Apple on Thursday detailed the necessary changes it is implementing to comply with Texas state law SB 2420, which introduces mandatory age assurance requirements for app stores and app developers operating in the state. Although Apple had already rolled out its own age assurance technology earlier this year in anticipation of a wider regulatory crackdown, the technology giant publicly called out the Texas law over fundamental privacy concerns.
The Privacy Risk of Blanket Enforcement
In a developer announcement, Apple explained that it is “concerned that SB2420 impacts the privacy of users by requiring the collection of sensitive, personally identifiable information to download any app, even if a user simply wants to check the weather or sports scores.” The Texas law is one of several going into effect across the United States, which is acting to fill the regulatory void left by the failure of lawmakers and the federal government to create comprehensive internet regulations to protect minors online. Consequently, states are passing their own laws with similar goals but widely differing implementation methods.
While a large technology company like Apple possesses the resources to comply with such laws, smaller developers do not, often relying on tools provided by Apple. The difficulty for smaller firms is evident elsewhere; social networking startup Bluesky, for instance, recently had to block its service in Mississippi, stating it lacked the resources to comply with that state’s law.
New Rules for Texas Users and Developers
When the Texas law takes effect on January 1, 2026, Apple will be required to confirm whether Texas users creating a new account are 18 years or older. Any user under 18 will be required to join a Family Sharing group managed by a parent or legal guardian. The parent or guardian must then provide explicit consent for every single App Store download, purchase, and transaction the minor makes, utilizing Apple’s existing in-app purchase system.
To assist developers in complying with the law in a “privacy-preserving way,” Apple announced that its Declared Age Range API will be updated before the law’s effective date to provide the necessary age categories for new account users in Texas. Additionally, Apple will roll out new APIs later this year that will allow developers to obtain fresh parental consent if they make significant changes to their app that would require a different age rating. Parents will also be able to actively revoke consent after it is granted, should they determine the app is no longer appropriate for their child. This new consent revocation feature could easily be used as a new disciplinary technique by parents, for example, “No Instagram for a month!” Apple warned developers that similar laws are scheduled to come into effect in Utah and Louisiana later next year, urging them to prepare for a fragmented regulatory landscape.
What The Author Thinks
Apple’s public compliance combined with its privacy warning reveals the primary danger of fragmented state-level regulation: a legal framework that compels mass collection of sensitive data for trivial apps, thereby creating a massive, centralized honeypot of personal information for hackers. While the intent to protect children is laudable, forcing the same stringent age verification onto a weather app as a social media platform is disproportionate and increases systemic privacy risk for every user. This patchwork of state laws forces major platforms to divert resources into compliance rather than unified safety features, and it puts an unfair resource burden on small developers, risking a decline in the diversity of the App Store.
Featured image credit: Vitya_maly via GoodFon
For more stories like it, click the +Follow button at the top of this page to follow us.