AL
Alabama House Bill HB317

Alabama 2025 Regular Session

Alabama House Bill HB317 Compare Versions

Only one version of the bill is available at this time.
OldNewDifferences
11 HB317INTRODUCED
22 Page 0
33 HB317
44 EJS5X99-1
55 By Representatives Sells, Mooney, Stadthagen, Bracy
66 RFD: Children and Senior Advocacy
77 First Read: 20-Feb-25
88 1
99 2
1010 3
1111 4
1212 5 EJS5X99-1 02/20/2025 THR (L)ma 2025-868
1313 Page 1
1414 First Read: 20-Feb-25
1515 SYNOPSIS:
1616 This bill would require app store providers to
1717 verify the age of users.
1818 This bill would require app store providers to
1919 affiliate minor accounts with parent accounts and
2020 obtain consent from the holder of the parent account.
2121 This bill would require app store providers to
2222 notify users when an app makes a significant change.
2323 This bill would require app store providers to
2424 give developers real-time access to the age category
2525 and consent status for minor accounts.
2626 This bill would require app store providers to
2727 protect personal age verification data.
2828 This bill would prevent app store providers and
2929 developers from enforcing contracts against minors,
3030 misrepresenting information in disclosures and sharing
3131 personal age verification data.
3232 This bill would require developers to verify the
3333 age of users, notify users of significant changes to
3434 the app, and limit the use of age category data in
3535 compliance with laws or regulations.
3636 This bill would require the Attorney General to
3737 adopt certain rules.
3838 This bill would also authorize the Attorney
3939 General to bring an action for a violation as a
4040 1
4141 2
4242 3
4343 4
4444 5
4545 6
4646 7
4747 8
4848 9
4949 10
5050 11
5151 12
5252 13
5353 14
5454 15
5555 16
5656 17
5757 18
5858 19
5959 20
6060 21
6161 22
6262 23
6363 24
6464 25
6565 26
6666 27
6767 28 HB317 INTRODUCED
6868 Page 2
6969 General to bring an action for a violation as a
7070 deceptive trade practice.
7171 A BILL
7272 TO BE ENTITLED
7373 AN ACT
7474 Relating to consumer protection; to require an app
7575 store provider to take certain actions regarding age
7676 verification, parental notification, and data protection; to
7777 prohibit an app store provider or developer from taking
7878 certain actions that allow minors to access apps without
7979 parental consent; and to authorize the Attorney General to
8080 bring an action for a violation as a deceptive trade practice.
8181 BE IT ENACTED BY THE LEGISLATURE OF ALABAMA:
8282 Section 1. For the purposes of this act, the following
8383 terms have the following meanings:
8484 (1) AGE CATEGORY. Whether an individual is: (i) under
8585 13 years of age; (ii) at least 13 years of age but less than
8686 16 years of age; (iii) at least 16 years of age but less than
8787 18 years of age; or (iv) at least 18 years of age.
8888 (2) AGE CATEGORY DATA. Information about a user's age
8989 category that is collected by an app store developer and
9090 shared with a developer.
9191 (3) APP. A software application or electronic service
9292 that a user may run or direct on a mobile device.
9393 (4) APP STORE. A publicly available website, software
9494 application, or electronic service that distributes apps from
9595 29
9696 30
9797 31
9898 32
9999 33
100100 34
101101 35
102102 36
103103 37
104104 38
105105 39
106106 40
107107 41
108108 42
109109 43
110110 44
111111 45
112112 46
113113 47
114114 48
115115 49
116116 50
117117 51
118118 52
119119 53
120120 54
121121 55
122122 56 HB317 INTRODUCED
123123 Page 3
124124 application, or electronic service that distributes apps from
125125 third-party developers to users.
126126 (5) APP STORE PROVIDER. An entity that owns, operates,
127127 or controls an app store that distributes apps to users in
128128 this state.
129129 (6) DEVELOPER. An entity that owns or controls an app
130130 made available through an app store in this state.
131131 (7) MINOR. An individual under 18 years of age.
132132 (8) MINOR ACCOUNT. An account with an app store
133133 provider that is established by an individual who the app
134134 store provider has determined is a minor.
135135 (9) PARENT. With respect to a minor, any of the
136136 following individuals:
137137 a. A biological parent.
138138 b. A legal guardian.
139139 c. An individual with legal custody.
140140 (10) PARENT ACCOUNT. An account with an app store
141141 provider that is affiliated with one or more minor accounts
142142 and that is verified to have been established by an individual
143143 who the app store provider has determined is at least 18 years
144144 of age.
145145 (11) PARENTAL CONSENT DISCLOSURE. The following
146146 information that an app store provider is required to provide
147147 to a parent before obtaining parental disclosure:
148148 a. A description of the personal data collected by the
149149 app from a user.
