Digital Age Assurance Act of 2026

This Act may be cited as the “Digital Age Assurance Act of 2026”.

In this Act:

(1) Age bracket data.— The term age bracket data means non-personally identifiable data derived from a user's date of birth or age for the purpose of sharing information to indicate the user's age range, including whether a user—

(A) has not attained 13 years of age;

(B) has attained 13 years of age but not 16 years of age;

(C) has attained 16 years of age but not 17 years of age; or

(D) has attained 17 years of age.

(2) Application.—

(A) In general.— The term application means a software program that may be run or directed by a user on a covered device.

(B) Exceptions.— The term application does not include—

(i) telecommunications services (as defined in section 3(53) of the Communications Act of 1934 (47 U.S.C. 153(53))); or

(ii) a software component that is not offered to users as a standalone software program through an application store.

(3) Application store.—

(A) In general.— The term application store means an application, online service, or platform that distributes and facilitates the download of applications from third party developers by users of a covered device.

(B) Exception.— The term application store does not include an online service or platform that distributes extensions, plug-ins, add-ons, or other software components that run exclusively within a separate host application.

(4) Browser.— The term browser means an application that enables a user to visit an internet website.

(5) Browser provider.— The term browser provider means a person that owns, maintains, or controls a browser for use on a covered device.

(6) Child.— The term child means an individual who has not attained 17 years of age.

(7) Commission.— The term Commission means the Federal Trade Commission.

(8) Covered device.— The term covered device means a computer, mobile device, or other general purpose computing device that has the capability to run an operating system.

(9) Covered internet website.— The term covered internet website means an internet website that is required under Federal or State law to verify the age of a user prior to granting such user access to content or services provided on such internet website.

(10) Covered internet website operator.— The term covered internet website operator means a person that owns, maintains, or controls a covered internet website that is required under Federal or State law to verify the age of a user prior to granting to such user access to content or services provided on such covered internet website.

(11) Developer.— The term developer means a person that owns, maintains, or controls an application (including an application store).

(12) Operating system provider.— The term operating system provider means a person that develops, licenses, or controls the operating system software on a covered device.

(13) Signal.— The term signal means the age bracket data of a user—

(A) sent by a real-time secure application programming interface or operating system to a developer, browser provider, or covered internet website operator; or

(B) communicated by a browser provider to a covered internet website operator in any technically feasible manner.

(14) User.— The term user means an individual who primarily uses a covered device.

(15) Verifiable credential.— The term verifiable credential means a tamper-evident, cryptographically signed digital credential that—

(A) enables a user to demonstrate such user's age or age bracket data; and

(B) discloses no other information regarding such user.

(16) Zero-knowledge proof.— The term zero-knowledge proof means a cryptographic method by which a user demonstrates the age bracket data of a user without revealing any information beyond what is necessary to establish such age bracket data (such as the exact age, date of birth, or other personal information of the user).

(a) In general.—

(1) Requirements.— Subject to paragraph (2), each operating system provider shall—

(A) for each covered device, subject to clause (ii), require that in order to use the operating system of the provider on such device—

(i) with respect to an account created on or after the effective date, require each user to establish an account with the provider through a process that requires the user to indicate the date of birth and age of the user; and

(ii) with respect to an account existing as of the effective date, unless the operating system provider knows the age of the user for purposes of compliance with any legal obligation, administration of its own terms of services or policies, or confirming authorization for any purchase within an application, require the user who is the account holder to provide the date of birth and age of such user;

(B) using the information described in subparagraph (A)—

(i) classify such information into age bracket data associated with such user; and

(ii) provide to a developer, browser provider, or covered internet website operator who has requested a signal with respect to a user a signal containing the age bracket data of a user through a reliable real-time application programming interface, using, where technically feasible, in an interoperable format, and subject to paragraph (3), a verifiable credential or zero-knowledge proof;

(C) if the information described in subparagraph (A) indicates that a user is a child, require that the child link their account to the account of a parent or legal guardian; and

(D) provide each user or parent or legal guardian of a user if such user is a child with a mechanism to allow such user or parent or legal guardian to view the age bracket data of such user.

