New App Store Privacy Laws in 2026: What Developers Need to Know

A wave of new privacy laws specifically targeting app stores and digital platforms is reshaping the legal landscape for mobile app developers in 2026 and beyond. Unlike broad privacy regulations such as GDPR or CCPA, these laws focus on age verification, parental consent, and age-appropriate content—reflecting growing concern about children's safety online. Several US states have already passed laws, some are being enforced, others are enjoined by courts, and more are coming. This guide explains what these laws require, how they affect developers, and what you need to do to prepare your app.

Overview of the New Laws

Texas App Store Accountability Act (ASAA)

Texas passed the App Store Accountability Act in June 2023, making it law in September 2023. However, the federal courts have temporarily blocked (enjoined) enforcement while legal challenges proceed. The law requires app store operators (Apple, Google, etc.) to verify user age, obtain parental consent for minors, and categorize apps by age-appropriateness. Although enforcement is paused, understanding its requirements is essential because similar laws are passing in other states and courts may eventually allow enforcement.

What ASAA Requires (Even Though Paused):

App stores must verify the age of users before they download apps.
Apps must be categorized by age: unrestricted, for ages 6+, 12+, 17+, or 18+ only.
For minors (under 18), app stores must obtain parental consent before allowing download or use of age-restricted apps.
Minors cannot delete their parental controls.
Parents must have dashboards to see and control their child's app usage.

Utah Consumer Privacy Act for Minors

Utah passed the Online Privacy Protection Act and the Youth Online Privacy Protection Act, effective May 29, 2026. These laws specifically protect minors under 18 (with stricter rules for under-13) and are enforceable, unlike ASAA.

What Utah Requires (Effective May 2026):

Apps must verify user age at signup and obtain parental consent for children under 13.
Apps cannot use dark patterns (manipulative design) to trick minors into sharing data or downgrading privacy settings.
Apps cannot sell personal data of minors under 18 without opt-in consent (not opt-out).
Apps must allow minors (or parents on their behalf) to delete accounts and data.
Minors have the right to disable personalized recommendations and targeted advertising.
Apps cannot use algorithmic recommendations to amplify harmful content (e.g., eating disorder content, self-harm) to minors.
Apps must provide parental controls for minors under 18.
Apps cannot collect location, contacts, photos, calendar, or call history from minors under 18 without affirmative parental consent for each category.

Louisiana Minors' Privacy Protection Law

Louisiana passed legislation effective July 1, 2026, protecting minors' privacy online. It follows a similar structure to Utah but with some variations.

What Louisiana Requires (Effective July 2026):

Apps serving minors must obtain parental consent before collecting personal data from minors under 13 (COPPA-aligned).
Apps cannot use dark patterns or manipulative design to get minors to share data.
Apps must delete data upon parental request.
Apps must provide age-appropriate data deletion mechanisms.
Apps cannot sell or share personal data of minors without explicit parental authorization.

California Privacy Rights Act (CPRA) — Children's Provisions

California's CPRA, effective January 1, 2027, includes specific protections for minors aged 13–17. While CPRA is a comprehensive privacy law (like GDPR), the children's provisions are particularly relevant to app developers.

What California CPRA Requires for Minors (Effective Jan 2027):

Apps collecting data from minors aged 13–17 must obtain opt-in consent (affirmative agreement) before collecting, using, or sharing personal information, except for data necessary to provide a requested service.
For minors under 13, apps must follow COPPA: parental consent is required.
Apps cannot use dark patterns to coerce minors into sharing data or downgrading privacy settings.
Minors have the right to delete their accounts and data.
Apps cannot sell personal information of minors aged 13–17 without explicit opt-in consent from the minor (or parent if under 13).
Apps must provide a simple mechanism for minors to opt out of the sale or sharing of their data.

How These Laws Affect Developers vs. App Stores

Who's Responsible?

On the surface, these laws target app stores (Apple, Google), not individual developers. The requirement to verify age and enforce parental consent seems like an App Store responsibility. However, as a developer, you're not off the hook. Here's why:

Shared Responsibility

App stores are implementing age verification, but your app must provide tools to support it. You'll need to: (1) integrate with app store age verification APIs, (2) update your app to handle parental consent flows if the app store doesn't fully handle them, (3) enforce age-appropriate features within your app (e.g., show a "Create Parental PIN" screen if the device is registered to a minor), (4) respect app store parental control signals so your app behaves differently for minors vs. adults.

App-Specific Age Gating

Even if the app store verifies age at download, your app may need to verify age again during signup. For example, if your app is a social network and a minor creates an account in-app, your app should ask their age and either (1) provide a restricted, age-appropriate experience, (2) ask for parental consent, or (3) block them if your app is 18+ only.

