Law / United States / 
California
AB 1856 (2026), Digital Age Assurance Act amendments (operating systems and application stores)New, enacted
2026 Cal. Stats. ch. 184 (AB 1856), amending Cal. Civ. Code §§ 1798.500-1798.504
An app store age verification (AV) rule binding private bodies.
- Audit expectation
- none
What it requires
- Applies to any operating system that operates on a device and has an account setup feature, and to the application developers and covered application stores already reached by the Digital Age Assurance Act; browsers and website operators are not covered.
- As an operating system provider, send the age signal to a covered application store or to an application developer.NIST Privacy FrameworkCT.PO-P2
- As a developer, request a signal when an application is downloaded and launched, treat the signal as the primary indicator of a user's age absent clear and convincing contrary information, and do not request more information than the minimum needed.NIST Privacy FrameworkCT.DP-P4
- Do not request a signal unless this title or other applicable law requires it.NIST Privacy FrameworkCT.PO-P1
- For a device or application already set up or downloaded before , request or provide the signal by .NIST Privacy FrameworkCT.PO-P2
- As an operating system provider or application store, do not use compliance data anticompetitively (a nondiscrimination duty).NIST Privacy FrameworkCT.PO-P1
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- CT.DP-P4System or device configurations permit selective collection or disclosure of data elements.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
Who enforces it
Enforcement body
California Attorney General
Settledness
- As of
- Open questions
- Does the exclusion in Civil Code section 1798.500(g)(2) for a person that distributes an operating system 'under license terms that permit a recipient to copy, redistribute, and modify the software' reach a vendor that ships a build of such a system with components licensed on terms that do not permit copying and redistribution?
- Who is the 'primary user' of a device that several people share, whose age bracket the operating system provider must report under sections 1798.500(h) and 1798.501(a)(1), and does the account holder's answer at account setup settle it?
What it reaches
Covered services
Operating system providers with an account setup feature, and the application developers and covered application stores already reached by AB 1043; browsers and website operators are not covered.
How the hook was established
express
What makes it apply
User location
Verification methods
Device signal, Self declaration
What it makes you log
Logging duty
The amendments keep the age bracket signal model: the operating system provider sends a signal and the developer requests it. No provision names a log, record or audit trail, and none states a retention period; section 1798.504(b) adds no collection beyond what section 1798.501 needs.
- Kind
- None
- As of
What this law does
AB 1856, enacted as 2026 Cal. Stats. ch. 184, amends the Digital Age Assurance Act (Civil Code Sections 1798.500 to 1798.504) rather than extending it to browsers or websites: it applies the age-signal duty to any operating system that operates on a device and has an account setup feature, removes the prior definition tying the protected 'user' to a child, and requires the signal be sent to a covered application store or to an application developer.
A developer must request a signal when an application is downloaded and launched, must treat the signal as the primary indicator of a user's age absent clear and convincing contrary information, and may not request more information than the minimum needed; nobody may request a signal unless required by this title or other applicable law.
For a device or application already set up or downloaded before , the operating system provider or developer must request or provide the signal by .
The Act carries forward the Digital Age Assurance Act's existing Attorney General civil enforcement (up to $2,500 per affected child for a negligent violation or $7,500 for an intentional violation) and adds good faith compliance defenses and a nondiscrimination duty barring an operating system or application store from using compliance data anticompetitively. Approved by the Governor and chaptered , effective .
When LexLint raises it
When your app profile says your app operates an app store or ships a mobile app.
Back to the example · Lint your app
Page updated .