(2) Exceptions.—

(A) Emergency phone calls.— The requirements described in paragraph (1) shall not apply in the event that a user is using an operating system to make an emergency phone call.

(B) Emancipated minors.— The requirement described in paragraph (1)(C) shall not apply to a child who is an emancipated minor.

(3) Consensus based interoperability standards.— An operating system provider that uses a verifiable credential or zero-knowledge proof to send a signal pursuant to paragraph (1)(B)(ii) shall send such signal in a manner that is consistent with widely adopted, consensus-based interoperability standards.

(b) Limitation on use and deidentification of age bracket data.— An operating system provider—

(1) shall—

(A) only send age bracket data in accordance with subsection (a)(1)(B)(ii);

(B) employ reasonable security safeguards to protect such data;

(C) only retain such data that is necessary to generate and transmit a signal under subsection (a)(1)(B)(ii); and

(D) when a user deletes the account associated with the operating system of such provider, deidentify or securely delete such data associated with such account; and

(2) except as provided in subsection (a)(1)(B)(ii), may not share such data with a third party.

(c) Operating system provider safe harbor.— An operating system provider acting in good faith to comply with this section shall not be liable if there is an electrical or internet outage or other technical error that prevents such provider from providing a signal to a developer under subsection (a)(1)(B)(ii).

(d) Conflicting age information.— If an operating system provider receives clear and convincing information that a user's age is different than the age range indicated in the age bracket data contained in the signal provided pursuant to subsection (a)(1)(B) from a developer or covered internet website operator under section 4(c)(1)(B), such operating system provider shall—

(1) verify the age of the user; and

(2) provide an updated signal regarding such user to each developer, browser provider, or covered internet website operator that was provided the original signal with respect to such user.

(a) Requesting age bracket data.—

(1) In general.— A developer and covered internet website operator shall—

(A) for each application of the developer or covered internet website of a covered internet website operator published or updated on or after the effective date of this Act, each time a user downloads and uses such application or accesses such covered internet website on a covered device for the first time, request a signal from an operating system provider or, with respect to a covered internet website operator, the browser provider from which the covered internet website is being accessed;

(B) for each application of the developer or covered internet website of a covered internet website operator published or updated before the effective date of this Act, not later than 7 months after such date, with respect to an application, each time a user uses such application request a signal from an operating system provider or, with respect to a covered internet website operator, request a signal once from the browser provider from which the website is being accessed; and

(C) use the age bracket data contained in a signal—

(i) except as described under subsection (c) and subject to paragraph (2), as the primary indicator of a user's age; and

(ii) to comply with any applicable law or policy of an application store regarding age requirements for a user of such application or covered internet website.

(2) Actual knowledge.— If a developer or covered internet website operator has received a signal with respect to a user pursuant to paragraph (1), such developer or covered internet website operator shall be deemed to have actual knowledge of the age bracket data of such user across all platforms and points of access of the application of the developer or covered internet website of the covered internet website operator.

(b) Complying with internal policies.— It shall be unlawful for a developer or covered internet website operator to allow a user to access an application of such developer or covered internet website of such operator if—

(1) the developer or covered internet website operator has determined that access to such application, a feature of such application, or covered internet website is inappropriate for users within a certain age bracket; and

(2) the age bracket data of such user contained in a signal indicates that the user falls within such age bracket.

(c) Other age information.—

(1) In general.— Subject to paragraph (2), if a developer or covered internet website operator has clear and convincing information that a user's age is different than the age range indicated in the age bracket data contained in the signal requested under subparagraph (A) or (B) of subsection (a)(1), such developer or covered internet website operator shall—

(A) until the developer or covered internet website operator receives an updated signal from an operating system provider pursuant to paragraph (2), use such clear and convincing information as the primary indicator of the age of such user;

(B) to the extent technically feasible, transmit such clear and convincing information to the operating system provider from which such developer or covered internet website operator received the signal regarding such user by using the same mechanism such developer or covered internet website operator used to receive such signal; and

(C) provide a notice containing a general description of such clear and convincing information to—

(i) such user; or

(ii) if such user is a child, the parent or legal guardian whose account is linked to the account of the user pursuant to section 3(a)(1)(C).