Privacy Controls & Features

You must build features required by law: (1) clear age verification UI at signup, (2) parental consent flows for minors, (3) data access, download, and deletion features for minors and parents, (4) parental control dashboards (in some cases), (5) opt-out mechanisms for targeted ads and personalization for minors, (6) restrictions on data sharing for minors' personal information.

Liability

If regulators or parent groups discover your app is unlawfully collecting data from children or circumventing parental consent mechanisms, you face liability. State attorneys general and the FTC pursue these cases. Even if the app store approved your app, you bear responsibility for your app's data practices.

Apple's Declared Age Range API

Apple has introduced a "Declared Age Range" API to help apps determine the age category of the current user and provide age-appropriate experiences.

How It Works

When uploading your app to App Store Connect, you declare the age range your app targets: 4+, 12+, 17+, or 18+.
Users in App Store set their age in their Apple ID account.
Your app can query the user's declared age via the API and adjust features accordingly.
For example, if a user is in the "under 13" category, your app might disable direct messaging, disable targeted ads, or require parental consent before collecting location data.

Using the API

In your app code, you can check the user's age category and conditionally show features:

if (userAgeRange == .under13) { // Show age-appropriate experience, disable data collection } else if (userAgeRange == .teens) { // Show teen-appropriate experience, require opt-in for personalization } else { // Show full feature set for adults }

This API is not yet widely deployed, but expect Apple to roll it out more fully to support state laws requiring age-based features.

Connection to COPPA (Children's Online Privacy Protection Act)

The US federal law COPPA has regulated apps and websites directed to children under 13 since 1998. The new state laws build on COPPA but extend it to teens aged 13–17, require more stringent age verification, and add features like dark pattern bans and algorithmic recommendation restrictions that COPPA doesn't explicitly address.

COPPA Requirements Refresher

If your app is directed to children under 13:

Obtain verifiable parental consent before collecting personal information (name, email, location, photos, video, phone number, etc.).
Publish a clear privacy policy explaining what you collect, how you use it, and who you share it with.
Don't use dark patterns or manipulative design.
Provide parental access to and control over their child's information (ability to request access and deletion).
Maintain security safeguards to protect children's data from breach.
Don't use children's data for behavioral advertising (targeted ads based on tracking) without parental consent.

How New State Laws Expand COPPA

Teens (13–17): COPPA only covers under-13. New laws extend protections to teens, requiring stricter consent (opt-in vs. opt-out) and restrictions on profiling and algorithmic amplification.
Age verification: COPPA requires reasonable verification; new laws require app stores to implement verified age checks at download (not just parental consent forms).
Dark patterns: COPPA forbids deception; new laws explicitly ban dark patterns (defined as UI tricks that nudge users into oversharing or downgrading privacy).
Algorithmic harms: New laws restrict apps from amplifying harmful content (eating disorders, self-harm) to minors, which COPPA doesn't directly address.

Teen Privacy Laws (Ages 13–17)

New Protections for Teens

Laws like Utah and California's CPRA recognize that teens aged 13–17 deserve heightened privacy protection beyond what COPPA provides for younger children. Teens often have their own smartphones and create accounts independently, but their privacy awareness and susceptibility to manipulation may still be developing. New laws require:

Opt-in consent: Apps must get teens' explicit agreement before using data for targeted advertising, profiling, or sharing with third parties. Opt-out (where users must actively disable) is insufficient.
Parental oversight: Parents can request access to a teen's account and data, and can delete the account if the teen is under 18 (in some laws).
Easy opt-outs: Teens can easily disable personalized recommendations, targeted ads, and data sharing with one or two taps.
Restricted algorithmic amplification: Apps cannot use machine learning to recommend harmful content (self-harm, eating disorders, substance abuse) to teens.
Limited data collection: Apps should minimize collection of sensitive data (contacts, location, photos) and require teens' explicit consent before accessing device sensors.

What Developers Should Do Now (Before Laws Take Effect)

Audit Your App

Document whether your app is directed at children, teens, or all ages.
List all personal data your app collects from minors (under 18).
Identify third parties who receive minor users' data (ad networks, analytics, social plugins).
Review your parental consent mechanism: do you have one? Is it COPPA-compliant? Will it pass a state attorney general's scrutiny?
Check for dark patterns: buttons, toggles, or UI that manipulates minors into oversharing. Redesign if found.

Implement Age Verification

Add an age gate at signup: "How old are you?" or "What's your birthdate?"
For minors under 13, require parental email and implement parental consent flow (email verification before account activation).
For teens 13–17, collect age but don't block signup; instead, provide an age-appropriate experience with restricted features and require opt-in for data sharing.
Consider integrating with Apple's Declared Age Range API when available.

