AN ACT relating to online protections for minors.

UNOFFICIAL COPY 26 RS BR 1283
Page 1 of 9
XXXX 2/12/2026 12:02 PM Jacketed
AN ACT relating to online protections for minors. 1
Be it enacted by the General Assembly of the Commonwealth of Kentucky: 2
SECTION 1. A NEW SECTION OF KRS CHAPTER 367 IS CREATED TO 3
READ AS FOLLOWS: 4
As used in Sections 1 to 6 of this Act: 5
(1) "Age category" means a category of an individual based on age, including child, 6
younger teenager, older teenager, and adult. As used in this subsection: 7
(a) "Child" means an individual who is younger than thirteen (13) years old; 8
(b) "Younger teenager" means an individual who is thirteen (13) to fifteen (15) 9
years old; 10
(c) "Older teenager" means an individual who is sixteen (16) or seventeen (17) 11
years old; and 12
(d) "Adult" means an individual who is eighteen (18) years of age or older; 13
(2) "Age category data" means information about a user's age category that is 14
collected by an app store provider and shared with a developer; 15
(3) "Age rating" means a classification that provides an assessment of the suitability 16
of an app's content for different age groups; 17
(4) "App" means a software application or electronic service that a user may run or 18
direct on a mobile device; 19
(5) "App store" means a publicly available website, software application, or 20
electronic service that distributes apps from third-party developers to users; 21
(6) "App store provider" means a person that owns, operates, or controls an app 22
store that distributes apps to users; 23
(7) "Content description" means a description of the specific content elements that 24
informed an app's age rating; 25
(8) "Developer" means a person that owns or controls an app made available 26
through an app store; 27
UNOFFICIAL COPY 26 RS BR 1283
Page 2 of 9
XXXX 2/12/2026 12:02 PM Jacketed
(9) "Minor" means an individual under eighteen (18) years old; 1
(10) "Minor account" means an account with an app store provider that: 2
(a) Is established by an individual younger than eighteen (18) years old as 3
determined by the app store provider's age verification methods; and 4
(b) Requires affiliation with a parent account; 5
(11) "Mobile device" means a portable computing device that: 6
(a) Provides cellular or wireless connectivity; 7
(b) Is capable of connecting to the internet; 8
(c) Runs a mobile operating system; and 9
(d) Is capable of running apps through the mobile operating system; 10
(12) "Mobile operating system" means software that: 11
(a) Manages mobile device hardware resources; 12
(b) Provides common services for mobile device programs; 13
(c) Controls memory allocation; and 14
(d) Provides interfaces for applications to access device functionality; 15
(13) "Office" means the Office of Consumer Protection in the Offic e of the Attorney 16
General; 17
(14) "Parent" means an adult who has legal authority to make decisions on behalf of 18
a minor; 19
(15) "Parent account" means an account with an app store provider that: 20
(a) Is verified to be established by an individual at least eigh teen (18) years old 21
as determined by the app store provider's age verification methods; and 22
(b) May be affiliated with one (1) or more minor accounts; 23
(16) "Parental consent disclosure" means information that an app store provider is 24
required to provide to a parent before obtaining parental consent, and includes: 25
(a) The age rating of the app or in-app purchase, if one exists; 26
(b) The content description of the app or in-app purchase, if one exists; and 27
UNOFFICIAL COPY 26 RS BR 1283
Page 3 of 9
XXXX 2/12/2026 12:02 PM Jacketed
(c) A description of: 1
1. The personal data the app collects; 2
2. The personal data the app shares with a third party; and 3
3. The method used to protect the personal data the app collects; 4
(17) "Significant change" means a material modification to an app's terms of service 5
or privacy policy that: 6
(a) Changes the categories of data collected, stored, or shared; 7
(b) Alters the app's age rating or content descriptions; 8
(c) Adds new monetization features, including in -app purchases or 9
advertisements; or 10
(d) Materially changes the app's functionality or user experience; and 11
(18) "Verifiable parental consent" means authorization that: 12
(a) Is provided by an individual verified as an adult by the app store provider's 13
age verification methods; 14
(b) Is given after the app store provider has clearly and conspicuously provided 15
the parental consent disclosure to the individual; and 16
(c) Requires the parent to make an affirmative choice to grant or decline 17
consent. 18
SECTION 2. A NEW SECTION OF KRS CHAPTER 367 IS CREATED TO 19
READ AS FOLLOWS: 20