(2) Conflicting age information.— If a developer or covered internet website operator receives an updated signal from an operating system provider pursuant to section 3(d)(2), such developer or covered internet website operator shall use the age bracket data contained in such updated signal with respect to such user.

(3) Opportunity to correct.— A developer or internet website operator that provides a notice described in paragraph (1)(C) shall—

(A) provide a mechanism through which a user or the parent or legal guardian of a user whose account is linked to a user pursuant to section 3(a)(1)(C) may provide updated age information; and

(B) not later than 30 days after receiving such updated age information, provide such user or parent or legal guardian with a determination with respect to the age information of the user.

(d) Use of information.— A developer or covered internet website operator may not—

(1) request more information about a user from an operating system provider than the signal described in subparagraph (A) or (B) of subsection (a)(1); or

(2) share the signal or age bracket data contained in the signal with a third party.

(e) Developer and covered internet website operator safe harbor.— A developer or covered internet website operator acting in good faith to comply with this section shall not be liable for conduct resulting from an erroneous signal indicating a user’s age range received from an operating system provider pursuant to section 3(a)(B)(ii) or an application store pursuant to section 5(a).

(a) Developers of application stores.— A developer of an application store shall—

(1) the first time a user accesses the application store on a covered device, request a signal from an operating system provider; and

(2) provide such signal to another developer upon request.

(b) Browser providers.— A browser provider shall—

(1) the first time a user accesses the browser on a covered device, request a signal from an operating system provider; and

(2) provide such signal to a covered internet website operator upon request.

A developer, covered internet website operator, or operating system provider may not—

(1) collect more data regarding a user than is necessary to—

(A) generate age bracket data and transmit or receive a signal; or

(B) perform the basic functions of an application, covered internet website, or operating system;

(2) sell age bracket data contained in a signal;

(3) use age bracket data for profiling, engagement optimization, or targeted advertising; or

(4) combine age bracket data with other personal or inferred information regarding a user.

(a) Targeted advertising.—

(1) In general.— It shall be unlawful for any person to engage in targeted advertising to a user the person knows, or reasonably should know, is a child.

(2) Clarification.— Nothing in this subsection shall be construed to prohibit contextual advertising that does not rely on personal data or behavioral profiling.

(b) Data monetization.— It shall be unlawful for any person to sell, license, rent, trade, transfer, release, disclose, provide access to, or otherwise make available to a data broker the personal data of a user the person knows, or reasonably should know, is a child.

(a) Enforcement by the Commission.—

(1) Unfair or deceptive Acts.— A violation of section 3, 4, 5, 6, or 7, or a regulation promulgated thereunder shall be treated as a violation of a rule defining an unfair or deceptive act or practice prescribed under section 18(a)(1)(B) of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)).

(2) Powers of Commission.—

(A) In general.— The Commission shall enforce this Act and any regulation promulgated under this Act, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act (15 U.S.C. 41 et seq.) were incorporated into and made a part of this Act.

(B) Privileges and immunities.— Except as provided in subparagraph (D), any person who violates section 3, 4, 5, 6, or 7 or any regulation promulgated thereunder, shall be subject to the penalties and entitled to the privileges and immunities provided in the Federal Trade Commission Act (15 U.S.C. 41 et seq.).

(C) Authority preserved.— Nothing in this Act shall be construed to limit the authority of the Commission under any other provision of law.

(D) Civil penalties.—

(i) In general.— In addition to any other penalties as may be prescribed by law, each violation of section 3, 4, 5, 6, or 7 or a regulation promulgated thereunder, shall carry a civil penalty not to exceed—

(I) for a negligent violation, $2,500; and

(II) for a knowing or intentional violation, $7,500.

