App store obligations

(a) In general Each covered app store provider shall— (1) at the time an individual creates an account with the covered app store provider— (A) request age information from the individual; and (B) verify the individual’s age category using a commercially available method or process that is reasonably designed to ensure accuracy; (2) if the age verification method or process determines the individual is a minor— (A) require the account to be affiliated with a parental account; and (B) obtain verifiable parental consent from the holder of the affiliated parental account before allowing the minor to download or purchase an app or make an in-app purchase; (3) after receiving notice of a significant change from an app developer— (A) notify the user of a significant change; and (B) for a minor account, notify the holder of the affiliated parental account and obtain a new verifiable parental consent; (4) provide to an app developer the user’s age category and the status of verified parental consent if the user is a minor; (5) notify an app developer when a parent revokes verifiable parental consent; (6) protect the confidentiality of personal data related to age verification by— (A) limiting its collection, processing, and storage to what is strictly necessary to verify a user’s age, obtain verifiable parental consent, or maintain compliance records; and (B) safeguarding personal data related to age verification by adopting reasonable administrative, technical, and physical safeguards to secure the collection, processing, storage, and transmission of this data, including through industry-standard encryption; (7) if a covered app store provider displays an age rating or description of an app’s content, the age rating and description must be clearly and prominently displayed and be in plain and concise language; and (8) provide to an app developer the ability to determine, in real time, the age category of any user and, with respect to any user that is a minor, whether the covered app store provider has obtained verifiable parental consent. (b) Rules of construction Nothing in this section shall be construed— (1) to prevent a covered app store provider from taking reasonable measures to block, detect, or prevent the distribution of unlawful or obscene material to minors, to block or filter spam, to prevent criminal activity, or to protect the security of an app store or app; (2) to require a covered app store provider to disclose to an app developer information other than such user’s age category and, with respect to any user that is a minor, whether the covered app store provider has obtained verifiable parental consent in accordance with this section; (3) to allow a covered app store provider to use any measures required by this section in a way that is arbitrary, capricious, anti-competitive, or unlawful; or (4) to affect or restrict the expression of political, religious, or other viewpoints.