On this page · 12 sections
- What is in force, what is coming, and what is in court
- Alabama HB 161: what applies from 1 January 2027
- Louisiana HB 977 (Act 185): what changes on 1 July 2027
- Alabama vs Louisiana: the developer view
- Court status: plan for the law, watch the docket
- Apple and Google: mapping duties to APIs
- What to build: a reference design
- Worked example: one ads update, two states
- Checklist for 1 January and 1 July 2027
- A note for Indian and offshore teams
- How eCorpIT can help
- References
Summary. Alabama's HB 161 (Act 2026-59) applies from 1 January 2027, and Louisiana's HB 977, signed as Act 185 on 15 May 2026, from 1 July 2027. Act 185 stopped Louisiana's 2025 law (HB 570) from ever taking effect, so the 1 July 2026 date some trackers still show is dead, and Utah's HB 498 moved its duties to 6 May 2027. In both new states the store verifies each account holder's age category (under 13, 13 to 15, 16 to 17, 18 and over), links minors to a parent and collects parental consent. Developers must request the category and consent status through the store, notify stores of significant changes, limit use of the data, and never share it (Alabama) or sell it (Louisiana). Penalties reach $7,500 per knowing or reckless violation in Alabama and $10,000 per violation in Louisiana, after a 45-day cure notice. CCIA sued Alabama's Attorney General on 28 October 2026; no court order had been reported by 7 November 2026. Texas's version has been enforceable since 28 May 2026. Plan for both dates on Apple's and Google's age APIs.
About this article. For product, mobile and privacy teams with apps in Alabama or Louisiana, and their agencies. On 7 November 2026 we read Alabama's enrolled HB 161 on the legislature site, and Louisiana's Act 185 and Utah's enrolled HB 498 as archived copies, because both legislature sites were unreachable from our network. We also read the CCIA complaint and Apple and Google documentation, using law firm and tracker reports only where no primary source exists. This is general information, not legal advice; confirm your position with counsel. No vendor paid for inclusion. Researched with AI assistance and reviewed by our editorial team.
What is in force, what is coming, and what is in court
App store accountability acts (ASAAs) move age checks to the store: the store verifies the account holder, the parent approves, and the developer receives an age category and a consent status. Six state laws matter; the table draws on the enacted texts and the reports cited.
| State | Law | Developer duties start | Status on 7 November 2026 | Enforcement |
|---|---|---|---|---|
| Texas | SB 2420 | Enforceable since 28 May 2026 | Injunction of 23 Dec 2025 stayed on 28 May 2026; Supreme Court refused emergency relief on 6 Jul 2026; appeal pending | Deceptive trade practice, which also opens private suits |
| Utah | SB 142 (2025), amended by HB 498 (2026) | 6 May 2027 | Not yet in force; CCIA dropped its challenge on 21 Apr 2026 after state enforcement was removed | Private suits by harmed minors or parents only |
| Louisiana (old) | HB 570, Act 481 of 2025 | Was 1 Jul 2026 | Never took effect; stopped by Act 185 | None |
| Alabama | HB 161, Act 2026-59 | 1 Jan 2027 | Challenged in CCIA v. Marshall, filed 28 Oct 2026; no order reported | Attorney General only; up to $7,500 per violation |
| Louisiana (new) | HB 977, Act 185 of 2026 | 1 Jul 2027 | No challenge found | Attorney General only; up to $10,000 per violation |
| California | AB 1043, amended by AB 1856 | 1 Jan 2027 | Different model: operating system age signal, no store consent gate | Attorney General only |
Trackers lag the statute books. Apple's 24 February 2026 notice still names 6 May 2026 for Utah and 1 July 2026 for Louisiana, and the October 2026 AVPA tracker lists the dead HB 570 date and says Utah's duties began on 6 May 2026; Utah's enrolled HB 498 says 6 May 2027. A lawsuit is not an injunction either, so treat Alabama's date as live. California's design is covered in our AB 1043 developer checklist. Do not confuse these acts with Alabama's and Louisiana's new privacy laws (1 May 2027 and 1 January 2027), covered in our 2027 state privacy law guide.
Alabama HB 161: what applies from 1 January 2027
HB 161, by Representatives Sells and Mooney, passed the House 103 to 0 on 22 January 2026; the Senate amended and passed it on 5 February and the House concurred on 10 February. LegiScan records it as enacted on 17 February 2026, and the CCIA complaint calls it Act 2026-59. Section 15 sets 1 January 2027.
