SB467: SB467 Minors; procedures to validate the age of certain persons using any app; require

26 LC 64 0047 Senate Bill 467 By: Senators Cowsert of the 46th, Gooch of the 51st, Hatchett of the 50th, Robertson of the 29th, Watson of the 11th and others A BILL TO BE ENTITLED AN ACT To amend Title 39 of the Official Code of Georgia Annotated, re lating to minors, so as to1 require procedures to validate the age of certain persons using any app; to require app store2 providers to verify the age of each person with an account; to provide methods for age3 verification; to require parental consent before minor account holders download an app or4 make an in-app purchase; to provide for the withdrawal of parental consent; to provide for5 the renewal of parental consent in certain circumstances; to pr ovide for data sharing6 regarding age category data and parental consent; to provide for limitations on data sharing;7 to provide for deceptive business practices; to provide the Att orney General with the8 authority to enforce provisions of this chapter; to provide for exceptions; to provide for9 definitions; to provide for related matters; to repeal conflicting laws; and for other purposes.10 BE IT ENACTED BY THE GENERAL ASSEMBLY OF GEORGIA:11 SECTION 1.12 Title 39 of the Official Code of Georgia Annotated, relating to minors, is amended by adding13 a new chapter to read as follows:14 S. B. 467 - 1 - 26 LC 64 0047 "CHAPTER 715 39-7-1.16 As used in this chapter, the term:17 (1) 'Account holder' means the individual who is associated with a certain mobile device.18 (2) 'Adult' means an individual who is at least 18 years of age.19 (3) 'Age category' means one of the categories of child, younger teenager, older teenager,20 or adult.21 (4) 'Age category data' means information about an account hol der's age category that22 is collected by an app store provider and is shared with a developer.23 (5) 'Age rating' means one or more classifications that assess the suitability of an app's24 content and function for different age groups.25 (6) 'App' means a software application or electronic service that a user may run or direct26 on a mobile device, including preinstalled applications.27 (7) 'App store' means a publicly available website, software a pplication, or electronic28 service that allows account holders to download apps from third-party developers onto29 a mobile device.30 (8) 'App store provider' means a person that owns, operates, or controls an app store that31 allows account holders in the state to download apps onto a mobile device.32 (9) 'Child' means an individual who is under 13 years of age.33 (10) 'Content description' means a description of the specific content elements or34 functions that informed an app's age rating.35 (11) 'Developer' means a person that owns or controls an app made available through an36 app store or a preinstalled application.37 (12) 'Minor' means an individual who is under 18 years of age and who is not38 emancipated.39 S. B. 467 - 2 - 26 LC 64 0047 (13) 'Minor account' means an account with an app store provid er which has a minor40 account holder.41 (14) 'Mobile device' means a phone or general-purpose tablet that:42 (A) Provides cellular or wireless connectivity;43 (B) Is capable of connecting to the internet;44 (C) Runs a mobile operating system; and45 (D) Is capable of running apps through a mobile operating system.46 (15) 'Mobile operating system' means software that:47 (A) Manages mobile device hardware resources;48 (B) Provide common services for mobile device programs;49 (C) Controls memory allocation; and50 (D) Provides interfaces for apps to access device functionality.51 (16) 'Older teenager' means an individual who is at least 16 years of age but not 18 years52 of age or older.53 (17) 'Parent' means, with respect to a minor, an individual who is reasonably believed to54 be a parent, a legal guardian, an individual with legal custody , or any other individual55 who has the legal authority to make decisions on behalf of the minor under applicable56 state law.57 (18) 'Parent account' means an account with an app store provider that:58 (A) Is verified to be established by an individual who the app store provider has59 determined is at least 18 years old or emancipated through the app store provider's age60 verification methods;61 (B) Is reasonably believed to be the parent of a minor account holder; and62 (C) Is affiliated with one or more such minor's accounts.63 (19) 'Parental consent' means authorization that:64 (A) Is provided by a parent account on behalf of an associated minor account;65 S. B. 467 - 3 - 26 LC 64 0047 (B) Is given after the app store provider has clearly and cons picuously provided the66 parental consent disclosure as part of the app download, purchase, or in-app purchase67 process; and68 (C) Requires the parent to make an affirmative choice to grant or decline consent.69 (20) 'Parental consent disclosure' means a disclosure containing:70 (A) The app's or in-app purchase's age rating if the app store provider has an age rating71 for the app or in-app purchase;72 (B) The app's or in-app purchase's content description if the app store provider has a73 content description for the app or in-app purchase;74 (C) A description of the personal data collected by the app from the account holder;75 (D) A description of the personal data shared by the app with any third party; and76 (E) The methods implemented by the developer to protect person al data if any is77 collected.78 (21) 'Preinstalled application' means any app, or portion ther eof, that is present on a79 mobile device at the time of purchase, initial activation, or f irst use by the consumer,80 including browsers, search engines, and messaging, but excluding core operating system81 functions, essential device drivers, and applications necessary for basic device operation82 such as phone, settings, and emergency services applications. Preinstalled applications83 include apps, or portions thereof, installed or partially insta lled by the device84 manufacturer, wireless service provider, retailer, or any other party prior to purchase,85 initial activation, or first use by the account holder and which may be updated thereafter.86 (22) 'Significant change' means a modification to an app's ter ms of service or privacy87 policy that materially:88 (A) Changes the categories of data collected, stored, or shared;89 (B) Alters the app's age rating or content descriptions;90 (C) Introduces in-app purchases where no in-app purchases were previously present;91 or92 S. B. 467 - 4 - 26 LC 64 0047 (D) Introduces advertisements where no advertisements were previously present.93 (23) 'Younger teenager' means an individual who is at least 13 years of age but not 1694 years of age or older.95 39-7-2.96 (a) An app store provider shall:97 (1) For each account, at the time an account holder who is located in this state creates the98 account with the app store provider or, for