Read the full stored bill text
As Amended by House Committee
{As Amended by Senate Committee of the Whole}
As Amended by Senate Committee
Session of 2026
SENATE BILL No. 372
By Committee on Judiciary
1-22
AN ACT concerning consumer protection; enacting the app store
accountability act; regulating app store and developer operations with
respect to minors; creating requirements for age verification and
parental consent; providing for enforcement under the Kansas
consumer protection act; creating a private cause of action for
violations of the act.
Be it enacted by the Legislature of the State of Kansas:
Section 1. (a) The provisions of sections 1 through 9, and
amendments thereto, shall be known and may be cited as the app store
accountability act.
(b) The provisions of this section shall be effective on and after
January 1, 2027.
Sec. 2. (a) As used in sections 1 through 9, and amendments thereto:
(a)(1) "Account holder" means the individual who is associated with
the mobile device { and creates or maintains an account with an app
store provider}.
(b)(2) "Age category" means one of the following categories of
individuals based on age:
(1)(A) "Child" means an individual who is under 13 years of age;
(2)(B) "younger teenager" means an individual who is at least 13
years of age and less than 16 years of age;
(3)(C) "older teenager" means an individual who is at least 16 years
of age and less than 18 years of age; and
(4)(D) "adult" means an individual who is at least 18 years of age.
(c)(3) "Age category data" means information about an account
holder's age category that is collected by an app store provider and shared
with a developer.
(d)(4) "Age rating" means one or more classifications that assess the
suitability of an app's content and functions for different age groups.
(e)(5) "App" means a software application or electronic service that a
user may run or direct on a mobile device, including pre-installed
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
SB 372—Am. by HC 2
applications.
(f)(6) "App store" means a publicly available website, software
application or electronic service that allows account holders to download
apps from third-party developers onto a mobile device.
(g)(7) "App store provider" means a person that owns, operates or
controls an app store that allows account holders located in this state to
download apps onto a mobile device.
(h)(8) "Commercially available method" means a method that
includes affirmative age attestation for minors by someone who is
reasonably believed to be a parent or legal guardian and requires other
information collected in the ordinary course of account creation or use.
(9) "Content description" means a description of the specific content
elements or functions that informs an app's age rating.
(i)(10) "Developer" means a person that owns or controls an app
made available through an app store or a pre-installed application.
(j)(11) "In-app purchase" means a charge associated with any user
conduct within an app and billed by an app store, including, but not
limited to, the acquisition of virtual currency, digital goods, digital
services or other apps.
(12) "Minor" means an individual under 18 years of age unless the
individual is married or legally emancipated.
(k)(13) "Minor account" means an account with an app store provider
that is established by an individual who is a minor.
(l)(14) "Mobile device" means a phone or general-purpose tablet that:
(1)(A) Provides cellular or wireless connectivity;
(2)(B) is capable of connecting to the internet;
(3)(C) runs a mobile operating system; and
(4)(D) is capable of running apps through such mobile operating
system.
(m)(15) "Mobile operating system" means software that:
(1)(A) Manages mobile device hardware resources;
(2)(B) provides common services for mobile device programs;
(3)(C) controls memory allocation; and
(4)(D) provides interfaces for apps to access device functionality.
(n)(16) "Parent" means, with respect to a minor, an individual who is
reasonably believed to be a parent, legal guardian, individual with legal
custody or any other individual who has the legal authority to make
decisions on behalf of the minor under applicable state law.
(o)(17) "Parent account" means an account with an app store provider
that:
(1)(A) Is verified to be established by an individual who the app store
provider has determined through the app store provider's age verification
methods is at least 18 years of age, married or legally emancipated; and
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
SB 372—Am. by HC 3
(2)(B) may be affiliated with one or more minor accounts.