Scope. A mobile device is a phone or general-purpose tablet with connectivity that runs a mobile operating system. A developer is any entity that owns or controls an app offered through an app store, or a pre-installed app. There is no revenue threshold and no exemption for apps not aimed at children.
What app stores must do. Verify the age category of anyone in Alabama who creates an account, and of accounts that existed on 2 October 2026 by 1 October 2027. Link minors to a parent account and obtain verifiable parental consent before a minor downloads or buys an app or makes an in-app purchase. Let parents withdraw consent and tell developers, and give developers real-time access to each Alabama user's age category and consent status. Section 10 requires Attorney General rules on verification; we found none by 7 November 2026.
What developers must do (Section 9).
- Verify through the store. Check each Alabama user's age category and, for minors, consent status through the store.
- Request at trigger points. Request age data or consent at download, purchase or first launch of a pre-installed app, at a significant change, and when another law requires it.
- Notify significant changes to every app store.
- Limit use to your own age restrictions, protections or defaults, legal compliance and safety features.
- Apply the lowest category when the store's data and your own disagree.
- Never share age category data with any person.
- Hold back your terms. Do not enforce terms of service against a minor unless the store has confirmed consent.
- Do not misrepresent anything in the parental consent disclosure.
You may also re-check once in 12 months, on reasonable suspicion of account transfer or misuse, and at new account creation.
Significant change is the definition to print out: a material change to your terms or privacy policy that changes the categories of data collected, stored or shared; adds monetisation such as in-app purchases or ads where there were none; or alters the age rating or content descriptions. A legal edit to your privacy policy can trigger renewed parental consent. Ratings are moving too: Apple adds content descriptors for shared location and for dating and relationships on 16 November 2026, and every app must answer them by 12 January 2027. If your answers change your rating, ask counsel whether the significant-change process applies.
Softeners. Section 13(5) says nobody has to block an app installed before 1 October 2026 unless a parent revokes consent or a significant change occurs. Section 12 shields developers that relied in good faith on the store's data and consent notices and otherwise complied, and protects age ratings set consistently with widely adopted industry standards.
Enforcement. A knowing or reckless violation is a deceptive trade practice. Only the Attorney General can sue, within one year of learning of it, for up to $7,500 per violation plus fees and costs, and punitive damages for a consistent pattern.
Louisiana HB 977 (Act 185): what changes on 1 July 2027
HB 977, by Representative Beau Beaullieu, passed the House 94 to 0 on 22 April 2026 and the Senate 36 to 0 on 11 May, and was signed on 15 May as Act 185. Section 1, effective on signature, provides that Act 481 of 2025 (HB 570, due on 1 July 2026) will not take effect. Section 2, enacting R.S. 51:1771 to 1775, takes effect on 1 July 2027. The skeleton matches Alabama's, but seven differences change the build.
- More devices. A connected device is a smartphone, tablet, computer, gaming console or virtual reality device. FPF notes that no other ASAA reaches connected devices, so console, PC and VR storefronts come into scope.
- Pre-loaded apps and purchase settings. The store needs parental consent before a minor accesses a pre-loaded app or switches on in-app purchases, as well as before downloads and purchases.
- Verification and existing accounts. Stores may verify with commercially available methods, including a real-time system authorised by Louisiana's commissioner of motor vehicles. The duty attaches at account creation; the act sets no deadline for existing accounts.
- A different conflict rule. You may rely on the store's signal unless you actually know your own is more accurate, for example because the user gave you proof of age. Then you must use your signal or the lower of the two.
- Broader significant changes. Louisiana adds any material change to the app's functionality or user experience, and its monetisation limb drops Alabama's condition that the feature be new to the app.
- Sale, not sharing. Developers may not sell age category data. Alabama bans sharing it with anyone.
- Family account apps. A paid or payment-verified app with profiles that bars under-18 sign-ups and verifies the primary holder as an adult may use the holder's age range and let the holder attest to profile ages.
Developers must also enforce all age-related restrictions and use the verified signal for legally required minimum ages and age-appropriate defaults. If R.S. 9:2800.29 already requires you to age-verify in the app, that duty stays with you.
Enforcement. The Attorney General may sue for fines of up to $10,000 per violation, after 45 days' written notice, and cannot sue if you cure and confirm in writing, unless you repeat the violation. Breaching a resulting order costs up to $5,000 per violation, and a winning Attorney General recovers fees and investigative costs. A developer that shows it complied with R.S. 51:1773 is not liable.
