SF 2197 (LSB 5588XS (9) 91)

SENATE FILE 2197

BY  ALONS

A BILL FOR

An Act relating to app store provider and app developer requirements concerning minor users, and providing civil penalties, and including applicability provisions.
BE IT ENACTED BY THE GENERAL ASSEMBLY OF THE STATE OF IOWA:

    Section 1.  NEW SECTION.  554J.1  Definitions.
   1.  “Account holder” means the individual who is associated with the mobile device.
   2.  “Age category” means one of the following categories of individuals based on age:
   a.  “Adult” which means an individual who is at least eighteen years old.
   b.  “Child” which means an individual who is under thirteen years old.
   c.  “Older teenager” which means an individual who is at least sixteen years old and under eighteen years old.
   d.  “Younger teenager” which means an individual who is at least thirteen years old and under sixteen years old.
   3.  “Age category data” means information about an account holder’s age category that is collected by an app store provider and is shared with a developer.
   4.  “Age rating” means one or more classifications that assess the suitability of an app’s content and functions for different age groups.
   5.  “App” means a software application or electronic service that a user may run or direct on a mobile device.
   6.  “App store” means a publicly available internet site, software application, or electronic service that allows an account holder to download an app from a third-party developer onto a mobile device.
   7.  “App store provider” means a person that owns, operates, or controls an app store that allows account holders in the state to download apps onto a mobile device.
   8.  “Content description” means a description of the specific content elements or functions that informed an app’s age rating.
   9.  “Developer” means a person that owns or controls an app made available through an app store in the state.
   10.  “Knowingly” means to act with actual knowledge or to act with knowledge fairly inferred based on objective circumstances.
   11.  “Minor” means an individual under eighteen years old unless the individual is married or legally emancipated.
   12.  “Minor account” means an account with an app store provider that is established by an individual who is a minor. A minor account must be affiliated with a parent account.
   13.  “Mobile device” means a phone or general-purpose tablet described by all of the following:
   a.  The phone or general-purpose tablet provides cellular or wireless connectivity.
   b.  The phone or general-purpose tablet is capable of connecting to the internet.
   c.  The phone or general-purpose tablet runs a mobile operating system.
   d.  The phone or general-purpose tablet is capable of running apps through the mobile operating system.
   14.  “Mobile operating system” means software that does all of the following:
   a.  Manages mobile device hardware resources.
   b.  Provides common services for mobile device programs.
   c.  Controls memory allocation.
   d.  Provides interfaces for apps to access device functionality.
   15.  “Parent” means, with respect to a minor, an individual who is reasonably believed to be a parent, a legal guardian, an individual with legal custody, or any other individual who has the legal authority to make decisions on behalf of the minor.
   16.  “Parent account” means an account with an app store provider that is described by all of the following:
   a.  The account is verified to be established by an individual the app store provider has determined through the app store provider’s age verification methods that the individual is at least eighteen years old, married, or emancipated.
   b.  The account may be affiliated with one or more minor accounts.
   17.  “Parental consent disclosure” means a statement about an app or an in-app purchase containing all of the following information:
   a.  If the app store provider has an age rating for the app or in-app purchase, the app’s or in-app purchase’s age rating.
   b.  If the app store provider has a content description for the app or in-app purchase, the app’s or in-app purchase’s content description.
   c.  A description of all of the following:
   (1)  The personal data collected by the app from an account holder.
   (2)  The personal data shared by the app with a third party.
   d.  If personal data is collected by the app, the methods implemented by the developer to protect the personal data.
   18.  “Significant change” means a material modification to an app’s terms of service or privacy policy that is described by any of the following:
   a.  The modification changes the categories of data collected, stored, or shared.
   b.  The modification alters the app’s age rating or content descriptions.
   c.  The modification adds new monetization features, including any of the following:
   (1)  In-app purchases.
   (2)  Advertisements.
   d.  The modification materially changes any of the following:
   (1)  The app’s functionality.
   (2)  The app’s user experience.
   19.  “Verifiable parental consent” means authorization that is described by all of the following:
   a.  The authorization is provided by a parent account.
   b.  The authorization is given after the app store provider has clearly and conspicuously provided the parental consent disclosure as part of the app download, purchase, or in-app purchase process.
   c.  The authorization requires the parent to make an affirmative choice to do any of the following:
   (1)  Grant consent.
   (2)  Decline consent.