(p)(18) "Parental consent disclosure" means the following
information that an app store provider is required to clearly and
conspicuously provide to the holder of a parent account prior to obtaining
parental consent:
(1)(A) The age rating of the app or in-app purchase, if any such age
rating exists;
(2)(B) the content description of the app or in-app purchase, if any
such description exists;
(3)(C) a description of the personal data:
(A)(i) Collected by the app from an account holder; and
(B)(ii) shared by the app with a third party; and
(4)(D) the methods implemented by the developer to protect the
personal data if such personal data is collected.
(q)(19) "Pre-installed applications" means any app, or portion thereof,
that is present on a mobile device at the time of purchase, initial activation
or first use by the consumer, including browsers, search engines and
messaging but excluding core operating system functions, essential device
drivers and applications necessary for basic device operation such as
phone, settings and emergency services applications. "Pre-installed
applications" includes apps, or portions thereof, installed or partially
installed by the device manufacturer, wireless service provider, retailer or
any other party prior to purchase, initial activation or first use by the
consumer and which may be updated thereafter.
(r)(20) "Significant change" means a material modification to an
app's terms of service or privacy policy that materially:
(1)(A) Changes the categories of data collected, stored or shared;
(2)(B) alters the app's age rating or content descriptions; or
(3)(C) introduces:
(A)(i) In-app purchases where no in-app purchases were previously
present; or
(B)(ii) advertisements where no advertisements were previously
present in the app.
(s)(21) "Verifiable parental consent" means authorization that:
(1)(A) Is provided by a parent account;
(2)(B) is given after the app store provider has clearly and
conspicuously provided the parental consent disclosure as part of the app
download, purchase or in-app purchase process; and
(3)(C) requires the parent account holder to make an affirmative
choice to grant or decline consent.
(b) The provisions of this section shall be effective on and after
January 1, 2027.
Sec. 3. (a) At the time an individual who is located in this state
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
SB 372—Am. by HC 4
creates an account with an app store provider, or by December 31, 2026,
for accounts created prior to July 1, 2026, such app store provider shall:
(1) Request age category information from the individual; and
(2) verify the individual's age category using:
(A) Commercially available methods that are reasonably designed to
ensure accuracy; or
(B) an age verification method that complies with rules and
regulations adopted by the attorney general.
(b) If an app store provider determines an account has been created
by a minor, such app store provider shall:
(1) Require that such account be affiliated with a parent account; and
(2) obtain verifiable parental consent from the holder of the affiliated
parent account each time before allowing the minor to:
(A) Download an app;
(B) purchase an app; or
(C) make an in-app purchase.
(c) Upon receiving notice of a significant change in an app from a
developer, an app store provider shall notify the account holder of such
significant change, and, if the account holder is a minor, such app store
providers shall notify the holder of the affiliated parent account and obtain
verifiable parental consent before providing renewed access to the
significantly changed version of such app.
(d) Upon receipt of a request made pursuant to section 4, and
amendments thereto, including requests made for pre-installed
applications, an app store provider shall provide the requesting developer
age category data for the specified account holder and the status of
verifiable parental consent for the specified minor account. Upon request
by the developer, an app store provider shall take reasonable measures to
facilitate verifiable parental consent for use of a pre-installed application.
(e) An app store provider shall provide a mechanism for the holder of
a parent account to withdraw parental consent. If parental consent is
withdrawn, the app store provider shall notify the appropriate developer of
such withdrawal.
(f) An app store provider shall protect age category data and any
associated verification data by:
(1) Limiting collection and processing to data necessary for:
(A) Verifying an account holder's age category;
(B) obtaining verifiable parental consent; and
(C) maintaining compliance records , which shall not include copies
of identification documents, biometric identifiers, verification data or
other personally identifiable information collected solely for the
purpose of age verification; and
(2) transmitting age category data using industry-standard encryption
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
SB 372—Am. by HC 5
protocols that ensure data integrity and data confidentiality; and
(3) deleting or destroying any personally identifiable information
or verification data collected for the purpose of verifying an account
holder's age category pursuant to this act immediately after the age
verification process is completed and shall not retain, use, process or
disclose such information for any other purpose.
