For two years, the App Store Accountability Acts read like someone else’s problem. They named “app store providers” — Apple and Google — as the parties who had to check ages and broker parental consent. If you shipped an app, the comfortable assumption was that the platforms would handle it and pass you a signal.
That assumption ran out of road in the last week of May 2026. On 28 May, the Fifth Circuit stayed the district court injunction that had blocked Texas SB 2420, letting the law take effect while the appeal plays out. A month later, on 1 July 2026, Louisiana’s HB 570 goes live as the third state app store law on the books. Read the actual text of either statute and the same fact jumps out: the obligations don’t stop at the store layer. They reach the developer.
If you build mobile apps that touch minors — and “touch minors” is a much wider net than most teams assume — you are now a regulated party in at least two states, with more queued behind them.
What the Texas and Louisiana Laws Actually Say
Start with Texas SB 2420, because it sets the template. The law requires app stores to verify a user’s age category at account creation and sort every user into one of four buckets: children under 13, younger teens aged 13 to 15, older teens aged 16 to 17, and adults 18 and over. If the store determines a user is a minor, it must require that account to be linked to a verified parent or guardian account and obtain parental consent before that minor can download an app, purchase an app, or make an in-app purchase.
So far that sounds like an Apple-and-Google problem. It isn’t. SB 2420 also imposes duties directly on developers: you must request the age category data the store makes available, treat users according to that category, and obtain verifiable parental consent before collecting a minor’s personal data or making significant changes to your app’s data practices for that minor. The store supplies the age signal; the developer is responsible for acting on it correctly inside the app.
Louisiana HB 570 follows the same architecture and arguably tightens the developer side. It requires app store providers to request age information at account creation, verify it through reliable methods, and tie minor accounts to a parent account. But it also requires developers to verify user ages and obtain verifiable parental consent before allowing minors to download or transact. Two independent verification duties, two independently liable parties, one user.
The pattern is deliberate. Lawmakers watched the social media age laws get litigated into a stalemate and concluded that putting the duty at a single chokepoint was too easy to challenge and too easy to evade. By splitting the obligation between the store and the developer, they built redundancy into the regime — and doubled the number of companies that can be found in breach.
The Litigation Status, Without the Spin
It’s worth being precise about where these laws stand, because the legal posture changes what you should do, not whether you should do it.
A federal district judge in Austin enjoined Texas SB 2420 in December 2025, days before its 1 January 2026 effective date, writing that its restrictions likely violated the First Amendment by burdening a large amount of protected online speech. Apple paused its announced Texas changes in response. Then, on 28 May 2026, the Fifth Circuit issued a stay of that injunction, allowing the state to enforce the law during the appeal.
Here is the part that matters: the Fifth Circuit’s order is not a ruling on the merits. The court did not decide whether SB 2420 is constitutional, whether its requirements are properly tailored, or whether Texas has the authority to regulate app stores this way. It decided only that the law can operate while those questions are litigated. That means the obligation is live and enforceable today, even though the constitutional fight is unresolved and could still flip.
Utah, the first state to pass an App Store Accountability Act, took a different path: lawmakers amended it during the 2026 session to delay full implementation to 2027 and make it enforceable only through private lawsuits, after which the industry group representing Apple and Google withdrew its challenge. So the live, government-enforced obligations right now are Texas and, from 1 July, Louisiana — with Utah’s private-action version and a long line of copycat bills behind them.
For a compliance-minded operator, the lesson from the Texas whiplash is not “wait for the courts.” It’s that effective dates and injunctions can swing on a single appellate order with days of notice. A capability you can switch on per-jurisdiction is worth far more than a legal bet on any one outcome.
“Apple Will Handle It” Is Not a Compliance Strategy
The most expensive misreading of these laws is treating the platform’s age signal as the end of your obligation. Three problems break that assumption.
First, the statutes name developers as independently responsible. If a minor downloads your app and you collect their data without honoring the age category and consent state the store exposes, the platform handling its own duty does not discharge yours. You are a separate regulated party with separate exposure.
Second, the platform signal is coarse and you don’t control its accuracy. SB 2420’s four-bucket model tells you roughly which side of 13, 16, and 18 a user falls on. It does not tell you whether that classification is reliable for your risk profile, and you inherit the consequences of its errors — both the under-13 who slips through and the adult who gets wrongly gated and churns. You are accountable for the outcome inside your app regardless of how good or bad the upstream signal is.