(ii) Affected children.— In any case in which a violation of section 3, 4, 5, 6, or 7 affected a child (as determined by the Commission), the penalties described in clause (i) may be multiplied by the number of children affected.

(E) Rulemaking.— Not later than 1 year after the date of enactment of this Act, the Commission shall promulgate in accordance with section 553 of title 5, United States Code, such rules as may be necessary to carry out this Act.

(b) Enforcement by State attorneys general.—

(1) In general.— In any case in which the attorney general of a State has reason to believe that an interest of the residents of the State has been or is threatened or adversely affected by the engagement of any person in an act or practice that violates section 3, 4, 5, 6, or 7, the attorney general of the State may, as parens patriae, bring a civil action on behalf of the residents of the State in an appropriate district court of the United States or a State court of appropriate jurisdiction to—

(A) enjoin any further such violation by such person;

(B) enforce compliance with such section;

(C) obtain a permanent, temporary, or preliminary injunction;

(D) obtain damages, restitution, or other compensation on behalf of residents of the State; or

(E) obtain such other relief as the court may consider appropriate.

(2) Rights of the Commission.—

(A) Notice to the Commission.—

(i) In general.— Except as provided in clause (ii), before initiating a civil action under paragraph (1), the attorney general of a State shall provide to the Commission a written notice of such action and a copy of the complaint for such action.

(ii) Exception.— If the attorney general determines that it is not feasible to provide the notice described in clause (i) before initiating a civil action under paragraph (1), the attorney general shall provide written notice of the action and a copy of the complaint to the Commission immediately upon initiating the civil action.

(B) Intervention.— The Commission may—

(i) intervene in any civil action brought by the attorney general under paragraph (1); and

(ii) upon intervening—

(I) if applicable, remove the action to an appropriate United States district court;

(II) be heard on all matters arising in the civil action; and

(III) file petitions for appeal of a decision in the civil action.

(3) Investigatory powers.— Nothing in this subsection may be construed to prevent the attorney general of a State from exercising the powers conferred on the attorney general by the laws of the State to conduct investigations, to administer oaths or affirmations, or to compel the attendance of witnesses or the production of documentary or other evidence.

(4) Limitation on State action while Federal action is pending.— If the Commission has instituted a civil action for a violation of section 3, 4, 5, 6, or 7, no State attorney general may, without the approval of the Commission, bring an action under this subsection during the pendency of that action against any defendant named in the complaint of the Commission for any violation of this section alleged in the complaint.

(5) Venue; Service of process.—

(A) Venue.— Any action brought under paragraph (1) may be brought in—

(i) the district court of the United States that meets applicable requirements relating to venue under section 1391 of title 28, United States Code; or

(ii) another court of competent jurisdiction.

(B) Service of process.— In an action brought under paragraph (1) in a district court of the United States, process may be served in any district in which—

(i) the defendant is an inhabitant, may be found, or transacts business; or

(ii) venue is proper under section 1391 of title 28, United States Code.

(c) Safe harbor.— An operating system provider, covered internet website operator, or developer acting in good faith to comply with this Act shall not be liable under this Act if a user inputs inaccurate information under section 3(a)(1).

(a) Consistent age-Related requirements.— An operating system provider or an application store provider shall, with respect to an application developed by a third party, impose age-related restrictions and obligations on the application and distribution of the application that are the same as or less restrictive than the restrictions and obligations it imposes on its own applications and distribution of its own applications.

(b) Use of collected data.— An operating system provider or an application store may not use age bracket data collected from a third party with respect to the applications or distribution of the applications of the third party to engage in anticompetitive behavior with respect to the third party, including by—

(1) offering the applications or services of the operating system provider or application store at terms and conditions such that users will prefer such applications or services to the applications or services of a third party; and

(2) using age bracket data.

