S 1722

Florida Senate - 2026  SB 1722
By Senator Calatayud
38-01471-26  20261722__
1A bill to be entitled
2An act relating to application stores; providing a
3short title; creating s. 501.1733, F.S.; defining
4terms; requiring an app store provider to take certain
5steps to verify the ages of individuals who create or
6who have existing accounts with the app store
7provider; providing parental consent requirements for
8accounts created or held by minors; providing
9notification and consent requirements for apps that
10have been significantly changed; requiring the app
11store provider to provide age category data and
12parental consent information to developers upon
13request; requiring app store providers to take certain
14steps to protect specified personal information;
15prohibiting app store providers from enforcing
16contracts or terms of service against a minor under
17certain circumstances, knowingly misrepresenting
18certain information, or sharing age category data;
19requiring developers to take certain steps to verify
20age information and to comply with certain measures;
21providing limits on and requirements for developers
22requesting age data; prohibiting developers from
23enforcing contracts or terms of service against a
24minor under certain circumstances, knowingly
25misrepresenting certain information, or sharing age
26category data; authorizing minors, or the parents of
27minors, to bring civil actions against app store
28providers or developers for violations of the act;
29authorizing courts to award prevailing plaintiffs with
30specified damages, fees, and costs; providing that a
31violation of this act is an unfair and deceptive trade
32practice; authorizing the Department of Legal Affairs
33to bring an action against app store providers and
34developers; providing jurisdiction; requiring the
35department to adopt specified rules; providing
36applicability; providing construction; providing for
37severability; providing an effective date.
38
39Be It Enacted by the Legislature of the State of Florida:
40
41Section 1. This act may be cited as the “App Store
42Accountability Act.”
43Section 2. Section 501.1733, Florida Statutes, is created
44to read:
45501.1733 Application stores.—
46(1)DEFINITIONS.—As used in this section, the term:
47(a)“Account holder” means an individual associated with a
48mobile device.
49(b)“Age category” means one of the following categories of
50individuals, based on age:
511.A child, which means an individual who is under 13 years
52of age;
532.A younger teenager, which means an individual who is at
54least 13 years of age and under 16 years of age;
553.An older teenager, which means an individual who is at
56least 16 years of age and under 18 years of age; or
574.An adult, which means an individual who is at least 18
58years of age.
59(c)“Age category data” means information about an account
60holder’s age category collected by an app store provider and
61shared with a developer.
62(d)“Age rating” means one or more classifications that
63assess the suitability of an app’s content and functions for
64different age categories.
65(e)“App” means a software application or electronic
66service that a user may run or direct on a mobile device. The
67term includes preinstalled applications.
68(f)“App store” means any publicly available website,
69software application, or electronic service that allows an
70account holder to download an app from a third-party developer
71onto a mobile device.
72(g)“App store provider” means a person that owns,
73operates, or controls an app store.
74(h)“Content description” means a description of the
75specific content elements or functions that informed an app’s
76age rating.
77(i)“Department” means the Department of Legal Affairs.
78(j)“Developer” means a person that owns or controls an app
79made available through an app store or an app preinstalled onto
80a mobile device.
81(k)“Knowingly” mean to act with actual knowledge or to act
82with knowledge fairly inferred based on objective circumstances.
83(l)“Minor” means,unless the individual is married or
84legally emancipated, an individual under 18 years of age.
85(m)“Minor account” means an account with an app store
86provider, established by an individual who is a minor, which is
87affiliated with a parent account.
88(n)“Mobile device” means a phone or general-purpose tablet
89that:
901.Provides cellular or wireless connectivity;
912.Is capable of connecting to the Internet;
923.Runs a mobile operating system; and
934.Is capable of running apps through the mobile operating
94system.
95(o)“Mobile operating system” means software that:
961.Manages mobile device hardware resources;
972.Provides common services for mobile device programs;
983.Controls memory allocation; and
994.Provides interfaces for apps to access device
100functionality.
101(p)“Parent” means, with respect to a minor, an individual
102reasonably believed to be a parent, a legal guardian, an
103individual with legal custody, or any other individual who has
104the legal authority to make decisions on behalf of the minor
105under applicable state law.
106(q)“Parent account” means an account with an app store
107provider which:
1081.Is verified to be established by an individual who the
109app store provider has determined is at least 18 years of age or
110married or emancipated through the app store provider’s age
111verification methods; and
1122.May be affiliated with one or more minor accounts.