150150 b. A description of the personal data shared by the app
151151 with any third party.
152152 c. Any methods implemented by the developer to protect
153153 57
154154 58
155155 59
156156 60
157157 61
158158 62
159159 63
160160 64
161161 65
162162 66
163163 67
164164 68
165165 69
166166 70
167167 71
168168 72
169169 73
170170 74
171171 75
172172 76
173173 77
174174 78
175175 79
176176 80
177177 81
178178 82
179179 83
180180 84 HB317 INTRODUCED
181181 Page 4
182182 c. Any methods implemented by the developer to protect
183183 personal data.
184184 d. The age rating of the app or in-app purchase, if
185185 available.
186186 e. The content description of the app or in-app
187187 purchase, if available.
188188 (12) SIGNIFICANT CHANGE. A modification to an app's
189189 terms of service or privacy policy that does any of the
190190 following:
191191 a. Changes the categories of data collected, stored, or
192192 shared.
193193 b. Adds new monetization features, including, but not
194194 limited to, in-app purchases or advertisements.
195195 c. Materially changes the app's functionality or user
196196 experience.
197197 (13) VERIFIABLE PARENTAL CONSENT. Authorization that
198198 meets all of the following criteria:
199199 a. Is provided by an individual who the app store
200200 provider has verified is at least 18 years of age.
201201 b. Is given after the app store provider has clearly
202202 and conspicuously provided the parental consent disclosure to
203203 the individual.
204204 c. Requires the parent to make an affirmative choice to
205205 either grant consent or decline consent.
206206 Section 2. An app store provider shall do both of the
207207 following when an individual located in this state creates an
208208 account with the app store provider:
209209 (1) Request age information from the individual.
210210 (2) Verify the individual's age using one of the
211211 85
212212 86
213213 87
214214 88
215215 89
216216 90
217217 91
218218 92
219219 93
220220 94
221221 95
222222 96
223223 97
224224 98
225225 99
226226 100
227227 101
228228 102
229229 103
230230 104
231231 105
232232 106
233233 107
234234 108
235235 109
236236 110
237237 111
238238 112 HB317 INTRODUCED
239239 Page 5
240240 (2) Verify the individual's age using one of the
241241 following:
242242 a. Commercially available methods that are reasonably
243243 designed to ensure accuracy.
244244 b. An age verification system that complies with rules
245245 adopted pursuant to this act.
246246 Section 3. An app store provider shall do both of the
247247 following when an individual is determined to be a minor
248248 pursuant to Section 1:
249249 (1) Require the account to be affiliated with a parent
250250 account.
251251 (2) Obtain verifiable parental consent from the holder
252252 of the affiliated parent account before allowing the minor to:
253253 (i) download an app; (ii) purchase an app; or (iii) make an
254254 in-app purchase.
255255 Section 4. An app store provider shall do both of the
256256 following after receiving notice of a significant change from
257257 a developer:
258258 (1) Notify the user of the significant change.
259259 (2) For a minor account, do both of the following:
260260 a. Notify the holder of the affiliated parent account.
261261 b. Obtain renewed verifiable parental consent.
262262 Section 5. An app store provider shall provide
263263 developers with real-time access to both of the following:
264264 (1) Age category data for each user located in this
265265 state.
266266 (2) The status of verifiable parental consent for each
267267 minor located in this state.
268268 Section 6. An app store provider shall protect personal
269269 113
270270 114
271271 115
272272 116
273273 117
274274 118
275275 119
276276 120
277277 121
278278 122
279279 123
280280 124
281281 125
282282 126
283283 127
284284 128
285285 129
286286 130
287287 131
288288 132
289289 133
290290 134
291291 135
292292 136
293293 137
294294 138
295295 139
296296 140 HB317 INTRODUCED
297297 Page 6
298298 Section 6. An app store provider shall protect personal
299299 age verification data by doing both of the following:
300300 (1) Limiting the collection and processing to data
301301 necessary to: (i) verify a user's age; (ii) obtain parental
302302 consent; or (iii) maintain compliance records.
303303 (2) Transmitting personal age verification data using
304304 industry-standard encryption protocols that ensure data
305305 integrity and data confidentiality.
306306 Section 7. An app store provider may not do any of the
307307 following:
308308 (1) Enforce a contract or terms of service against a
309309 minor unless the app store provider has obtained verifiable
310310 parental consent.
311311 (2) Knowingly misrepresent the information in the
312312 parental consent disclosure.
313313 (3) Share personal age verification data except as
314314 required by law or as required by this act between an app
315315 store provider and a developer.
316316 Section 8. (a) A developer shall do all of the
317317 following:
318318 (1) Verify through the app store's data sharing
319319 methods: (i) the age category of users located in this state;
320320 and (ii) for a minor account, whether verifiable parental
321321 consent has been obtained.
