Age verification signals: software applications and online services.

The bill was reformatted from an official authenticated chaptered document (with state headers, page numbers, and formal layout) to a web-based display format that includes website navigation elements such as skip-to-content links, search boxes, sidebar menus, and version history dropdowns. No legislative language was added, removed, or altered.

The bill was assigned Chapter 675 and the approval date of October 13, 2025 was inserted, replacing the blank signature blocks from the enrolled version.

Page headers changed from 'AB 1043' to 'Ch. 675' and line wrapping was adjusted throughout the document to match the official chaptered law format.

Age brackets reduced from six categories (under 5, 5-10, 10-13, 13-16, 16-18, 18+) to four categories (under 13, 13-16, 16-18, 18+), eliminating the under-5 and 5-10 brackets

The definition of 'covered manufacturer' was removed entirely; obligations previously assigned to a 'covered manufacturer' are now placed directly on 'operating system provider'

The definition of 'signal' was narrowed by removing 'or notice of parent or guardian consent,' so a signal now only refers to age bracket data

The definition of 'child' changed from 'a consumer natural person who is under 18 years of age' to 'a natural person who is under 18 years of age,' removing the word 'consumer'

A presumption of accuracy for developers who rely in good faith on a signal (which would have shielded them from liability under other state age verification laws) was removed

Developer obligation changed from 'may use that signal to comply with applicable law' to 'shall use that signal to comply with applicable law,' making compliance mandatory rather than optional

The definition of 'developer' was narrowed from a person who 'creates, owns, maintains, or controls an application and is responsible for the design, development, maintenance, and distribution of the application to end users' to simply 'a person that owns, maintains, or controls an application.' This removes 'creates' as a trigger and drops the responsibility clause, potentially excluding some entities from coverage.

The definition of 'account holder' was changed from 'a device user who is under 18 years of age' to 'a user who is under 18 years of age,' removing the word 'device' and slightly broadening who qualifies as an account holder.

The specific enumerated features developers must provide (managing linked accounts, delivering age-appropriate content, and limiting daily screen time) were removed. The requirement was simplified to just 'connect account holders with any existing tools to support a user,' which is less prescriptive.

A new obligation was added requiring a developer with actual knowledge of a user's age to 'request a signal with respect to a particular user from a covered manufacturer when that user requests to download an application.' This creates a new active duty on developers at the point of download.

The covered manufacturer's obligation to provide age bracket signals was modified to require that the developer has 'requested a signal with respect to a particular user' before the manufacturer must provide it, adding a request-based trigger rather than an automatic provision.

The provision treating a received age signal as the 'authoritative primary indicator' for compliance with any state law requiring age verification or parental consent was narrowed. The word 'authoritative' was removed, and the reference to compliance with other state laws was deleted. The signal is now only the 'primary indicator' for determining the user's age under this title.

The actual knowledge presumption (that receiving a signal means the developer knows the user's age) was expanded in scope to apply 'across all platforms of the application and points of access of the application,' while also being limited to signals received 'pursuant to this title.'

Multiple provisions had 'pursuant to this title' inserted, narrowing the scope of when the safe harbor presumption, data minimization rules, and other protections apply - limiting them to signals generated under this specific law rather than any age signal.

The definition of 'account holder' now explicitly excludes a parent of an emancipated minor and a parent or legal guardian who is not associated with a user's device, narrowing who can act as an account holder.

The definition of 'developer' now includes a person who 'maintains' an application, not just one who creates, owns, or controls it.

Age indication is now specifically required 'at account setup' rather than at any time, clarifying when the covered manufacturer must collect age information.

New data minimization rule: covered manufacturers must send only the minimum amount of information necessary and shall not share digital signal information with a third party for a purpose not required by this title.

Developer obligations no longer include the 'to the extent technically feasible' qualifier, making the requirement to provide readily available features for account holders more absolute. The obligation is also reframed as connecting account holders with existing tools rather than providing features for child users specifically.

