Law / United States / 
California
AB 1043 (2025), Digital Age Assurance Act
Cal. Civ. Code §§ 1798.500-1798.505
An app store age verification (AV) rule binding private bodies.
- Age threshold
- 18
- Covered services
- Operating system providers and application developers.
- How the hook was established
- express
- What makes it apply
- User location
- Verification methods
- Self declaration, Device signal
- Audit expectation
- none
What it requires
- As an operating system provider, ask the account holder for a birth date or age at device setup, and send a real time age bracket signal (under 13, 13 to under 16, 16 to under 18, or 18 and older) to app developers. The stated duties fall on operating system providers; app developers receive the signal.NIST Privacy FrameworkCT.PO-P2
- Do not require government ID or biometric data to do so.NIST Privacy FrameworkCT.DP-P4
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- CT.DP-P4System or device configurations permit selective collection or disclosure of data elements.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Private right of actionNo
Penalties
Civil penalties up to $2,500 per affected child for a negligent violation and up to $7,500 for an intentional violation.
Who enforces it
Enforcement body
California Attorney General
Settledness
AB 1856 (Chapter 184, Statutes of 2026) amends this title.
- As of
- Open questions
- Does 'account setup' in Civil Code section 1798.501(a)(1) include the first-use setup of a device that has no user account, such as a shared or kiosk device, so that the operating system provider must ask for a birth date or age?
- Is a game console or a smart television a 'general purpose computing device' on which the operating system provider must provide the age interface and signal under sections 1798.500(g) and 1798.501(a)?
What it makes you log
Logging duty
The act has the operating system provider pass an age bracket signal and has the developer request it; neither duty names a log, record or audit trail, and section 1798.504(b) adds no collection beyond what section 1798.501 needs. The act also states no retention period for the signal.
- Kind
- None
- As of
What this law does
Requires operating system providers to ask account holders for a birth date or age at device setup and to send a real time age bracket signal (under 13, 13 to under 16, 16 to under 18, or 18 and older) to app developers, without requiring government ID or biometric data.
When LexLint raises it
When your app profile says your app operates an app store.
Back to the example · Lint your app
Page updated .