    Sec. 2.  NEW SECTION.  554J.2  App store provider requirements.
   1.  An app store provider shall do all of the following:
   a.  At the time an individual who is located in the state creates an account with the app store provider, the app store provider shall do all of the following:
   (1)  Request age category information from the individual.
   (2)  Verify the individual’s age category using any of the following:
   (a)  Commercially available methods that are reasonably designed to ensure accuracy.
   (b)  An age verification method or process that complies with rules adopted by the attorney general.
   b.  If the app store provider determines the individual is a minor, the app store provider shall do all of the following:
   (1)  Require the account to be affiliated with a parent account.
   (2)  Obtain verifiable parental consent from the holder of the affiliated parent account each time before allowing the minor to any of the following:
   (a)  Download an app.
   (b)  Purchase an app.
   (c)  Make an in-app purchase.
   c.  After receiving notice of a significant change from a developer, the app store provider shall do all of the following:
   (1)  Notify the account holder of the significant change.
   (2)  For a minor account, all of the following:
   (a)  Notify the parent account.
   (b)  Obtain renewed verifiable parental consent.
   d.  Provide to a developer, in response to a request authorized under section 554J.3, all of the following:
   (1)  Age category data for an account holder located in the state.
   (2)  The status of verifiable parental consent for a minor located in the state.
   e.  Notify a developer when a parent revokes verifiable parental consent.
   f.  Protect age category data and any associated verification data through all of the following:
   (1)  Limiting collection and processing to data necessary to all of the following:
   (a)  Verifying an account holder’s age category.
   (b)  Obtaining verifiable parental consent.
   (c)  Maintaining compliance records.
   (2)  Transmitting age category data using industry-standard encryption protocols that ensure data integrity and data confidentiality.
   2.  An app store provider shall not do any of the following:
   a.  Enforce a contract or terms of service against a minor unless the app store provider has obtained verifiable parental consent.
   b.  Knowingly misrepresent the information in the parental consent disclosure.
   c.  Share age category data and any associated data except as required by this chapter or otherwise required by law.
    Sec. 3.  NEW SECTION.  554J.3  Developer requirements.
   1.  A developer shall do all of the following:
   a.  Verify through the app store’s data sharing methods the age category data of account holders located in the state, and for a minor’s account, whether verifiable parental consent has been obtained.
   b.  Notify app store providers of a significant change to an app.
   c.  Use age category data received through the app store’s data sharing methods to do all of the following:
   (1)  Enforce any developer-created, age-related restrictions, safety-related features, or defaults.
   (2)  Ensure compliance with applicable laws and regulations.
   d.  Request age category data or verifiable parental consent at all of the following times:
   (1)  At the time an account holder downloads an app.
   (2)  At the time an account holder purchases an app.
   (3)  When implementing a significant change to the app.
   (4)  When necessitated to comply with applicable law.
   2.  A developer may request age category data at all of the following times:
   a.  No more than once during each twelve-month period to verify any of the following:
   (1)  The accuracy of age category data associated with an account holder.
   (2)  Continued account use within the age category.
   b.  When there is reasonable suspicion of any of the following:
   (1)  An account transfer.
   (2)  Misuse outside of the age category.
   c.  At the time an account holder creates a new account with the developer.
   3.  When implementing any developer-created, age-related restrictions, safety-related features, or defaults, a developer shall use the lowest age category indicated by any of the following:
   a.  Age category data received through the app store’s data sharing methods.
   b.  Age data independently collected by the developer.
   4.  A developer shall not do any of the following:
   a.  Enforce a contract or terms of service against a minor unless the developer has verified through an app store’s data sharing methods that verifiable parental consent has been obtained.
   b.  Knowingly misrepresent any information in the parental consent disclosure.
   c.  Share age category data with any person.
    Sec. 4.  NEW SECTION.  554J.4  Attorney general —— rulemaking authority.
   The attorney general shall adopt rules to establish processes and means by which an app store provider may verify an account holder’s age category as required under section 554J.2.
    Sec. 5.  NEW SECTION.  554J.5  Enforcement.
   1.  a.  A minor, or the parent of a minor, who has been harmed by a violation of this chapter may bring a civil action against an app store provider or a developer.
   b.  In an action brought under this subsection, the court shall award a prevailing plaintiff any combination of the following:
   (1)  The greater of actual damages or one thousand dollars per violation.
   (2)  Punitive damages if the violation was egregious.
