Read the full stored bill text
As Introduced
136th
General Assembly
Regular
Session
H. B. No. 302
2025-2026
Representatives Workman, Plummer
To
enact
sections
1349.07
,
1349.071, 1349.072, 1349.073, 1349.074, 1349.075, and 1349.076
of the Revised Code
to
establish age verification and parental consent requirements for
certain developers and application stores.
BE
IT ENACTED BY THE GENERAL ASSEMBLY OF THE STATE OF OHIO:
Section
1.
That
sections
1349.07
,
1349.071, 1349.072, 1349.073, 1349.074, 1349.075, and 1349.076
of the Revised Code be enacted to read as follows:
Sec.
1349.07.
As
used in sections 1349.07 to 1349.076 of the Revised Code:
(A)
"Adult" means an account holder who is or is estimated to
be eighteen years of age or older.
(B)
"Age category" means one of the following categories based
on age:
(1)
Minor;
(2)
Adult.
(C)
"Age signal" means a signal that indicates an account
holder's age category and the methods by which that information has
been assured, which the account holder or the account holder's parent
has agreed to share.
(D)
"Application" means a software program distributed through
an application distribution provider and that is designed to be run
on a connected device and to perform, or to help the user perform, a
specific task on the connected device. "Application" does
not include web sites, internet browser extensions, or software with
a primary purpose of extending the functionality of an internet
browser.
(E)
"Application distributor" means a software application that
distributes applications from developers to users of a connected
device. "Application distributor" does not include internet
browsers.
(F)
"Application distribution provider" means a person that
owns, operates, or controls an application distributor.
(G)
"Connected device" means a smartphone, tablet, gaming
console, or virtual reality device that enables users to connect to
the internet and download software applications.
(H)
"Covered application" means an application that is not an
application distributor and that provides a different experience for
adults than for minors, such as different account types, content,
features, or advertising or data practices depending on the user's
age. "Covered application" does not include internet
browsers or search engines.
(I)
"Developer" means any person that creates, owns, or
controls an application.
(J)
"Filter" means a generally accepted and commercially
reasonable technology used on a connected device that is capable of
preventing the connected device from accessing or displaying obscene
material, through internet browsers or search engines, in accordance
with prevailing industry standards, including blocking known web
sites primarily intended for the distribution of obscene material via
mobile data networks, wired internet networks, and wireless internet
networks.
(K)
"Internet browser" means a software program that allows
users to access and display web sites on the internet.
(L)
"Minor" means an account holder who is or is estimated to
be under the age of eighteen.
(M)
"Obscene" and "material" have the same meanings
as in section 2907.01 of the Revised Code.
(N)
"Operating system" means software that manages applications
on a connected device, including those applications' access to the
network, hardware, and other device resources.
(O)
"Operating system provider" means the company that owns,
operates, or controls the operating system on a connected device.
(P)
"Parent" includes a legal guardian.
(Q)
"Search engine" means software that allows users to input
queries in order to perform searches of content on web sites on the
basis of a query in the form of a keyword, voice request, phrase, or
other input, and returns results in any format in which information
related to the query can be found.
(R)
"Verifiable parental consent" means obtaining the consent
of a minor's parent in such a manner that is reasonably calculated,
in light of available technology, to ensure that the person providing
consent is the minor's parent. "Verifiable parental consent"
includes complying with the verifiable parental consent requirements
of the "Children's Online Privacy Protection Act of 1998,"
15 U.S.C. 6501, et seq.
Sec.
1349.071.
(A)
An application distribution provider shall do all of the following:
(1)
Request that a prospective account holder declares the prospective
account holder's age when creating an account with the application
distribution provider;
(2)
Provide an account holder who is not estimated to be an adult with
the opportunity to verify that the account holder is an adult;
(3)
Provide the developer of a covered application with the technical
ability to request an age signal in which the account holder or the
account holder's parent has agreed to share that information;
(4)
Provide the developer of a covered application with the ability to
prevent account holders who are not adults from acquiring the
developer's covered application from the application distributor, at
the developer's request;
(5)
Provide the capability to developers to view relevant parental
controls for covered applications through a centralized parental
controls interface and offer the developer of a covered application
the technical ability to integrate parental controls for the
developer's covered application into that centralized interface;
(6)
Impose the same, substantially the same, or greater restrictions and
obligations on covered applications for which the application
distribution provider is also the developer as it does on third-party
covered applications or application distribution providers in
complying with sections 1349.07 to 1349.076 of the Revised Code;
(7)
Not use data collected from third parties in the course of compliance
with sections 1349.07 to 1349.076 of the Revised Code to give the
application distribution provider preference relative to those of
third parties, or to otherwise use the data in an anti-competitive
manner.
