Law / United States / 
Texas
SB 2420 (2025), App Store Accountability Act
Tex. Bus. & Com. Code ch. 121 (Subtitle C, Title 5)
In force since , under challenge in court.
An app store age verification (AV) rule binding private bodies.
- Audit expectation
- none
- Court action
A suit challenging this law is pending. No court has blocked it. Premium data
What it requires
- Binds app store providers such as the Apple App Store and Google Play Store. An app developer distributing through a store receives the age and consent information the store shares with it.
- Verify a user's age category.no control in the NIST Privacy Framework
- Link a minor's account to a parent account.no control in the NIST Privacy Framework
- Obtain parental consent before a minor can download an app or make an in app purchase.no control in the NIST Privacy Framework
- Share age and consent information with app developers.NIST Privacy FrameworkCT.PO-P2
These lines are LexLint's reading of the law's text. Also read by: Students Engaged in Advancing Texas v. Paxton, No. 25-51073 (5th Cir. ) (order granting stay pending appeal) (recorded ).
In the frameworks
- NIST Privacy Framework
- CT.PO-P2Policies, processes, and procedures for enabling data review, transfer, sharing or disclosure, alteration, and deletion are established and in place (e.g., to maintain data quality, manage data retention).
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalty structure
A violation of the App Store Accountability Act is a deceptive trade practice actionable under the Deceptive Trade Practices-Consumer Protection Act (Tex. Bus. & Com. Code ch. 121, sec. 121.101), which lets the consumer protection division of the Attorney General's office seek, and the trier of fact award, a civil penalty of not more than $10,000 per violation, plus, if the act or practice was calculated to acquire or deprive money or property from a consumer 65 or older, an additional amount of not more than $250,000 (Tex. Bus. & Com. Code sec. 17.47(c)).
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 10,000
Who enforces it
Enforcement body
Texas Attorney General, and enforceable as a deceptive trade practice under the Texas Deceptive Trade Practices-Consumer Protection Act.
Litigation
- Court
- U.S. District Court for the Western District of Texas; Fifth Circuit Court of Appeals; Supreme Court of the United States
- Docket
- Students Engaged in Advancing Texas v. Paxton, No. 1:25-cv-01662 (W.D. Tex.), and Computer & Communications Industry Association v. Paxton (W.D. Tex.); Supreme Court emergency applications Nos. 25A1389 and 25A1390
- Posture
- The district court granted preliminary injunctions on . The Fifth Circuit stayed the injunctions in late May 2026, granting a full stay pending appeal in early June 2026, and the Supreme Court denied the challengers' emergency applications to vacate the stay on in unsigned orders with no noted dissents. The law is enforceable while the Fifth Circuit's merits appeal proceeds; the consolidated appeals (Nos. 25-51073 and 26-50001) were calendared for oral argument on in New Orleans.
Settledness
The latest orders read are the Fifth Circuit's stay pending appeal of and the Supreme Court's denial on of an application to vacate that stay.
- As of
- Case link
- https://www.ca5.uscourts.gov/opinions/pub/25/25-51073-CV0.pdf
- Case citation
- Students Engaged in Advancing Texas v. Paxton, No. 25-51073 (5th Cir. ) (order granting stay pending appeal)
- Under challenge
- Yes
- Open questions
- Which changes "materially change[] the functionality or user experience" of an app under section 121.053(b)(4), when the Fifth Circuit read the phrase only in an order granting a stay pending appeal and the merits panel has not ruled?
What it reaches
Age threshold
18
Covered services
App marketplaces such as the Apple App Store and Google Play Store, and the app developers that distribute through them.
How the hook was established
express
What makes it apply
User location
Obligation class
Age verification, Consent, Disclosure, Security
Verification methods
Device signal, Parental consent
What it makes you log
Who may demand the log
Counterparty
What the log must hold
Age assurance result, Consent or opt-out state
Log retention
For the app store, section 121.025(1) limits collection and processing to the minimum necessary for verifying age, obtaining consent and maintaining compliance records, and sets no retention period.
- As of
- Basis
- Purpose bound
- Prohibits retaining
- Personal data an app developer received from the app store about a user's age category and parental consent, which the developer must delete on completion of its verification
Logging duty
Section 121.025(1) limits an app store's collection and processing of personal data to what is necessary for verifying age, obtaining parental consent and "maintaining compliance records", which names a compliance record of the age and consent checks. Section 121.024 has the store keep current age category and consent status for each user available to developers. Developers must delete the personal data the store provides on completion of their verification (121.055(b)).
- Kind
- Explicit
- As of
- Provision
- Tex. Bus. & Com. Code sections 121.021 to 121.025 and 121.054 to 121.055 (SB 2420, 2025)
- Trigger
- age_assurance
- consent_or_optout
What this law does
Requires app store providers to verify a user's age category, link a minor's account to a parent account, and obtain parental consent before a minor can download an app or make an in app purchase, and to share age and consent information with app developers. Violations are deceptive trade practices under Texas consumer protection law.
When LexLint raises it
When your app profile says your app operates an app store.
Back to the example · Lint your app
Page updated .