   (3)  Reasonable attorney fees.
   (4)  Court costs.
   2.  a.  A violation of this chapter is an unfair practice under section 714.16 subject to the civil penalty limitation in paragraph “b”, subparagraph (1).
   b.  In addition to any other available remedy, the attorney general may bring an action against an app store provider or a developer to do any combination of the following:
   (1)  Recover a civil penalty not to exceed seven thousand five hundred dollars per violation.
   (2)  Restrain or enjoin the app store provider or developer from violating this chapter.
   (3)  Seek injunctive relief.
   (4)  Recover reasonable attorney fees.
   (5)  Recover litigation costs and the costs of investigating the violation.
    Sec. 6.  NEW SECTION.  554J.6  Safe harbor.
   1.  A developer is not liable for a violation of this chapter if the developer demonstrates that the developer did all of the following:
   a.  Relied in good faith on applicable age category data received through an app store’s data sharing methods.
   b.  Relied in good faith on notification from an app store provider that verifiable parental consent was obtained if the account holder was a minor.
   c.  Complied with the requirements described in section 554J.3.
   2.  In determining an app’s age rating and content description for purposes of section 554J.3, a developer is not liable for a violation of this chapter if the developer uses widely adopted industry standards to determine the app’s age category and content description and applies the standards consistently and in good faith.
   3.  The safe harbor described in this section applies only to actions brought under this chapter, and does not limit a developer or app store provider’s liability under any other applicable law.
   4.  Nothing in this chapter shall displace any other available remedies or rights authorized under the laws of this state or the United States.
    Sec. 7.  NEW SECTION.  554J.7  Severability.
   The provisions of this chapter are severable pursuant to section 4.12.
    Sec. 8.  NEW SECTION.  554J.8  Application and limitations.
   This chapter shall not be construed to do any of the following:
   1.  Prevent an app store provider or developer from taking reasonable measures to do any of the following:
   a.  Block, detect, or prevent distribution of any of the following to a minor:
   (1)  Unlawful material.
   (2)  Obscene material.
   (3)  Other harmful material.
   b.  Block or filter spam.
   c.  Prevent criminal activity.
   d.  Protect app store or app security.
   2.  Require an app store provider to disclose user information to a developer beyond age category data.
   3.  Allow an app store provider or developer to implement measures required by this chapter in a manner that is arbitrary, capricious, anticompetitive, or unlawful.
   4.  Require an app store provider or developer to obtain verifiable parental consent for an app that is described by all of the following:
   a.  The app provides direct access to emergency services, including any of the following:
   (1)  911.
   (2)  A crisis hotline.
   (3)  Emergency assistance services legally available to minors.
   b.  The app limits data collection to information necessary to provide emergency services in compliance with 15 U.S.C. §6501, et seq.
   c.  The app provides access without requiring any of the following:
   (1)  Account creation.
   (2)  Collection of unnecessary personal information.
   d.  The app is operated by or in partnership with any of the following:
   (1)  A government entity.
   (2)  A nonprofit organization.
   (3)  An authorized emergency service provider.
   5.  Require a developer to collect, retain, re-identify, or link any information beyond what is necessary to verify age category data as required by this chapter and collected, retained, re-identified, or linked in the developer’s ordinary course of business.
   6.  Relieve a developer of its obligation to conduct age verification as otherwise required by law. A developer may rely on age category data obtained under this chapter to the extent those signals satisfy the requirements of applicable law.
    Sec. 9.  Section 714.16, subsection 2, Code 2026, is amended by adding the following new paragraph:
   NEW PARAGRAPH.  t.  It is an unlawful practice for a person to violate chapter 554J.
    Sec. 10.  APPLICABILITY.  The following apply December 1, 2026:
   The sections of this Act enacting sections 554J.2 and 554J.3.
EXPLANATION
The inclusion of this explanation does not constitute agreement with
the explanation’s substance by the members of the general assembly.
   This bill relates to app store provider and app developer requirements concerning minor users.
   The bill defines “developer” as a person that owns or controls an app made available through an app store in the state.
   The bill also defines “account holder”, “age category”, “age category data”, “age rating”, “app”, “app store”, “app store provider”, “content description”, “knowingly”, “minor”, “minor account”, “mobile device”, “mobile operating system”, “parent”, “parent account”, “parental consent disclosure”, “significant change”, and “verifiable parental consent”.
