Law / United States / 
Louisiana
Act 185 of 2026 (HB 977), App Store Accountability Act, replacing Act 481 of 2025 (HB 570)
La. R.S. 51:1771 to 51:1775 (Acts 2026, No. 185; Acts 2025, No. 481 did not become effective)
An app store age verification (AV) rule binding private bodies.
- Age threshold
- 18
- Covered services
- Application store providers and app developers offering apps in Louisiana.
- How the hook was established
- express
- What makes it apply
- User location
- Verification methods
- Device signal, Parental consent
- Audit expectation
- none
What it requires
- This law puts duties on covered application store providers, meaning a person who owns, operates or controls a covered application store that allows users in Louisiana to download applications, and on developers of applications made available through a covered application store in Louisiana.
- As a covered application store provider, when an individual located in Louisiana creates an account, request age information and verify the individual's age category using commercially available methods reasonably designed to ensure accuracy.no control in the NIST Privacy Framework
- As a covered application store provider, if the individual is a minor, require the account to be affiliated with a parent account and obtain verifiable parental consent from the parent account holder before the minor downloads an application, purchases an application, accesses an application pre-loaded on a device, or enables in-application purchases.no control in the NIST Privacy Framework
- As a covered application store provider, notify the user of a significant change reported by a developer and, for a minor account, notify the parent account holder and obtain renewed verifiable parental consent.no control in the NIST Privacy Framework
- As a covered application store provider, give a developer that makes an authorized request the age category and the verified parental consent status of a user located in Louisiana, and notify the developer when a parent revokes parental consent.NIST Privacy FrameworkCT.PO-P2
- As a covered application store provider, limit the collection and processing of personal age verification data to verifying age, obtaining parental consent and maintaining compliance records, and transmit it using industry-standard encryption.NIST Privacy FrameworkCT.PO-P1NIST Privacy FrameworkPR.DS-P2
- As a covered application store provider, do not enforce a contract or terms of service against a minor without verifiable parental consent, do not knowingly misrepresent the parental consent disclosure, and do not share age verification data except with a developer as the law requires or as otherwise required by law.NIST Privacy FrameworkCT.PO-P1
- As a developer, verify through the covered application store's data sharing methods the age category of users located in Louisiana and, for a minor account, whether verifiable parental consent has been obtained.no control in the NIST Privacy Framework
- As a developer, notify covered application store providers of a significant change to the application, and enforce all age-related restrictions, including any you created.no control in the NIST Privacy Framework
- As a developer, do not enforce a contract or terms of service against a minor unless you have verified through the covered application store provider that verifiable parental consent has been obtained, do not knowingly misrepresent the parental consent disclosure, and do not sell age category data.NIST Privacy FrameworkCT.PO-P1
- As a developer required by R.S. 9:2800.29 to verify age at the application level, remain responsible for that verification; a developer required by law to verify age at the application level to whom that section does not apply may use the age signal from the covered application store.no control in the NIST Privacy Framework
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.PO-P1Policies, processes, and procedures for authorizing data processing (e.g., organizational decisions, individual consent), revoking authorizations, and maintaining authorizations are established and in place.
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
- PR.DS-P2Data-in-transit are protected.
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Penalty structure
A civil fine of up to $10,000 per violation, set by the Attorney General, after written notice at least 45 days before an enforcement action; no action may be started if the violation is cured within 45 days of the notice, unless the person fails to cure or repeats the violation after curing. A person who violates an administrative or court order issued for a violation of the Part is subject to a civil penalty of not more than $5,000 per violation.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 10,000
Who enforces it
Enforcement body
Louisiana Attorney General
Settledness
- As of
- Open questions
- What makes a method "commercially available" and "reasonably designed to ensure accuracy" under R.S. 51:1772(A)(1)(b)(i) for verifying that an account holder is an adult, when paragraph (b)(ii) defines "commercially available" only for individuals under eighteen years of age?
- May a covered application store provider accept "affirmative age attestation by someone who is reasonably believed to be the parent or legal guardian" under R.S. 51:1772(A)(1)(b)(ii) from a person it has not verified as an adult, when "verifiable parental consent" in R.S. 51:1771(20) must come from an individual whom the provider "has verified is an adult"?
What it makes you log
Who may demand the log
Counterparty
What the log must hold
Age assurance result, Consent or opt-out state
Log retention
- As of
- Basis
- Purpose bound
- Prohibits retaining
- Personal age verification data beyond what is needed for verifying a user's age, obtaining parental consent and maintaining compliance records
Logging duty
Section 1772(A)(6) limits an application store provider's collection and processing of personal age verification data to what is needed for verifying age, obtaining parental consent and maintaining compliance records, so the provider is expected to keep records of compliance, and subsection (A)(4) requires it to supply a developer with a user's age category and parental consent status on request. The statute does not say what the compliance records hold or how long they are kept, and it names no audit; section 1774 only gives a good faith defense to a provider that demonstrates compliance.
- Kind
- Implicit
- As of
- Provision
- La. R.S. 51:1772(A)(6)(a)(iii) and (A)(4), enacted by Acts 2026, No. 185
- Trigger
- age_assurance
What this law does
Act 481 of 2025 had provided for these duties to begin on . Act 185 of 2026 (HB 977) provides that Act No. 481 of the 2025 Regular Session shall not become effective. The Governor signed Act 185 on . Act 185 enacts a replacement App Store Accountability Act as sections 51:1771 through 51:1775 of Title 51 of the Louisiana Revised Statutes. The sections of Act 185 that enact the replacement take effect on .
A covered application store provider must, when an individual located in Louisiana creates an account, request age information and verify the individual's age category using commercially available methods reasonably designed to ensure accuracy.
If the individual is a minor, the provider must require the account to be affiliated with a parent account and obtain verifiable parental consent before the minor downloads an application, purchases an application, accesses a pre-loaded application, or enables in-application purchases. A provider may not enforce a contract or terms of service against a minor unless it has obtained verifiable parental consent.
A developer must verify through the covered application store's data sharing methods the age category of users located in Louisiana and, for a minor account, whether verifiable parental consent has been obtained.
The Attorney General may bring a civil action to enforce the law, and a covered application store or developer that violates it is subject to a civil fine of up to $10,000 per violation set by the Attorney General.
The Attorney General must give written notice at least forty-five days before initiating an enforcement action and may not initiate one if the person cures the violation within forty-five days after receiving the notice, with exceptions for a failure to cure and a repeat violation of the same provision.
When LexLint raises it
When your app profile says your app operates an app store or ships a mobile app.
Back to the example · Lint your app
Page updated .