Parental Consent Flows

If you target children under 13, build a parental consent flow: show the minor a screen with their parent's email, send a verification email to the parent, require the parent to confirm before the account becomes active.
Store proof of parental consent (timestamp, parent email, what was consented to) for legal protection.
Make it easy for parents to revoke consent and delete their child's account.

Update Privacy Policy & Consent Mechanisms

Clearly disclose what data you collect from minors and how you use it.
For minors under 13, obtain explicit parental consent before collecting personal data.
For minors 13–17, provide opt-in consent for targeted ads and data sharing (not opt-out).
Explain parental controls: how parents can view their child's data, delete it, and manage privacy settings.
Use tools like App Club to generate COPPA and state law-compliant privacy policies.

Data Handling for Minors

Minimize data collection from minors: collect only what's necessary for core app features.
Disable targeted advertising for minors unless you have explicit opt-in consent.
If you use behavioral analytics (e.g., Firebase tracking every screen view), obtain consent or rely on an exemption (analytics for app improvement may not require consent under some laws, but verify).
Don't sell or share minors' personal data without explicit opt-in consent from the minor (or parent if under 13).
Implement easy opt-out: Settings → Privacy → "Disable personalized ads" (one toggle, immediate effect).

Parental Control Features

Build in-app parental controls: a PIN-protected Parent Dashboard where parents can view their child's account, see what data is collected, view communication history (if applicable), delete the account, and manage privacy settings.
For very young children, this might be a dedicated screen after signup that prompts the child to provide a parent's email and PIN.
For teens, parental controls might be less intrusive (e.g., parents can see aggregated usage stats and data collected, but not every message).

Avoid Dark Patterns

Don't use pre-ticked boxes (e.g., "Yes, use my data for ads" is checked by default; user must uncheck it).
Don't use vague, manipulative language like "Allow sharing for a better experience" without explaining what "sharing" means.
Don't hide the opt-out button or make it smaller than the opt-in button.
Don't bury parental controls in obscure settings menus; make them prominent.
Don't use countdown timers ("Consent expires in 5 seconds") to pressure quick decisions.
Have your design reviewed by someone outside your team who can spot manipulative patterns.

Google Play's Age Ratings & Approach

Google Play uses a content rating system (Everyone, Everyone 10+, Teen, Mature 17+, Adults Only 18+) that's different from age verification. The rating is about content appropriateness, not data collection or parental consent.

How Google Play Ages Apps

When you submit an app, Google asks about content (violence, sexual content, drugs, etc.). Based on your answers, Google assigns a rating. An app rated "Everyone" can be downloaded by anyone; an app rated "17+" may have restrictions on some devices or show age warnings.

Google's Stance on Children's Apps & Data

Google Play Policy explicitly forbids apps from knowingly collecting data from children without parental consent (COPPA compliance). Google's Play Families Program asks developers to certify their app is family-friendly and COPPA-compliant if it targets children. Non-compliance results in app removal.

What to Expect

As state age laws take effect, Google will likely align its policies and require age verification and parental consent mechanisms. Google may introduce an API similar to Apple's to share user age with apps. Stay tuned to Google Play policy updates.

How Privacy Policies Need to Update for Age-Specific Data Handling

Your privacy policy must now explain how you handle data differently based on age.

Example Sections

Children Under 13 (COPPA)

"If you are under 13, we require your parent or guardian to provide consent before we collect personal information. We collect: [list: email, profile name, profile photo]. We use this data only to: [list: provide the service, prevent abuse]. We do not use your data for targeted advertising or sell your data to third parties. Your parent can access, update, or delete your data by contacting us at [email protected] or using the 'Parent Dashboard' feature in the app."

Teens Ages 13–17

"If you are 13–17, we collect personal information with your permission. We ask your consent before: [list: enabling targeted ads, sharing data with partners, using your location for recommendations]. You can withdraw consent anytime in Settings → Privacy. You have the right to delete your account and data by [contact method or in-app button]. We do not use dark patterns to manipulate you into sharing data. If your parents request it, they can access your account and delete it."

Adults 18&+

"If you are 18 or older, standard privacy terms apply. We may collect [list data] and use it for [list purposes] based on your consent and our legitimate interests."

Parental Controls & Rights

"Parents of minors using our app can: view their child's personal data, download a copy, delete their child's account, and manage privacy settings via the 'Parent Dashboard' (link) or by contacting [email protected] with proof of relationship (birth certificate or family plan documentation). We respond to parental requests within 30 days."

Age Verification Process

"At signup, we ask your age or birthdate. If you're under 13, we require parental consent via email verification. If you're 13–17, we provide an age-appropriate experience with stricter privacy defaults. If you're 18+, you have full access to all features."