(B)
An application distribution provider may use commercially reasonable
efforts to estimate the age category of an account holder with a
reasonable level of certainty proportionate to the risks that arise
from access to and use of the relevant service or portion thereof.
Sec.
1349.072.
(A)
A developer of a covered application shall do all of the following:
(1)
Report to the application distribution provider whether the
developer's applications provide a different experience for account
holders that are adults than for account holders that are minors;
(2)
Provide tools to help parents support minors using the developer's
covered applications;
(3)
Use commercially reasonable efforts to estimate the age category of
an account holder with a reasonable level of certainty proportionate
to the risks that arise from access to and use of the covered
application or portion thereof;
(4)
Make a reasonable effort, proportionate to the risks, to ensure that
account holders who are minors cannot engage in any activity that is
restricted for adults only;
(5)
Obtain verifiable parental consent prior to permitting minor account
holders to access content or features that the developer has
designated as unsuitable for minors without parental guidance or
supervision;
(6)
Not deliver personalized advertising to minors.
(B)
If the developer requests an age signal facilitated by an application
distributor, the developer shall do all of the following:
(1)
Request the minimum amount of information needed for the purposes of
complying with sections 1349.07 to 1349.076 of the Revised Code;
(2)
Not share the information obtained from the age signal with third
parties, unless necessary to implement safety measures or privacy
protections for minors, or unless otherwise required to do so by law;
(3)
Not use the age signal for any purpose beyond that required by
sections 1349.07 to 1349.076 of the Revised Code.
Sec.
1349.073.
(A)
An operating system provider shall do all of the following:
(1)
Request a prospective account holder to declare the prospective
account holder's age when creating an account with the operating
system provider;
(2)
Provide an account holder who is estimated not to be an adult with
the opportunity to verify that the account holder is an adult;
(3)
Enable parents of a minor account holder to activate and control a
filter setting for the minor account holder;
(4)
Provide internet browsers and search engines with the technical
ability to read a setting that indicates the state of the filter.
(B)
An operating system provider may use commercially reasonable efforts
to estimate the age category of an account holder with a reasonable
level of certainty proportionate to the risks that arise from access
to and use of the relevant service or portion thereof.
Sec.
1349.074.
An
internet browser or search engine shall do all of the following:
(A)
Provide a filter that may be enabled by an account holder or the
account holder's parent;
(B)
Where available, read the filter setting required by division (A)(4)
of section 1349.073 of the Revised Code;
(C)
Activate the filter when enabled by an account holder or the account
holder's parent via the filter settings on a connected device;
(D)
Notify the account holder when the filter blocks access to obscene
material through the internet browser or search engine.
Sec.
1349.075.
(A)
An application distribution provider or operating system provider
that makes a good faith effort to comply with sections 1349.07 to
1349.076 of the Revised Code, taking into consideration available
technology, is not liable for attempts to comply with those sections,
including any of the following with regard to the provision of an age
signal:
(1)
Any erroneous age signal;
(2)
Any conduct by a developer of a covered application that receives any
age signal;
(3)
Failing to provide an age signal due to any reasonable technical
limitations or outages that prevent the provision of the age signal
upon request;
(4)
Not providing the age signal to developers that do not adhere to
reasonable safety standards and application distributor policies.
(B)(1)
The developer is solely liable for correctly identifying whether an
application is a covered application. No application distributor is
required to proactively identify covered applications, and an
application distributor is not liable under sections 1349.07 to
1349.076 of the Revised Code in cases in which a developer provides
inaccurate information about an application.
(2)
The developer is not liable for an erroneous age signal provided by
an application distribution provider if the developer makes a
reasonable effort, taking into consideration available technology, to
properly use the age signal and carry out other age assurance, if
needed, as proportionate to the risks presented to users by use of
the developer's application.
Sec.
1349.076.
(A)
The attorney general may initiate an action and seek a civil penalty
of up to one thousand dollars for each violation of sections 1349.07
to 1349.076 of the Revised Code.
(B)
The attorney general has exclusive authority to enforce sections
1349.07 to 1349.076 of the Revised Code.
(C)
Sections 1349.07 to 1349.076 of the Revised Code shall not be
construed to provide a private right of action with respect to any
act or practice described under those sections.
Section
2.
Section
1 of this act takes effect one year after the effective date of this
section.