(c) Interoperable credentialing.— An operating system provider or application store may not require a developer, browser provider, or covered internet website operator to use a proprietary software development kit, licensing agreement, or other exclusive technical dependency as a condition of verifying a signal, unless such requirement is reasonably necessary to ensure security, privacy, fraud prevention, or the integrity of the verification process.

(d) Enforcement.—

(1) Unlawful method of competition.— A violation of this section or a regulation promulgated under this section shall be deemed to be an unlawful method of competition in violation of section 5 of the Federal Trade Commission Act (15 U.S.C. 45) and a per se violation of section 1 of the Sherman Act (15 U.S.C. 1).

(2) Enforcement.—

(A) In general.— The Commission shall enforce this section and any regulation promulgated under this section in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act (15 U.S.C. 41 et seq.) were incorporated into and made a part of this section.

(B) Enforcement authorities.—

(i) Federal trade commission.— If the Federal Trade Commission has reason to believe that a person violated this section, and in so doing, committed a violation of section 5 of the Federal Trade Commission Act (15 U.S.C. 45), the Commission may commence a civil action, in its own name by any of its attorneys designated by it for such purpose, to recover a civil penalty and seek other appropriate relief.

(ii) Attorney general.— The Attorney General shall enforce this section in the same manner, by the same means, and with the same jurisdiction, powers and duties as though all applicable terms of the Sherman Act (15 U.S.C. 1 et seq.), Clayton Act (15 U.S.C. 12 et seq.), and Antitrust Civil Process Act (15 U.S.C. 1311 et seq.) were incorporated into and made a part of this section.

(iii) State attorneys general.— Any attorney general of a State shall enforce this section in the same manner, by the same means, and with the same jurisdiction, powers and duties as though all applicable terms of the Sherman Act (15 U.S.C. 1 et seq.) and the Clayton Act (15 U.S.C. 12 et seq.) were incorporated into and made a part of this section.

Nothing in this Act shall be construed to—

(1) preempt section 444 of the General Educational Provisions Act (20 U.S.C. 1232g) (commonly known as the “Family Educational Rights and Privacy Act of 1974”) or any other Federal or State law governing student privacy;

(2) preempt the Children's Online Privacy Protection Act of 1998 (15 U.S.C. 6501 et seq.) or any rule promulgated under such Act;

(3) authorize any action that would conflict with section 18(h) of the Federal Trade Commission Act (15 U.S.C. 57a(h));

(4) expand, limit, or alter the meaning or scope of section 230 of the Communications Act of 1934 (47 U.S.C. 230);

(5) require—

(A) except as provided in sections 3, 4, and 5 an operating system provider, covered internet website operator, application store, browser provider, or developer to affirmatively collect personal data with respect to a user's age beyond what an operating system provider, covered internet website operator, application store, browser provider, or developer collects in their normal course of business; or

(B) any person to verify the age of a user through—

(i) the collection of a government-issued identification document, biometric information, or other sensitive personal information; or

(ii) facial age estimation technology;

(6) restrict the ability of an operating system provider, covered internet website operator, developer, browser provider, or application store to—

(A) cooperate with law-enforcement agencies regarding activity reasonably believed to violate Federal, State, or local law;

(B) comply with lawful civil, criminal, or regulatory process, including a subpoena or summons;

(C) investigate, establish, or defend legal claims; or

(D) prevent, detect, or respond to security incidents, fraud, or other illegal activity; or

(7) require a particular technological method of generating, transmitting, or verifying a signal.

This Act shall take effect on the date that is 18 months after the date of the enactment of this Act.

If any provision or application of this Act is held invalid, the remainder of such Act shall remain in effect.

The provisions of this Act shall preempt any State law or regulation only to the extent that such State law or regulation conflicts with a provision of this Act. Nothing in this Act or any regulation promulgated thereunder shall be construed to prohibit or otherwise affect the enactment or enforcement of any Federal law or regulation or State law or regulation that is at least as protective of individuals as this Act and the regulations promulgated thereunder.