113(r)“Parental consent disclosure” includes the following
114information:
1151.If the app store provider has an age rating for the app
116or in-app purchase, the app’s or in-app purchase’s age rating;
1172.If the app store provider has a content description for
118the app or in-app purchase, the app’s or in-app purchase’s
119content description;
1203.A description of:
121a.The personal data collected by the app from an account
122holder in compliance with, if applicable, part V of this
123chapter; and
124b.The personal data shared by the app and the methods
125implemented by the developer to protect the personal data,
126including,if the app meets the definition of a controller under
127s. 501.702, the methods implemented by the developer to comply
128with part V of this chapter; and
1294.Whether personal data is collected by the app and the
130methods implemented by the developer to protect the personal
131data, and, if the app meets the definition of a controller under
132s. 501.702, the methods implemented by the developer to comply
133with part V of this chapter.
134(s)“Preinstalled application” means any app, or portion
135thereof, which is present on a mobile device at the time of
136purchase, initial activation, or first use by the consumer,
137including browsers, search engines, and messaging, but excluding
138core operating system functions, essential device drivers, and
139applications necessary for basic device operation such as phone
140call, settings, and emergency service applications. The term
141includes apps, or portions thereof, installed or partially
142installed by the device manufacturer, wireless service provider,
143retailer, or any other party before purchase, initial
144activation, or first use by the consumer and which may be
145updated thereafter.
146(t)“Significant change” means a material modification to
147an app’s terms of service or privacy policy which:
1481.Changes the categories of data collected, stored, or
149shared;
1502.Alters the app’s age rating or content descriptions; or
1513.Introduces in-app purchases where in-app purchases were
152not previously present or introduces advertisements where
153advertisements were not previously present in the app.
154(u)“Verifiable parental consent” means authorization that:
1551.Is provided by a parent account;
1562.Is given after the app store provider has clearly and
157conspicuously provided the parental consent disclosure as part
158of the app download, purchase, or in-app purchase process; and
1593.Requires the parent to make an affirmative choice to
160grant consent or decline consent.
161(2)APP STORE PROVIDERS.—
162(a)An app store provider shall do all of the following:
1631.At the time an individual located in this state creates
164an account with the app store provider, or for existing
165accounts, by July 1, 2028, request age category information from
166the individual and verify the individual’s age category using:
167a.Commercially available methods reasonably designed to
168ensure accuracy; or
169b.An age verification method or process that complies with
170department rule.
1712.If the app store provider determines the individual is a
172minor, require that the account be affiliated with a parent
173account and obtain verifiable parental consent from the holder
174of the affiliated parent account each time before allowing the
175minor to download an app, purchase an app, or make an in-app
176purchase.
1773.After receiving notice of a significant change from a
178developer, notify the account holder of the significant change
179and, for a minor account, notify the parent account and obtain
180renewed verifiable parental consent before providing access to
181the significantly changed version of the app.
1824.Provide to a developer, in response to a request
183authorized under subsection (3), age category data for an
184account holder located in this state and the status of
185verifiable parental consent for a minor located in this state.
1865.Provide a mechanism for a parent account to withdraw
187consent and notify a developer when a parent revokes verifiable
188parental consent.
1896.Protect age category data and any associated
190verification data by:
191a.If applicable, complying with s. 501.1735;
192b.Limiting collection and processing to data necessary for
193verifying an account holder’s age category, obtaining verifiable
194parental consent, or maintaining compliance records; and
195c.Transmitting age category data using industry-standard
196encryption protocols that ensure data integrity and data
197confidentiality.
1987.For preinstalled apps, provide available age category
199information in response to a request from a developer and take
200reasonable measures to facilitate verifiable parental consent
201for use of the app in response to a request from a developer.
202(b)An app store provider may not:
2031.Enforce a contract or terms of service against a minor
204unless the app store provider has obtained verifiable parental
205consent;
2062.Knowingly misrepresent the information in the parental
207consent disclosure; or
2083.Share age category data and any associated data except
209as required by this section or otherwise required by law.
210(3)DEVELOPERS.—
211(a)A developer shall:
2121.Verify through the app store’s data-sharing methods the
213age category data of account holders located in this state, and
214for a minor’s account, whether verifiable parental consent has
215been obtained;
2162.Notify app store providers of significant changes to an
217app;
2183.Use age category data received through the app store’s
219data-sharing methods to enforce any developer-created, age
220related restrictions, safety-related features, or defaults, and
221to enforce compliance with applicable laws and regulations; and
2224.Request any age category data or verifiable parental
223consent at the time an account holder downloads an app,
224purchases an app, or launches a preinstalled app for the first
225time; when implementing a significant change to the app; or to
226comply with applicable law.
227(b)A developer may request age category data:
2281.No more than once during each 12-month period to verify
229the accuracy of age category data associated with an account
230holder or the continued account use within an age category
231listed in paragraph (1)(b);
2322.When there is reasonable suspicion of an account
233transfer or misuse outside of the age category; or
2343.At the time an account holder creates a new account with
235the developer.
