App stores and app developers and providing a penalty

The bill also requires an app store provider, each time it receives notice from a developer that an app on the app store has undergone a significant change, to notify all app store account holders that have downloaded the app of the significant change. In addition, if the account holder is a minor, the app store provider must 1) notify a parent affiliated with the minor account of the significant change; and 2) obtain from the parent renewed verifiable parental consent before providing the changed app to the minor.

The bill requires an app store provider to provide to each developer of an app available on the app store, in response to the developer’s request (as discussed below), age category data for an account holder and the status of verifiable parental consent for a minor. An app store provider must also provide a mechanism for a parent to revoke prior consent for a minor and for notifying a developer when parental consent is revoked. In addition, an app store provider must protect age category data and any associated verification data by 1) limiting the collection and processing of data to that necessary for verifying an account holder's age category, obtaining verifiable parental consent, or maintaining compliance records; and 2) transmitting age category data using encryption protocols. With respect to pre-installed apps, an app store provider must, in response to a request from a developer, provide available age category information to the developer and take reasonable measures to facilitate verifiable parental consent for use of the pre-installed app. The bill defines a “pre-installed app” as any app, or portion of any app, that is present on a mobile device at the time of purchase, initial activation, or first use by a consumer, subject to certain exclusions. An app store provider may not 1) enforce a contract or terms of service against a minor unless the app store provider has obtained verifiable parental consent; 2) knowingly misrepresent any information in a parental consent disclosure; or 3) share or disclose age category data and any associated data except as required by law.

The bill requires a developer to do all of the following: 1) verify through an app store's data sharing methods the age category data of account holders located in this state and, for a minor account, whether verifiable parental consent has been obtained; 2) notify an app store provider each time the developer’s app has undergone a significant change; 3) use age category data received through an app store's data sharing methods to enforce any developer-created, age-related restrictions, safety-related features, or defaults; 4) request age category data or verifiable parental consent at all of the following times: when an an account holder purchases an app, downloads an app, or launches a pre-installed app for the first time; when the developer implements a significant change to the app; and when necessary to comply with applicable law. A developer may request age category data for any of the following purposes: 1) to verify the accuracy of age category data associated with an account holder or to verify continued account use within the age category, but the developer may not request this age category data more than once during any 12-month period; 2) when there is reasonable suspicion of account transfer or misuse outside of the age category; and 3) at the time an account holder creates a new account with the developer. When implementing any developer-created, age-related restrictions, safety-related features, or defaults, a developer must use the lowest age category indicated by age category data received through an app store's data sharing methods or by age data independently collected by the developer. A developer may not 1) enforce a contract or terms of service against a minor unless the developer has verified through an app store's data sharing methods that verifiable parental consent has been obtained with respect to the minor; 2) knowingly misrepresent any information in a parental consent disclosure; or 3) share age category data with any person.

Under the bill, the Department of Agriculture, Trade and Consumer Protection, or the Department of Justice in consultation with DATCP, may bring a civil action against an app store provider or developer that violates the bill’s provisions seeking any combination of the following relief: a forfeiture not exceeding $7,500 for each violation; temporary or permanent injunctive relief; and court costs and attorney fees, plus investigative costs. The bill also provides for a private cause of action. A minor, or the parent of a minor, who has been harmed by a violation may bring a civil action against an app store provider or a developer to recover all of the following: the greater of actual damages or $1,000 for each violation; punitive damages if the violation was egregious; and court costs and attorney fees. In addition, a violation of the bill’s provisions is a violation of the unfair and deceptive trade practice law. However, a developer is not liable for a violation if the developer satisfies certain requirements.