Alabama vs Louisiana: the developer view
Both columns come from the enrolled texts.
| Item | Alabama HB 161 | Louisiana HB 977 (Act 185) |
|---|---|---|
| Effective | 1 Jan 2027 | 1 Jul 2027 |
| Devices | Phones and general-purpose tablets | Adds computers, consoles and VR devices |
| Mandatory developer requests | Download, purchase, first launch of pre-installed app, significant change, other law | Download, purchase, significant change, other law |
| Conflicting age data | Lowest category wins | Store signal, unless you know your own is more accurate |
| Third-party use | No sharing with any person | No sale |
| Significant change | Data categories, monetisation where none existed, age rating | Same without the none-existed limit, plus material functionality or UX changes |
| Existing accounts | Stores verify by 1 Oct 2027; no blocking of pre-1 Oct 2026 installs without a trigger | No backfill deadline in the text |
| Family accounts | No carve-out | Carve-out for qualifying apps |
| Penalty | Up to $7,500 per knowing or reckless violation | Up to $10,000 per violation |
| Cure period | None stated | 45 days |
Court status: plan for the law, watch the docket
Texas shows how fast this moves. A district court enjoined SB 2420 on 23 December 2025, as a likely unconstitutional content-based rule. The Fifth Circuit stayed that injunction on 28 May 2026, and on 6 July 2026 the Supreme Court denied emergency applications in Students Engaged in Advancing Texas v. Paxton and CCIA v. Paxton, without ruling on the merits. Apple applied the rules to new Texas accounts from 4 June 2026, and Google's API returns signals for eligible Texas accounts created after 28 May 2026.
Utah went the other way. HB 498, signed on 18 March 2026, delayed the duties to 6 May 2027 and removed the Attorney General's enforcement role, leaving only private suits by harmed minors or parents. With no state official to sue, CCIA dropped its challenge on 21 April 2026, so no court ruled on the merits.
Alabama is the live fight. CCIA v. Marshall (case 2:26-cv-00897, Middle District of Alabama), filed on 28 October 2026, argues that the act puts nearly every mobile app behind verification and consent gates that burden protected speech. It also says the act can be read to force developers to age-rate content, calls the significant-change notice duty vague, and raises a Commerce Clause claim. No court order had been reported by 7 November 2026, and the Fifth Circuit's Texas order does not bind courts in Alabama, which sits in the Eleventh Circuit. Build for 1 January behind feature flags you can switch per state.
Apple and Google: mapping duties to APIs
The table maps each duty to Apple's and Google's documented tools.
| Developer duty | Apple | Google Play |
|---|---|---|
| Get age category | Declared Age Range API; isEligibleForAgeFeatures (iOS 26.2+) and requiredRegulatoryFeatures (iOS 26.4+) | Play Age Signals API (beta); Google recommends library 0.0.4 |
| Parental approval status | Declared Age Range flags when parent permission is needed for a significant update | significantChangeStatus and ageRangeSource in 0.0.4 |
| Significant changes | PermissionKit SignificantAppUpdateTopic; system acknowledgement sheet for adults (iOS 26.4+) | Notify on the Age signals page in Play Console, no new release needed |
| Revoked consent | Server notification RESCIND_CONSENT; Apple stops the app launching | Play Console list of revoked install IDs, kept 90 days |
| Age ratings | StoreKit ageRatingCode returns the app's current rating, to detect a change | Age ratings on in-app product SKUs |
| Build floor | iOS 26.2 SDK and Xcode 26.2 or later for all features | Client-side library; signals only while the app is open |
| Testing | Sandbox age scenarios from iOS 26.2 | FakeAgeSignalsManager test class |
| Use limits | Developer responsible for its own age restrictions | No advertising, marketing, profiling or analytics use |
Four details affect code. On iOS 26.5 and later, Apple returns a single confirmed value when a card or ID confirmed the age, instead of paymentChecked and governmentIDChecked. Apple says you must keep a child out of a significant update until the parent approves. Google says Play will not revoke access when a parent declines a significant change, so you read the status and gate access yourself. Google's 0.0.4 library adds a required requestAgeSignalsAccess() call and drops userStatus; our Play Age Signals integration guide walks through it. If you are also moving to the iOS 27 SDK for Apple's April 2027 upload rule, put the age work on the same release train.
Neither company had published Alabama guidance by 7 November 2026; Google's pages name only Brazil and Texas as live and promise updates before other state laws start.