236(c)When implementing any developer-created, age-related
237restrictions, safety-related features, or defaults, a developer
238must use the lowest age category listed in paragraph (1)(b)
239indicated by age category data received through the app store’s
240data-sharing methods or age data independently collected by the
241developer.
242(d)A developer may not:
2431.Enforce a contract or terms of service against a minor
244unless the developer has verified through an app store’s data
245sharing methods that verifiable parental consent has been
246obtained;
2472.Knowingly misrepresent any information in the parental
248consent disclosure; or
2493.Share age category data with any person.
250(4)ENFORCEMENT.—
251(a)A minor who has been harmed by a violation of this
252section, or such minor’s parent, may bring a civil action
253against an app store provider or a developer. In such action,
254the court shall award a prevailing plaintiff:
2551.The greater of actual damages or $1,000 for each
256violation;
2572.Punitive damages if the violation was egregious;
2583.Reasonable attorney fees; and
2594.Litigation costs.
260(b)A violation of this section is an unfair and deceptive
261trade practice actionable under part II of this chapter by the
262department. The department may bring an action against an app
263store provider or a developer to:
2641.Recover a civil penalty not to exceed $7,500 for each
265violation;
2662.Restrain or enjoin the app store provider or developer
267from violating this section;
2683.Seek injunctive relief;
2694.Recover reasonable attorney fees; and
2705.Recover litigation costs and the costs of investigating
271the violation.
272(c)For the purpose of bringing an action pursuant to this
273section, ss. 501.211 and 501.212 do not apply.
274(5)JURISDICTION.—For purposes of bringing an action
275pursuant to this section, any person who meets the definition of
276an app store provider or developer which operates or develops an
277app store or app likely to be accessed by minors and accessible
278by minors located in this state is considered to be both engaged
279in substantial and not isolated activities within this state and
280operating, conducting, engaging in, or carrying on a business
281and doing business in this state, and is therefore subject to
282the jurisdiction of the courts of this state.
283(6)RULES.—The department shall adopt rules to establish
284definite processes and means by which an app store provider may
285verify an account holder’s age category in accordance with this
286section.
287(7)SAFE HARBOR; APPLICABILITY.—
288(a)A developer is not liable for a violation of this
289section if the developer demonstrates that the developer:
2901.Relied in good faith on applicable age category data
291received through an app store’s data-sharing methods;
2922.Relied in good faith on notification from an app store
293provider that verifiable parental consent was obtained if the
294account holder was a minor; and
2953.Complied with the requirements of subsection (3).
296(b)In determining an app’s age rating and content
297description for purposes of this section, a developer is not
298liable for a violation of this section if the developer uses
299widely adopted industry standards to determine the app’s age
300category and content description and applies those standards
301consistently and in good faith.
302(c)This subsection applies only to actions brought under
303this section and does not limit a developer’s or app store
304provider’s liability under any other applicable law.
305(d)This section does not displace any other available
306rights or remedies authorized under federal or Florida law.
307(8)CONSTRUCTION.—This act may not be construed to do any
308of the following:
309(a)Prevent an app store provider or developer from taking
310reasonable measures to block, detect, or prevent distribution to
311minors of unlawful material, obscene material, or other harmful
312material; block or filter spam; prevent criminal activity; or
313protect app store or app security.
314(b)Require an app store provider to disclose user
315information to a developer beyond age category data or status of
316parental consent.
317(c)Allow an app store provider or developer to implement
318measures required by this section in a manner that is arbitrary,
319capricious, anticompetitive, or unlawful.
320(d)Require an app store provider or developer to obtain
321verifiable parental consent for an app that:
3221.Provides direct access to emergency services, including
323911, crisis hotlines, or emergency assistance services, legally
324available to minors;
3252.Limits data collection to information necessary to
326provide emergency services in compliance with the Children’s
327Online Privacy Protection Act, 15 U.S.C. s. 6501 et seq.;
3283.Provides access without requiring account creation or
329collection of unnecessary personal information; and
3304.Is operated by or in partnership with a governmental
331entity, a nonprofit organization, or an authorized emergency
332service provider.
333(e)Require a developer to collect, retain, reidentify, or
334link any information beyond what is necessary to verify age
335category data as required by this section, and what is
336collected, retained, reidentified, or linked in the developer’s
337ordinary course of business.
338(f)Require an app store provider or developer to block
339access to an application that an account holder has downloaded
340or installed onto a mobile device before July 1, 2027, except to
341the extent that a parent account revokes verifiable consent for
342an affiliated minor account or there has been a significant
343change to the application.
344Section 3. If any provision of this act or its application
345to any person or circumstance is held invalid, the invalidity
346does not affect other provisions or applications of this act
347which can be given effect without the invalid provision or
348application, and to this end the provisions of this act are
349severable.
350Section 4. This act shall take effect July 1, 2027.