Third, the laws are not uniform and the platform abstraction is leaky. Texas, Louisiana, and Utah differ on effective dates, enforcement mechanisms, and exactly what developers must verify themselves. A single store-provided flag does not encode “verifiable parental consent obtained under Louisiana HB 570 for a 14-year-old” versus “age category returned by the Texas app store API.” If you’re relying solely on the platform, you have no independent record to show a regulator that you met your obligation.
The practical conclusion is that developers need their own verification and consent layer that sits alongside the store signal — consuming it where useful, but capable of producing a defensible, jurisdiction-aware decision and an audit trail the developer actually owns.
Who’s Actually In Scope
Teams routinely assume these laws are about games and social apps. The scope is wider. SB 2420 and HB 570 attach to app stores and the developers who distribute through them, with parental-consent triggers keyed to minors and to data collection — not to any particular content vertical. A productivity app, a fitness tracker, an e-commerce app, or an AI assistant that collects personal data from a 15-year-old is squarely in the frame.
If any of the following is true, you should be treating yourself as in scope: you distribute through the Apple App Store or Google Play to users in Texas or Louisiana; you collect personal data from users who may be minors; you process in-app purchases; or you make “significant changes” to how you handle a minor’s data. The content of your app is almost beside the point. The trigger is minors plus data plus transactions.
What To Ship Before July 1
With Texas live and Louisiana days away, here is the build order that maps to the statutory duties rather than to platform marketing.
Consume the age category, but don’t trust it blindly. Integrate the store-provided age signal where available, and design your app’s gating logic around the four-category model so it degrades gracefully whether the signal is present, stale, or missing. Treat the store flag as an input to your decision, not the decision itself.
Stand up an independent verification path. You need your own age-assurance step that you control and can document — one that returns an age decision without forcing every user to surrender a government ID, and that escalates to stronger checks only for the ambiguous band around 13, 16, and 18. This is what protects you when the platform signal is absent or wrong, and it is the only way to satisfy Louisiana’s direct developer-verification duty.
Build verifiable parental consent as a first-class flow. For users in a minor category, you must capture and record genuine parental consent before collecting data or processing purchases — not a checkbox the child can tap. That means a real parent-linkage step, a durable consent record, and the ability to re-verify when your data practices materially change.
Make it per-jurisdiction and switchable. Texas is live, Louisiana lands 1 July, Utah arrives in 2027 with a private right of action, and the next wave of bills is already moving. Hard-coding one state’s rules guarantees rework. Treat jurisdiction as configuration so you can enable, disable, or adjust obligations as effective dates and injunctions move — because, as Texas just demonstrated, they move fast.
Keep an audit trail you own. When an enforcement inquiry arrives, “the app store told us they were an adult” is not a defense to your own statutory duty. Persist the age decision, the method used, the consent state, and the jurisdiction logic applied — a record that demonstrates you met your obligation, independent of the platform.
Where Xident Fits
This is the exact problem Xident is built for. We give developers an age-assurance and parental-consent layer they own — not a dependency on whatever the store decides to expose. A single integration returns an age decision through a privacy-preserving waterfall: light signals and on-device estimation for the clear cases, escalating to document or credential checks only for the uncertain band around each threshold, and never forcing a government ID where the law requires an alternative.
Because the decision is bound to a reusable, token-based credential rather than re-derived from scratch on every session, you get the durable, jurisdiction-aware audit trail these laws expect — the record that proves the developer met the developer’s duty in Texas or Louisiana, regardless of what the platform did upstream. Verifiable parental consent, age-category gating, and per-jurisdiction configuration come out of the same flow, so you can switch obligations on as states go live instead of rebuilding for each one.
The App Store Accountability era stopped being theoretical on 28 May. The companies that treat it as a platform problem will discover, the hard way, that the statutes named them too. The ones that build their own verification and consent layer now will be ready for July 1 — and for the dozen states lining up behind it.
Building age verification or parental consent into your app ahead of the July 1 deadline? Talk to our team about a developer-owned compliance layer for the App Store Accountability Acts.