The signal is now described as the 'authoritative primary indicator' of a user's age rather than simply 'the authoritative indicator,' slightly softening its status while still making it the main reference point.

New developer data minimization rule: developers who receive an age signal may use it to comply with applicable law but shall not request more information than necessary or share the signal with a third party for a purpose not required by this title.

The parental consent requirement for app downloads by users under 16 now only applies to users 'who has an account holder,' meaning no consent is required if no account holder is associated with the device.

A developer that receives a signal indicating a user's age is now deemed to have actual knowledge 'even if the developer willfully disregards the signal,' closing a potential loophole.

The presumption of accuracy for developers relying in good faith on a signal is now explicitly rebuttable by credible evidence that the user's actual age differs from the signal.

New safe harbor provision (Section 1798.502(b)): a covered manufacturer making a good faith effort to comply, considering available technology and reasonable technical limitations or outages, is not liable for an erroneous signal or for any conduct by a developer that receives the signal.

A severability clause (Section 1798.503(e)) was added, declaring that if any provision is held invalid, the remaining provisions continue in effect.

New definition of 'account holder' as a parent or legal guardian of a device user under 18, replacing the prior use of 'device owners' and 'parents' in key obligations

New definition of 'user' limited to a child who is the primary user of the device, narrowing the population covered by the bill's requirements

Age information must now be provided by 'account holders' (parents/guardians of minors) rather than any 'device owner,' meaning adults using their own devices are no longer required to provide age data under this title

The nonsubstantive amendment to Section 1798.1 of the Civil Code (Information Practices Act of 1977) was removed from the bill entirely

New provision (b)(3) requires developers to treat a manufacturer-provided age signal as the authoritative indicator of a user's age for compliance with any state law requiring age verification or parental consent

New provision (b)(4) creates a good-faith safe harbor: a developer that relies in good faith on a covered manufacturer's age signal is presumed to have accurately determined the user's age and to be in compliance with applicable state laws

Fiscal committee vote changed from 'no' to 'yes,' indicating the bill now carries a fiscal impact requiring fiscal committee approval

Entirely new Title 1.81.9 (Digital Age Assurance Act) added to the Civil Code with Sections 1798.500 through 1798.503, replacing what was previously a nonsubstantive technical fix to Section 1798.1.

The new title does not modify antitrust law, does not require collection of additional personal information beyond what is necessary for compliance, requires nondiscriminatory compliance, and its protections are additive to existing laws including the California Age-Appropriate Design Code Act.

Senator Umberg added as principal coauthor, indicating the bill now has cross-chamber sponsorship.

New definitions for 'age bracket data' (six brackets: under 5, 5-9, 10-12, 13-15, 16-17, 18+), 'covered manufacturer' (device maker, OS provider, or app store), 'developer,' 'signal' (age bracket data or parental consent notice sent via real-time secure API), and 'child' (under 18).

Covered manufacturers must provide an accessible interface for device owners to indicate the user's birth date or age, solely to generate age bracket signals for apps in covered application stores.

Covered application stores must obtain parental or guardian consent before permitting children under 16 to download applications, provide developers a signal indicating whether consent was given, and offer an option to connect parents with developers to manage parental tools.

Covered manufacturers must provide developers with a digital signal via real-time API indicating which age bracket a user falls into (under 5, 5-9, 10-12, 13-15, 16-17, or 18+).

Developers with actual knowledge that a user is a child via an age signal must, to the extent technically feasible, provide parental features including managing linked accounts for users under 18, managing delivery of age-appropriate content, and limiting daily screen time.

Civil penalties of up to $2,500 per affected child per negligent violation and up to $7,500 per affected child per intentional violation, enforceable only through civil action by the Attorney General. Injunctive relief also available.

Age bracket signals are presumed accurate, and developers may rely on them for compliance with any state law requiring age verification or parental consent.

Fiscal committee review changed from 'no' to 'yes,' indicating the bill now has potential fiscal impact requiring committee analysis.