorney General rulemaking process. We have not compared the texts.
- Any effect on minors. These are process statutes. Whether they change what children can reach is an empirical question none of this material addresses, and Feature 39 suggests the answer is not obvious.
- Anything outside these four states. California enacted a law that functions differently, and other legislatures are considering their own. This is a snapshot of four statutes, not of American law.
Sources for this feature
- Key Developments With State App Store Accountability Acts, as Texas Act Takes Effect, Wiley Rein LLP, 8 June 2026. wiley.law A named study, reported by someone else - named law firm, primary-adjacent
- State App Store Accountability Acts Introduce New Obligations for App Developers, Wiley Rein LLP, 16 October 2025. wiley.law A named study, reported by someone else - superseded by the above, retained to date the change
- Apple developer guidance on age assurance and the Declared Age Range API, reported via AppleInsider and Engadget. developer.apple.com A named study, reported by someone else - platform documentation via trade press
- Features 14 and 39 of this edition. Another feature in this edition