Use App Club's policy generator to create a template that addresses age-specific handling, then customize it for your app.

EU Digital Services Act & Age Verification (Comparison)

The EU's Digital Services Act (DSA), effective in 2024, includes provisions for protecting minors online that are similar in spirit to the US state laws. The DSA requires:

Services must identify and mitigate risks to minors' safety, including data misuse and algorithmic manipulation.
Services must provide easy opt-out of recommender systems (algorithmic feeds) and tailored advertising.
Services must not use dark patterns to manipulate minors.
Services must be transparent about how algorithms work.

The DSA doesn't require app stores to verify age at download (unlike ASAA or Utah law), but it does require platforms to provide tools for parental control and age-appropriate experiences. If your app is available in the EU, ensure it complies with both DSA and your target country's GDPR requirements, in addition to US state laws.

Timeline & Enforcement Considerations

Dates to Mark

May 29, 2026: Utah's Online Privacy Protection Act and Youth Online Privacy Protection Act become enforceable.
July 1, 2026: Louisiana's Minors' Privacy Protection Law takes effect.
January 1, 2027: California's CPRA minors' provisions take effect.
ASAA (Texas): Paused by court, but could be enforced in the future if legal challenges are resolved.

Who Enforces?

State Attorneys General (AG): can sue apps for non-compliance and seek penalties.
FTC: can investigate apps nationwide for COPPA violations.
App stores: can remove apps that don't comply with their policies, which will increasingly reflect state laws.
Parent advocacy groups: may file complaints with regulators on behalf of consumers.

What Happens to Violators?

App removal from store.
State AG fines (up to $1000–$5000 per violation, per minor affected; can add up quickly).
FTC action under COPPA (fines, consent decrees, publicity).
Negative media coverage and user backlash.
Class action lawsuits from parents or privacy groups.

Grace Period?

Some states allow a grace period for compliance. For example, Utah's law becomes effective in May 2026, but enforcement may not be immediate. However, don't count on a grace period; assume enforcement can begin on the effective date. Start implementation now (mid-2025 or before) to meet May 2026 deadline for Utah and later dates for other states.

Tools & Resources

App Club: Generate COPPA and state law-compliant privacy policies, parental consent forms, and data deletion request templates for your app.
FTC COPPA Guidance: ftc.gov/compliance has official COPPA requirements and examples.
Apple App Store Connect: look for age-related fields and upcoming Declared Age Range API documentation.
Google Play Console: monitor Google Families Program and age-related policy updates.
State Attorney General Offices: some publish guidance on their new laws (e.g., Utah AG's office).
Privacy Counsel: for complex or high-risk apps, consult a lawyer specializing in children's privacy and COPPA.

Key Takeaways for Developers

Age verification is coming. Whether app stores fully implement it or not, your app should verify user age and provide age-appropriate experiences.
Parental consent is mandatory for children under 13. Build a parental consent flow; email verification is the standard.
Teens (13–17) need special handling. Provide opt-in (not opt-out) consent for data sharing and targeted ads, and make privacy controls easy and obvious.
Data minimization is key. Collect only what you need from minors. Disable tracking and targeted ads unless you have explicit consent.
Avoid dark patterns at all costs. Regulators specifically target and fine companies that use them. Fair, transparent UI is legally safer and ethically sound.
Update your privacy policy. Use generators like App Club to create COPPA and state law-compliant policies that explain your age-specific practices.
Document compliance. Keep records of consent, parental verification, and data handling. This proves compliance if an AG or parent group investigates.
Expect enforcement soon. With Utah and Louisiana laws effective in mid-2026, enforcement actions will follow. Be ready.
Get ahead of competitors. Apps that implement strong children's privacy features now will have a compliance advantage and earn user trust when laws take full effect.

Conclusion

The landscape of app store privacy laws is shifting rapidly. What was optional or unclear two years ago is now required by law in multiple states, with more laws on the horizon. Developers who ignore these requirements face app removal, fines, and legal action. Developers who proactively build age verification, parental consent, and age-appropriate privacy features will not only stay compliant but also build trust with users and parents.

Start with a comprehensive privacy policy that addresses age-specific data handling. Add age gates, parental consent flows, and parental control features to your app. Disable tracking and targeted ads for minors unless you have explicit permission. Remove dark patterns. Use tools like App Club to generate compliant legal documents. And stay informed as laws continue to evolve.

The effort is substantial, but the payoff is significant: a compliant app that passes store review, avoids regulatory fines, and respects the privacy of young users. Your app will be stronger, more trustworthy, and ready for the privacy-first future of app development.