(1) An app store provider shall: 21
(a) At the time an individual located in the Commonwealth creates an account 22
with the app store provider: 23
1. Request age information from the individual; and 24
2. Verify the individual's age using: 25
a. Commercially available methods that are reasonably designed to 26
ensure accuracy; or 27
UNOFFICIAL COPY 26 RS BR 1283
Page 4 of 9
XXXX 2/12/2026 12:02 PM Jacketed
b. An age verification method or process that complies with the 1
administrative regulations promulgated by the office under 2
subsection (3) of this section; 3
(b) If the age verification method or process described in paragraph (a) of this 4
subsection determines the individual is a minor: 5
1. Require the account to be affiliated with a parent account; and 6
2. Obtain verifiable parental consent from the holder of the affiliated 7
parent account before allowing the minor to: 8
a. Download any app; 9
b. Purchase any app; or 10
c. Make any in-app purchase; 11
(c) After receiving notice of any significant change from a developer: 12
1. Notify the user of any significant change; and 13
2. For a minor account: 14
a. Notify the holder of the affiliated parent account of the 15
significant change; and 16
b. Obtain renewed verifiable parental consent; 17
(d) Provide to a developer, in response to a re quest authorized under Section 3 18
of this Act: 19
1. Age category data for a user located in the Commonwealth; and 20
2. The status of verified parental consent for a minor located in the 21
Commonwealth; 22
(e) Notify a developer when a parent revokes parental consent; and 23
(f) Protect personal age verification data by: 24
1. Limiting collection and processing to data necessary for: 25
a. Verifying a user's age; 26
b. Obtaining parental consent; or 27
UNOFFICIAL COPY 26 RS BR 1283
Page 5 of 9
XXXX 2/12/2026 12:02 PM Jacketed
c. Maintaining compliance records; and 1
2. Transmitting personal age verification data using industry standard 2
encryption protocols that ensure data integrity and data 3
confidentiality. 4
(2) An app store provider shall not: 5
(a) Enforce a contract or terms of service against a minor unless the app store 6
provider has obtained verifiable parental consent; 7
(b) Knowingly misrepresent the information in the parental consent disclosure; 8
or 9
(c) Share personal age verification data except: 10
1. Between an app store provider and a developer as required by Sections 11
1 to 6 of this Act; or 12
2. As otherwise required by law. 13
(3) The office shall promulgate administrative regulations in accordance with KRS 14
Chapter 13A to establish the processes and means by which an app store provider 15
may verify whether an account holder is a minor in accordance with 16
subsection(1)(a)2.b. of this section. 17
SECTION 3. A NEW SECTION OF KRS CHAPTER 367 IS CREATED TO 18
READ AS FOLLOWS: 19
(1) A developer shall: 20
(a) Verify through the app store's data-sharing methods: 21
1. The age category of any users located in the Commonwealth; and 22
2. For a minor account, whether verifiable parental consent has been 23
obtained; 24
(b) Notify app store providers of a significant change to the app; 25
(c) Only use age category data received from an app store or other entity to: 26
1. Enforce age-related restrictions and protections; 27
UNOFFICIAL COPY 26 RS BR 1283
Page 6 of 9
XXXX 2/12/2026 12:02 PM Jacketed
2. Ensure compliance with applicable laws and regulations; or 1
3. Implement safety-related features or defaults; and 2
(d) Request personal age verification data or parental consent: 3
1. At the time a user downloads or purchases an app; 4
2. When implementing a significant change to the app; or 5
3. To comply with any applicable federal or state law or regulation. 6
(2) A developer may request personal age verification data or parental consent: 7
(a) No more than once during each one (1) year period to verify accuracy of 8
user age data and continued account use within the verified age category, 9
except as provided in paragraph (b) of this subsection; 10
(b) When there is reasonable suspicion of account transfer or misuse outside 11
the verified age category; or 12
(c) At the time a user creates a new account with the developer. 13
(3) A developer shall not: 14
(a) Enforce a contract or terms of service against a minor unless the developer 15
has verified through the app store that verifiable parental consent has been 16
obtained; 17
(b) Knowingly misrepresent any information in the parental consent disclosure; 18
or 19
(c) Share age category data with any person. 20
SECTION 4. A NEW SECTI ON OF KRS CHAPTER 367 IS CREATED TO 21
READ AS FOLLOWS: 22
(1) A violation of Section 2 or 3 of this Act shall be deemed an unfair, false, 23