(g) An app store provider shall not:
(1) Enforce contract terms or terms of service against a minor unless
the app store provider has obtained verifiable parental consent;
(2) knowingly misrepresent the information in the parental consent
disclosure; or
(3) share age category data or any associated data except as required
by sections 1 through 8, and amendments thereto, or as otherwise required
by law; or
(4) use, retain or disclose any personally identifiable information
collected for verifying an account holder's age category use
information collected for advertising, behavior targeting profiling,
data brokerage or other commercial monetizations.
(h) An app store provider shall provide each developer the option
to direct the app store provider to prevent downloads of the
developer's application by users based on the age of the user as
determined by the app store provider.
(i) The provisions of this section shall be effective on and after
January 1, 2027.
Sec. 4. (a) A developer shall:
(1) Submit a request to the app store provider to verify , through the
app store's data sharing methods, the age category data of account
holders located in this state and, for a minor account, whether verifiable
parental consent has been obtained when:
(A) An account holder:
(i) Downloads an app;
(ii) purchases an app; or
(iii) launches a pre-installed application for the first time;
(B) implementing a significant change to an app; or
(C) necessary to comply with applicable law;
(2) notify app store providers of when there is a significant change to
an app; and
(3) use age category data received from an app store provider to:
(A) Enforce any developer-created, age-related restrictions, safety-
related features or defaults; and
(B) ensure compliance with applicable laws and rules and regulations.
(b) (1) A developer may request age category data:
(A) When there is reasonable suspicion of:
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
SB 372—Am. by HC 6
(i) Account transfer; or
(ii) misuse outside of the age category; or
(B) at the time an account holder creates a new account with the
developer.
(2) A developer shall not request age category data more than once
during each 12-month period when verifying the accuracy of age category
data associated with an account holder or continued account use within the
age category.
(c) When implementing any developer-created, age-related
restrictions, safety-related features or defaults, a developer shall use the
lowest age category indicated by:
(1) Age category data received from an app store provider; or
(2) age data independently collected by the developer may rely on an
assessment of the age category of an individual that is different from
the signal provided by the app store provider if the developer
possesses clear and convincing evidence that the assessment of the age
category is of greater accuracy than the signal provided by the app
store provider. A developer bears the burden of producing clear and
convincing evidence that an assessment of the age of an individual is
more accurate than the signal provided by an app store provider.
(d) A developer shall not:
(1) Enforce a contract or terms of service against a minor unless the
developer has verified with the app store provider that verifiable parental
consent has been obtained;
(2) knowingly misrepresent any information in the parental consent
disclosure; or
(3) share age category data with any person except as permitted by
law.
(e) The provisions of this section shall be effective on and after
January 1, 2027.
Sec. 5. On or before October 1, 2026 January 1, 2027 , the attorney
general shall adopt rules and regulations to establish age verification
methods that app store providers may use to verify an account holder's age
category in accordance with section 3, and amendments thereto.
Sec. 6. (a) (1) A violation of section 3 or 4, and amendments thereto,
is an unconscionable act and practice under the Kansas consumer
protection act. For purposes of the remedies and penalties provided by the
Kansas consumer protection act:
(1)(A) The person alleging a violation of section 3 or 4, and
amendments thereto, shall be deemed a consumer, and the app store
provider or developer that violates such section shall be deemed the
supplier; and
(2)(B) proof of a consumer transaction shall not be required.
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
SB 372—Am. by HC 7
(2) Nothwithstanding any provision of the Kansas consumer
protection act to the contrary, only the attorney general or the
attorney general's designee may bring a civil action alleging a
violation of the Kansas consumer protection act pursuant to this
section. This section shall not be construed as creating or allowing a
private right of action under K.S.A. 50-634, and amendments thereto.