322322 (2) Notify app store providers of any significant
323323 change to an app.
324324 (3) Limit use of age category data received from an app
325325 store provider to: (i) enforcing age-related restrictions or
326326 protections; (ii) ensuring compliance with applicable laws or
327327 141
328328 142
329329 143
330330 144
331331 145
332332 146
333333 147
334334 148
335335 149
336336 150
337337 151
338338 152
339339 153
340340 154
341341 155
342342 156
343343 157
344344 158
345345 159
346346 160
347347 161
348348 162
349349 163
350350 164
351351 165
352352 166
353353 167
354354 168 HB317 INTRODUCED
355355 Page 7
356356 protections; (ii) ensuring compliance with applicable laws or
357357 regulations; or (iii) implementing safety-related features or
358358 defaults.
359359 (b) A developer may not do any of the following:
360360 (1) Enforce a contract or terms of service against a
361361 minor unless the developer has verified through the app store
362362 provider that verifiable parental consent has been obtained.
363363 (2) Knowingly misrepresent any information in the
364364 parental consent disclosure.
365365 (3) Share age category data with any person.
366366 Section 9. The Attorney General shall adopt rules
367367 establishing processes and means by which an app store
368368 provider may verify whether an account holder is a minor in
369369 accordance with this act.
370370 Section 10. (a) Any knowing or reckless violation of
371371 this act is deemed a deceptive trade practice actionable under
372372 Chapter 19 of Title 8 of the Code of Alabama 1975. If the
373373 Attorney General has reason to believe that an entity is in
374374 violation of this act, the Attorney General may bring an
375375 action against the entity for an unfair or deceptive trade
376376 practice. In addition to other remedies available under
377377 Chapter 19 of Title 8 of the Code of Alabama 1975, the
378378 Attorney General may collect a civil penalty of up to fifty
379379 thousand dollars ($50,000) per violation, reasonable attorney
380380 fees, and court costs.
381381 (b) If a violation described in subsection (a) is part
382382 of a consistent pattern of knowing or reckless conduct, the
383383 Attorney General may seek punitive damages against the entity.
384384 (c) An action for a claim under this section must be
385385 169
386386 170
387387 171
388388 172
389389 173
390390 174
391391 175
392392 176
393393 177
394394 178
395395 179
396396 180
397397 181
398398 182
399399 183
400400 184
401401 185
402402 186
403403 187
404404 188
405405 189
406406 190
407407 191
408408 192
409409 193
410410 194
411411 195
412412 196 HB317 INTRODUCED
413413 Page 8
414414 (c) An action for a claim under this section must be
415415 brought within one year from the date the Attorney General
416416 knew or reasonably should have known of the alleged violation.
417417 (d) This section does not preclude any other available
418418 remedy at law or equity.
419419 Section 11. (a) A developer is not liable for a
420420 violation of this act if the developer demonstrates all of the
421421 following:
422422 (1) The developer relied in good faith on personal age
423423 verification data provided by an app store provider.
424424 (2) The developer relied in good faith on notification
425425 from an app store provider that verifiable parental consent
426426 was obtained.
427427 (3) The developer complied with the requirements of
428428 this act.
429429 (4) The developer relied upon a widely held industry
430430 standard when submitting information concerning parental
431431 consent disclosures.
432432 (b) Notwithstanding subsection (a), the safe harbor
433433 provision applies only to actions brought under this act and
434434 does not limit a developer or app store provider's liability
435435 under any other applicable law.
436436 Section 12. Nothing in this act shall be construed to
437437 do any of the following:
438438 (1) Prevent an app store provider from taking
439439 reasonable measures to do any of the following:
440440 a. Block, detect, or prevent distribution to minors of:
441441 (i) unlawful material; (ii) obscene material; or (iii) other
442442 harmful material.
443443 197
444444 198
445445 199
446446 200
447447 201
448448 202
449449 203
450450 204
451451 205
452452 206
453453 207
454454 208
455455 209
456456 210
457457 211
458458 212
459459 213
460460 214
461461 215
462462 216
463463 217
464464 218
465465 219
466466 220
467467 221
468468 222
469469 223
470470 224 HB317 INTRODUCED
471471 Page 9
472472 harmful material.
473473 b. Block or filter spam.
474474 c. Prevent criminal activity.
475475 d. Protect app store or app security.
476476 (2) Require an app store provider to disclose user
477477 information to a developer beyond age category or verification
478478 of parental consent status.
479479 (3) Allow an app store provider to implement measures
480480 required by this chapter in a manner that is: (i) arbitrary;
481481 (ii) capricious; (iii) anticompetitive; or (iv) unlawful.
482482 Section 13. This act shall become effective on October
483483 1, 2026.
484484 225
485485 226
486486 227
487487 228
488488 229
489489 230
490490 231
491491 232
492492 233
493493 234
494494 235