What to build: a reference design
Seven components cover Texas, Utah, Alabama and Louisiana.
- Eligibility check. Let the platform's eligibility flags, not your own geolocation, say whether age rules apply.
- Age-signal service. Normalise both APIs to the four categories; record source, method, timestamp and state.
- Conflict resolver. Lowest category for Alabama; the store's signal for Louisiana unless you hold better evidence.
- Consent gate. Flags that keep a minor on the pre-change experience until consent arrives.
- Significant-change register. A release step that flags policy, monetisation, rating and (for Louisiana) UX changes and notifies both stores.
- Revocation handler. Consume RESCIND_CONSENT and the Play revoked-approvals list.
- Quarantine and evidence log. Keep the category out of analytics, ad SDKs and exports, and log every request for the safe harbour.
A policy file keeps the state differences out of app logic:
age_policy:
alabama:
effective: 2027-01-01
request_on: [download, purchase, preinstalled_first_launch, significant_change, legal_requirement]
conflict_rule: lowest_category
third_party_disclosure: none
significant_change_monetisation: only_if_none_before
louisiana:
effective: 2027-07-01
request_on: [download, purchase, significant_change, legal_requirement]
conflict_rule: store_unless_internal_known_more_accurate
third_party_disclosure: no_sale
significant_change_monetisation: any_new_feature
significant_change_includes_ux: true
family_account_exception: true
Worked example: one ads update, two states
A hypothetical free puzzle game has no ads or in-app purchases, 30,000 Alabama accounts and 25,000 Louisiana accounts; assume 15% belong to minors. In August 2027 it plans to add rewarded ads.
- Is it a significant change? Yes in both states: it adds monetisation where none existed. The team notifies Apple and Google once; the stores seek renewed consent.
- How many minors need renewed consent? 30,000 x 0.15 = 4,500 in Alabama and 25,000 x 0.15 = 3,750 in Louisiana, so 8,250 accounts.
- What does the build need? If 40% of parents have not approved after a month, 8,250 x 0.40 = 3,300 minors must stay on the ad-free version. That needs a server-side flag, not a separate binary.
- What is the exposure? Neither statute says how violations are counted; purely as an illustration, if each affected minor counted once, the ceilings would be 4,500 x $7,500 = $33,750,000 in Alabama and 3,750 x $10,000 = $37,500,000 in Louisiana, before Louisiana's 45-day cure window. Courts set real amounts.
Checklist for 1 January and 1 July 2027
Before 1 January 2027 (Alabama):
- List every app reachable by Alabama accounts, including pre-installed deals.
- Build against the iOS 26.2 SDK or later; integrate Play Age Signals 0.0.4.
- Wire the triggers: download, purchase, first launch of pre-installed apps, significant change.
- Apply the lowest-category rule across app and web accounts.
- Add the significant-change step to release management, legal edits included.
- Put changed features behind per-state flags and handle consent revocation.
- Strip the category from analytics, attribution and ad payloads.
- Stop enforcing terms against Alabama minors without confirmed consent, arbitration flows included.
- Keep your store data disclosures accurate, and answer Apple's new content descriptors by 12 January 2027.
- Log requests and responses, and track CCIA v. Marshall and the Section 10 rules.
Before 1 July 2027 (Louisiana):
- Extend coverage to console, PC and VR builds in covered stores.
- Switch the conflict rule and assess the family account exception.
- Widen the significant-change test to material UX changes and any new monetisation, and check data deals against the sale ban.
- Confirm whether R.S. 9:2800.29 already requires you to age-verify.
- Watch Apple and Google: Apple's last Louisiana notice predates Act 185.
A note for Indian and offshore teams
The duties follow users in these states, not your office. For agencies, the legal developer is whoever owns or controls the app, usually the client, but the build lands on you. India's DPDP Act also requires verifiable parental consent before processing the personal data of anyone under 18, so one age-signal service with per-jurisdiction policies serves both; see our DPDP Act engineering playbook.
How eCorpIT can help
eCorpIT is a Gurugram-based technology organisation, founded in 2021, assessed at CMMI Level 5 and MSME certified, with senior-led engineering teams working across AWS, Microsoft and Google platforms. Our mobile application development team can map where age data flows today, build one age-signal service across Apple's and Google's APIs, and add per-state consent gates and significant-change workflows, with test evidence for your counsel. Talk to us at /contact-us/.
Last updated: 7 November 2026.