misleading or deceptive act or practice in the conduct of trade or commerce in 24
violation of KRS 367.170. 25
(2) All of the rem edies, powers, and duties provided to the Attorney General or any 26
other person under KRS 367.110 to 367.300, and the penalties provided in KRS 27
UNOFFICIAL COPY 26 RS BR 1283
Page 7 of 9
XXXX 2/12/2026 12:02 PM Jacketed
367.990, pertaining to acts and practices declared unlawful by KRS 367.170, shall 1
apply with equal force and effect to a violation of Section 2 or 3 of this Act. 2
(3) This section shall not be construed to limit or restrict the powers, duties, 3
remedies, or penalties available to the Attorney General, the Commonwealth, or 4
any other person under any other statutory or common law. 5
(4) Any parent of a minor injured by a violation of Section 2 or 3 of this Act, shall 6
have a civil cause of action in Circuit Court to: 7
(a) Enjoin further violations; 8
(b) Recover actual damages sustained or up to one thousand dollars ($1,000) 9
for each violation, whichever is greater; and 10
(c) Recover the costs of the action, including reasonable attorney's fees. 11
SECTION 5. A NEW SECTION OF KRS CHAPTER 367 IS CREATED TO 12
READ AS FOLLOWS: 13
(1) A developer is not liable for a viola tion of Section 3 of this Act if the developer 14
demonstrates that the developer: 15
(a) Relied in good faith on: 16
1. Personal age verification data provided by an app store provider; and 17
2. Notification from an app store provider that verifiable parental 18
consent was obtained if the personal age verification data indicates 19
that the user is a minor; and 20
(b) Complied with the requirements in Section 3 of this Act. 21
(2) Notwithstanding subsection (1) of this section, the safe harbor described in this 22
section: 23
(a) Applies only to actions brought under Sections 1 to 6 of this Act; and 24
(b) Does not limit a developer or app store provider's liability under any other 25
applicable law. 26
(3) Sections 1 to 6 of this Act shall not displace any other available remedies or rights 27
UNOFFICIAL COPY 26 RS BR 1283
Page 8 of 9
XXXX 2/12/2026 12:02 PM Jacketed
authorized under the laws of this Commonwealth or the United States. 1
SECTION 6. A NEW SECTION OF KRS CHAPTER 367 IS CREATED TO 2
READ AS FOLLOWS: 3
Sections 1 to 6 of this Act shall not be construed to: 4
(1) Prevent an app store provider from taking reasonable measures to: 5
(a) Block, detect, or prevent distribution of unlawful, obscene, or harmful 6
material; 7
(b) Block or filter spam; 8
(c) Prevent criminal activity; or 9
(d) Protect the app or app store security; 10
(2) Require an app store provider to disclose user information to a developer beyond 11
age category or verification of parental consent status; 12
(3) Allow an app store provider to implement measures required by Section 2 of this 13
Act in a manner that is arbitrary, capricious, anticompetitive, or unlawful; 14
(4) Require an app store provider to obtain parental consent for an app that: 15
(a) Provides direct access to emergency services, including 911, crisis hotlines, 16
or any other emergency assistance services legally available to minors; 17
(b) Limits data collection to information necessary to provide emergency 18
services in compliance with the Children's Online Privacy Protection Act of 19
1998, 15 U.S.C. sec. 6501 et seq.; 20
(c) Provides access without requiring account creation or collection of 21
unnecessary personal information; or 22
(d) Is operated by or in partnership with an authorized emergency service 23
provider, government entity, or nonprofit organization; or 24
(5) Require a deve loper to collect, retain, reidentify, or link any information beyond 25
what is: 26
(a) Necessary to verify age categories and parental consent status as required 27
UNOFFICIAL COPY 26 RS BR 1283
Page 9 of 9
XXXX 2/12/2026 12:02 PM Jacketed
under Sections 2 and 3 of this Act; and 1
(b) Collected, retained, reidentified, or linked in the developer's ordinary course 2
of business. 3
Section 7. If any provision of this Act or the application thereof to any person 4
or circumstance is held invalid, the invalidity shall not affect other provisions or 5
applications of the Act that can be given effect without the invalid provision or 6
application, and to this end the provisions of this Act are severable. 7
Section 8. By December 1, 2026, the Office of Consumer Protection in the 8
Office of the Attorney General shall promulgate administrative regulations in accordance 9
with KRS 13A.200 to establish the processes and means by which an app store provider 10
may verify whether an account holder is a minor under subsection (1)(a)2.b. of Section 2 11
of this Act. 12
Section 9. Sections 1 to 8 of this Act take effect December 1, 2026. 13