existing accounts, no later than July 1, 2027,99 verify the account holder's age category using either:100 (A) A commercially available method that is reasonably designed to ensure accuracy;101 or102 (B) For minors, a method which includes affirmative age attestation by someone who103 is reasonably believed to be the parent or legal guardian;104 (2) For each minor account:105 (A) Require such minor's account to be affiliated with a parent account; and106 (B) Obtain parental consent from the holder of any affiliated parent account each time107 before allowing the minor account to download an app, purchase an app, or make any108 in-app purchase;109 (3) After receiving notice of a significant change from a developer:110 (A) Notify the account holder of the significant change; and111 (B) For a minor account, notify any associated parent accounts and obtain new parental112 consent before allowing the minor account access to the significantly changed version113 of the app;114 (4) Provide to a developer, in response to a request authorize d under Code115 Section 39-7-3, age category data for an account holder located in this state and the status116 of parental consent for a minor account;117 S. B. 467 - 5 - 26 LC 64 0047 (5) Provide a mechanism for a parent account to withdraw conse nt and notify a118 developer of such withdrawal; and119 (6) Protect age category data and any associated verification data by:120 (A) Limiting collection and processing of data to that which is necessary for verifying121 an account holder's age category, obtaining parental consent, and maintaining legally122 required compliance records; and123 (B) Transmitting age category data using industry standard encryption protocols that124 ensure data integrity and data confidentiality.125 (b) An app store provider shall not:126 (1) Enforce a contract or terms of service against a minor unless the app store provider127 has obtained parental consent;128 (2) Knowingly misrepresent the information in the parental consent disclosure; or129 (3) Share age category data or any associated data except as required by this chapter or130 other provision of law.131 39-7-3.132 (a) A developer shall:133 (1) Verify through the app store's data sharing methods age ca tegory data or parental134 consent, as required by the provisions of this chapter:135 (A) At the time an account holder downloads an app, purchases an app, or launches a136 preinstalled app for the first time;137 (B) When implementing a significant change to the app; or138 (C) To comply with applicable law;139 (2) Notify app store providers of a significant change to an app; and140 (3) Use age category data received through the app store's dat a sharing methods to141 enforce any developer created age related restrictions, safety related features, or default142 settings and ensure compliance with applicable laws and regulations.143 S. B. 467 - 6 - 26 LC 64 0047 (b) In addition to any requests regarding age category data provided for in subsection (a)144 of this Code section, a developer may request age category data:145 (1) No more than once during any 12 month period to verify:146 (A) The accuracy of age category data associated with an account holder; or147 (B) Continued account use within the age category;148 (2) When there is reasonable suspicion of:149 (A) Account transfer; or150 (B) Misuse outside of the age category; or151 (3) At the time an account holder creates a new account with the developer.152 (c) When implementing any developer created age related restri ctions, safety related153 features, or default settings, a developer shall use the lowest age category indicated by age154 category data received through the app store's data sharing met hods or any age data155 independently collected by the developer.156 (d) A developer shall not:157 (1) Enforce a contract or terms of service against a minor unl ess the developer has158 verified through an app store's data sharing methods that relev ant parental consent has159 been obtained;160 (2) Knowingly misrepresent any information in the parental consent disclosure; or161 (3) Share age category data with any other person or entity.162 39-7-4.163 The Attorney General shall have authority to initiate any proceedings and to exercise any164 power or authority in the same manner as if he or she were acting under Part 2 of Article 15165 of Chapter 1 of Title 10, the 'Fair Business Practices Act of 1975,' in regards to violations166 or potential violations of this chapter.167 S. B. 467 - 7 - 26 LC 64 0047 39-7-5.168 (a) A developer is not liable for a violation of this chapter if the developer demonstrates:169 (1) Reliance in good faith on applicable age category data received through an app store's170 data sharing methods;171 (2) Reliance in good faith on notification from an app store p rovider that parental172 consent was obtained if the account holder was a minor; and173 (3) Compliance with all requirements provided for in Code Section 39-7-2.174 (b) In determining an app's age rating and content description for purposes of Code175 Section 39-7-2, a developer is not liable for a violation of this chapter if the developer:176 (1) Uses widely adopted industry standards to determine the ap p's age category and177 content description; and178 (2) Applies those standards consistently and in good faith.179 (c) The provisions of this Code section shall limit only actio ns brought pursuant to this180 chapter and shall not be construed to limit any person's right to pursue any additional civil181 remedy otherwise allowed by law.182 39-7-6.183 Nothing in this chapter shall be construed to prevent an app st ore provider or developer184 from:185 (1) Taking reasonable measures to prevent criminal activity or block, detect, or prevent186 distribution to minors of unlawful, obscene, or otherwise harmful material;187 (2) Requiring an app store provider to disclose user information to a developer beyond188 age category data or status of relevant parental consent;189 (3) Allowing an app store provider or developer to implement measures required by this190 chapter in a manner that is arbitrary, capricious, anticompetitive, or unlawful;191 (4) Requiring a developer to collect, retain, reidentify, or link any information beyond192 what is necessary to verify age category data as required by this chapter and that which193 S. B. 467 - 8 - 26 LC 64 0047 is collected, retained, reidentified, or linked in the develope r's ordinary course of194 business; or195 (5) Requiring an app store provider or developer to block access to an application that196 an account holder has downloaded or installed onto a mobile device prior to the effective197 date of this chapter, except to the extent that:198 (A) A parent account revokes consent for an affiliated minor account; or199 (B) There has been a significant change to the application."200 SECTION 2.201 All laws and parts of laws in conflict with this Act are repealed.202 S. B. 467 - 9 -