   The bill requires an app store provider to request age category information and verify the age of an individual located in this state at the time the individual creates an account with the app store provider. If the app store provider determines the individual is a minor, the app store provider must require the account to be affiliated with a parent account and obtain verifiable parental consent from the holder of the affiliated parent account each time before allowing the minor to download an app, purchase an app, or make an in-app purchase.
   The bill requires an app store provider to provide notices and receive verifiable parental consent as described in the bill after the app store provider receives notice of a significant change from a developer.
   The bill requires an app store provider to provide age category data for an account holder and the status of verifiable parental content for a minor when a developer requests such information. The app store provider must also notify the developer when a parent revokes verifiable parental consent.
   The bill requires an app store provider to protect age category data and any associated verification data through methods described in the bill.
   The bill prohibits an app store provider from enforcing a contract or terms of service against a minor unless the app store provider has obtained verifiable parental consent, knowingly misrepresenting the information in the parental consent disclosure, or sharing age category data and any associated data except as required by the new Code chapter or otherwise required by law.
   The bill requires a developer to verify through the app store’s data sharing methods the age category data of account holders located in the state, and for a minor’s account, whether verifiable parental consent has been obtained; notify app store providers of a significant change to an app; use age category data received through the app store’s data sharing methods to perform acts detailed in the bill; and request age category data or verifiable parental consent at times detailed in the bill.
   The bill allows a developer to request age category data at times detailed in the bill.
   When implementing any developer-created, age-related restrictions, safety-related features, or defaults, the bill requires a developer to use the lowest age category as indicated by age category data received through the app store’s data sharing methods or age data independently collected by the developer.
   The bill prohibits a developer from enforcing a contract or terms of service against a minor unless the developer has verified through an app store’s data sharing methods that verifiable parental consent has been obtained, knowingly misrepresenting any information in the parental consent disclosure, or sharing age category data with any person.
   The bill requires the attorney general to adopt rules to establish processes and means by which an app store provider may verify an account holder’s age category.
   The bill allows a minor, or the parent of a minor, who has been harmed by a violation of the bill to bring a civil action against an app store provider or a developer. The court shall award a prevailing plaintiff any combination of the greater of actual damages or $1,000 per violation, punitive damages if the violation was egregious, reasonable attorney fees, and court costs.
   A violation of the bill is an unfair practice under Code chapter 714.16 (consumer fraud), punishable by disgorgement of money, return of money to a plaintiff, enjoinment of fraudulent acts, and a civil penalty of up to $7,500.
   In addition to other available remedies, the bill allows the attorney general to bring an action against an app store provider or a developer to restrain or enjoin the app store provider or developer from violating the bill, seek injunctive relief, recover reasonable attorney fees, and recover litigation costs and the costs of investigating the violation.
   A developer is not liable for a violation of the bill if the developer demonstrates that the developer relied in good faith on applicable age category data received through an app store’s data sharing methods, relied in good faith on notification from an app store provider that verifiable parental consent was obtained if the account holder was a minor, and complied with the bill’s other requirements.
   In determining an app’s age rating and content description, a developer is not liable for a violation of the bill if the developer uses widely adopted industry standards to determine the app’s age category and content description and applies the standards consistently and in good faith.
   The safe harbor described in the bill applies only to actions brought under the bill’s provisions, and does not limit a developer or app store provider’s liability under any other applicable law.
   Nothing in the bill shall displace any other available remedies or rights authorized under the laws of this state or the United States.
   The provisions of the bill are severable.
   Nothing in the bill shall be construed to prevent an app store provider or developer from taking reasonable measures against certain objectionable materials or criminal activity or otherwise protect app store or security as detailed in the bill; require an app store provider to disclose user information to a developer beyond age category data; allow an app store provider or developer to implement measures required by the bill in a manner that is arbitrary, capricious, anticompetitive, or unlawful; require an app store provider or developer to obtain verifiable parental consent for an app that is related to emergency services as described in the bill; require a developer to collect, retain, re-identify, or link any information beyond what is necessary to verify age category data as required by the bill and collected, retained, re-identified, or linked in the developer’s ordinary course of business; or relieve a developer of its obligation to conduct age verification, as otherwise required by law. A developer may rely on age category data obtained under the bill to the extent those signals satisfy the requirements of applicable law.
   The bill makes a conforming change to Code section 714.16.
   The bill’s provisions creating requirements for app store providers and developers apply December 1, 2026.