(b) A minor, or the parent of a minor, who has been harmed by a
violation of section 3 or 4, and amendments thereto, may bring a civil
action against an app store provider or a developer. Notwithstanding the
provisions of K.S.A. 50-634 and 50-636, and amendments thereto, a
person bringing such action may seek the following relief:
(1) The greater of actual damages or $1,000 for each violation;
(2) punitive damages if the violation was egregious; and
(3) reasonable attorney fees and costs of the action.
(c) The attorney general may investigate any alleged violation of
section 3 or 4, and amendments thereto, and may bring an action for
injunctive relief to enjoin any continuing violation. In addition to any
injunctive relief, such action may also seek to impose a civil penalty of not
less than $7,500 for each such violation instead of the penalty provided for
in K.S.A. 50-636(a), and amendments thereto, and reasonable attorney
fees and the costs of the action.
(d)(c) Nothing in this section shall preclude any other available
remedies or rights authorized under state or federal law.
(d) The provisions of this section shall be effective on and after
January 1, 2027.
Sec. 7. (a) A developer shall not be liable for a violation of section 4,
and amendments thereto, if the developer demonstrates that the developer:
(1) Relied in good faith on applicable age category data received
from an app store provider;
(2) relied in good faith on notification from an app store provider that
verifiable parental consent was obtained if the account holder was a minor;
and
(3) complied with the requirements of section 4, and amendments
thereto.
(b) In determining an app's age rating and content description for
purposes of section 4, and amendments thereto, a developer shall not be
liable for a violation of section 4, and amendments thereto, if the
developer:
(1) Uses widely adopted industry standards to determine the app's age
category and content description; and
(2) applies such standards consistently and in good faith.
(c) The provisions of this section only apply to actions brought
pursuant to section 6, and amendments thereto, and shall not limit the
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
SB 372—Am. by HC 8
liability of any developer or app store provider under any other applicable
state or federal law.
(d) The provisions of this section shall be effective on and after
January 1, 2027.
Sec. 8. Nothing in sections 1 through 7, and amendments thereto,
shall be construed to:
(a) Prohibit an app store provider or developer from taking
reasonable measures to:
(1) Block, detect or prevent the distribution of the following to
minors:
(A) Unlawful material;
(B) obscene material; or
(C) other harmful material;
(2) block or filter spam;
(3) prevent criminal activity; or
(4) protect an app store or app security;
(b) require an app store provider to disclose user information to a
developer other than age category data or status of parental consent;
(c) require a developer, digital service provider or app store
provider to disclose personal ly identif iable information to another
entity except as necessary to comply with this act or as otherwise
required by law;
(d) allow an app store provider or developer to implement any
measures required by sections 1 through 7, and amendments thereto, in a
manner that is arbitrary, capricious, anticompetitive or unlawful;
(d)(e) require a developer to collect, retain, reidentify or link any
information, except information that is:
(1) Necessary to verify age category data as required by section 4,
and amendments thereto; and
(2) collected, retained, reidentified or linked in the developer's
ordinary course of business; or
(e)(f) require an app store provider or developer to block access to an
app that an account holder has downloaded or installed onto a mobile
device prior to July 1, 2026, except access to such app shall be blocked if:
(1) The verifiable parental consent for an affiliated minor account has
been withdrawn; or
(2) there has been a significant change to the app; or
(g) require the submission of government-issued identification of
any individual to an app store provider.
(f)(h) The provisions of this section shall be effective on and after
January 1, 2027.
Sec. 9. (a) Sections 1 through 8, and amendments thereto, are
declared severable. Any provision of sections 1 through 8, and
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
SB 372—Am. by HC 9
amendments thereto, or the application thereof to any person or
circumstance that is held to be unconstitutional or invalid shall not affect
the validity of any remaining provisions of sections 1 through 8, and
amendments thereto, or the applicability of such provisions to any person
or circumstance.
(b) The provisions of this section shall be effective on and after
January 1, 2027.
Sec. 10. This act shall take effect and be in force from and after its
publication in the statute book.
1
2
3
4
5
6
7
8
9