Executive Summary

• The App Store Accountability Act, a bicameral bill introduced at the beginning of May, would require app store operators to verify users’ ages and require parents to consent for minors to use the store, download apps, or make purchases.
• The bill would preempt similar state-level bills that have begun to pass into law and make the Federal Trade Commission the primary enforcer of the act’s various provisions.
• The bill raises significant privacy and constitutional concerns, primarily stemming from the burden it would impose on anonymous speech and the additional information users would be required to provide to access any application.

Introduction

Last week, Representative John James (R-MI) and Senator Mike Lee (R-UT) introduced the App Store Accountability Act, which would require age verification to use app stores such as the Apple App Store on iOS and Google Play on Android devices. Specifically, the bill would require app stores to verify users’ ages when creating an account to access an app store, as well as organize these users into different age categories to allow apps to distinguish between adults and minors without disclosing actual birthdays. It would then require app stores and developers to clearly display age ratings and content descriptions so that parents can better control which apps their children can use and what they can purchase. While the bill builds on a growing trend of similar legislation introduced and enacted at the state level, it would preempt these state laws so that developers have one set of rules to follow, with the Federal Trade Commission (FTC) serving as the primary enforcement authority.

Despite growing support for app store age verification as a concept, particularly from big tech platforms such as Meta and X, the bill also raises significant privacy and First Amendment concerns. Requiring every user – regardless of age – to verify their age before they can download applications would undoubtedly require the disclosure of additional information that can be misused, mishandled, or otherwise accessed by malicious actors and used to harm the individual. Further, by verifying age, the bill could violate the First Amendment primarily due to concerns about the right to speak anonymously online: If users must provide identifiable information about themselves, their ability to share or obtain information anonymously could be jeopardized. Indeed, many of the state level bills have already been ruled unconstitutional primarily due to this concern, though most litigation thus far has focused on bills that target applications rather than app stores. Finally, the bill would shift the burden of protecting children online away from the applications themselves and onto the app store, putting significant costs on the app stores and developers who must now comply with transparency mandates.

App Store Accountability Act

The App Store Accountability Act creates a series of obligations for both app stores and app developers.

App Store Obligations

The bill requires app stores to verify users’ ages. Currently, federal law includes a variety of protections for children online, but these often only apply when the platform or website knows the user is in fact a child. Children can easily get around existing “age verification” by simply stating they are in fact adults, but efforts to impose a heightened knowledge standard (such as a constructive knowledge standard) have failed largely due to both legal and policy concerns. By targeting app stores rather than individual websites, proponents argue that the bill alleviates these concerns. Further, the bill would require app stores to use commercially reasonable methods of age verification, and advancements in age verification technology can require less information from users, and may come cheaper than previous methods of age verification, such as by obtaining credit card information.

In addition to requiring that app stores verify the age of users, the bill would require app stores to receive parental consent before minors can use, download from, or make purchases within apps and app stores. To achieve this, app stores would be required to display age ratings or descriptions of the content so that parents can make an informed decision about what apps their children can use.

Developer Obligations

While the bill primarily targets app stores, it would also require that the applications provide to both the public and app stores information on the type of content they host. Most notable, the bill requires that app developers verify, using the app store application programming interface, the category of age of the user before downloading, and that minors have parental consent to download the application.

Oversight and Enforcement

The bill would preempt state app store laws and direct the FTC to enforce its provisions. In addition, the bill would create an advisory committee to recommend best practices regarding the age rating of apps.

Concerns

The bill’s approach to protecting children online raises a variety of concerns, most notably regarding user privacy and the First Amendment. Despite these concerns, proponents of the bill argue that targeting the app store best protects users and provides a minimal burden on industry, and that advancements in age-assurance techniques could sufficiently alleviate the burden and chilling effect on anonymous speech.

In mandating that app stores verify the age of their users, the bill would require individuals to disclose additional information to a verifier to gain access to the app store and the information therein. Traditionally, this would require the provision of a driver’s license or the use of a credit card to estimate age, but many users do not want to disclose this information for a variety of reasons. If the age-verifying company stores that information, for example, it could be obtained by hackers, sold to advertisers, or otherwise misused by the business. Further, many users simply do not want large companies to know additional information about them.

Providing additional personal information about themselves also means the user must give up some level of anonymity, which raises First Amendment concerns. Courts have explained that Americans have a right to share and access information without disclosing their identify. Theoretically, age verification bypasses this concern because the user doesn’t necessarily need to provide their identification – just their age. But in practice this distinction is blurry, and even the most sophisticated age-assurance techniques could result in the individual being identified, creating a chilling effect on speech. For example, information about a user’s age could be paired with public or leaked data to de-anonymize the individual. Or, requirements to verify a user’s age could prevent that user from accessing information they feel embarrassed accessing, knowing that it could potentially be tied to them in the future. This chilling effect on lawful, anonymous speech has largely driven the legal challenges for the state level age verification bills.

Advancements in age assurance technologies could alleviate some of these concerns, however. In recent years, new technologies such as biometric scans and Zero-Knowledge Proofs could allow for an app store to verify that a user meets specific criteria without knowing exact their age or limiting the amount of information required to be released to a third party. These protections can also be supplemented by requirements for a double-blind verification option, meaning the application lacks information about the user and the age verification provider (which would a third-party) does not receive any information about the platform. Further, requirements regarding the handling and processing of consumer data by an age verifier can limit potential abuse, mitigating some of the risks. While strict First Amendment scrutiny is difficult to overcome, these advancements could result in a judge deciding the burdens on individuals are fairly limited and narrowly tailored to achieving the government’s goal.

Another challenge for proponents will be showing why current tools for parents fail to sufficiently protect children and whether there are alternative, less burdensome means of achieving these purposes. For example, Google and Apple offer parents controls built into the operating system and app stores, and it is unclear why these protections are insufficient to achieve the bill’s goals. If other, less restrictive means are available, it could jeopardize the bill’s constitutionality.

As an alternative, a judge could find that a lower level of First Amendment scrutiny should apply. For example, proponents have argued that the bill is grounded in contract law, not content. And because the verification requirements would apply to all app stores, the regulation is content neutral, which differs from some state-level bills that exempted different platforms and services. While these are separate issues from the anonymity concerns above, if a court focuses on these arguments, the bill could survive judicial scrutiny.

Finally, the bill does raise economic concerns. Forcing app stores to implement age verification, and to work with apps to provide additional information about those apps to consumers, increases the costs for the application stores. This, in turn, could raise costs for the app stores and applications, which will mean fewer apps and more fees for consumers. That said, if Congress does plan on requiring some age verification for social media or applications more specifically, targeting the app store could provide a less burdensome avenue to do so.

Conclusion

After a long push for state-level age verification requirements for app stores, Congress may soon act to impose a nationwide standard. The bill’s placement of the burden of verifying age on app stores rather than individual applications – along with advancements in age-assurance technologies that require less information from users – could alleviate some privacy and constitutional concerns but would not resolve them entirely. Congress should carefully consider how the bill would impact privacy and anonymous speech online, as well as whether existing tools with less intrusive means can adequately protect minors from harmful applications.