Age verification signals: software applications.

All definitions and obligations related to 'browser,' 'browser provider,' and 'internet website operator' are deleted. The bill no longer requires browsers to transmit age signals to websites, and internet website operators are no longer subject to the title's requirements.

The definition of 'signal' is narrowed from two prongs (API/OS to application, OR browser provider to internet website operator) to a single prong: data sent by a real-time secure API or operating system to an application.

New Section 1798.504(h) clarifies that a compliant developer is not required to request an age signal at every account login after initial account creation.

New Section 1798.504(i) clarifies that the title does not prohibit a developer from periodically requesting an age signal to maintain compliance after the initial download and launch.

Section 1798.501(a)(1) now requires signals to be provided only to covered application stores and developers, removing browser providers and internet website operators from the list of required recipients.

The 'actual knowledge' provision in Section 1798.501(d)(2)(A) is restructured into two subparts: (i) any platform where the user may create an account accessed by that same application, and (ii) any point of access used to create or log into an account from the referenced device. This narrows when a developer is deemed to have actual knowledge of a user's age.

The condition triggering operating system provider obligations is expanded: the operating system must now 'operate on a device and have an account setup feature' rather than simply 'have an account setup feature with respect to the use of the operating system on a particular device.'

A new good faith safe harbor is added in Section 1798.503(c): a developer that makes a good faith effort to comply shall not be liable for an erroneous signal or any conduct by the operating system that sent the signal.

The existing good faith safe harbor in Section 1798.503(b) is updated to remove 'browser provider' from the list of protected entities, now covering only operating systems and covered application stores.

New Section 1798.501(e) prohibits any person from requesting a signal with respect to a particular user from an operating system provider or covered application store unless required to do so by the Digital Age Assurance Act or another applicable law.

The actual knowledge imputation rule in Section 1798.501(d)(2)(A) was expanded: a developer or internet website operator that receives a signal is now deemed to have actual knowledge of the user's age range across all platforms of the application, including any internet website owned, maintained, or controlled by the developer, and at all points of access including websites used to create an account or log in.

Restructured the covered application store obligations in Section 1798.501(c) from subparagraphs (A) and (B) into paragraphs (1) and (2), with browser provider duties moved to paragraph (2). Also changed 'shall not do either of the following' to 'shall not do any of the following' in Section 1798.501(d)(4).

Added 'provider' to the list of entities in Section 1798.501(d)(4)(A) from whom a developer may not request more information than necessary, and made hyphenation corrections changing 'general purpose computing device' to 'general-purpose computing device' throughout.

The definition of 'application' was narrowed from 'a software application or online service, product, or feature' to just 'a software application,' with an added exclusion for software components not offered as stand-alone executable applications through a covered application store. This removes online services, products, and features from the bill's coverage.

The definition of 'developer' was changed from 'a person that owns, maintains, or controls an application' to 'a person that owns an application, or maintains or controls the hosting of the application, in a covered application store.' This limits developer obligations to those with a direct relationship to a covered application store.

A new exclusion was added to the 'operating system provider' definition: it does not include a person or entity that distributes an operating system or application under license terms permitting a recipient to copy, redistribute, and modify the software (i.e., open-source licenses).

The entire definition of 'online service, product, or feature' (with its exclusions for broadband, telecommunications, and physical products) was removed, consistent with narrowing the scope away from online services.

The definition of 'clear and convincing information' was expanded to include age information shared with a developer by an account holder regarding a user 'associated with the account,' not just users of subaccounts of a primary account.

Language deeming developers to have actual knowledge 'across all platforms of the application and points of access' was removed. Knowledge is now limited to when the user accesses the application from the specific device referenced in the signal request.

The liability exemption in Section 1798.504(g) was changed from protecting specific entities (operating system providers, covered application stores, developers) from liability arising from 'a device' being used by someone other than the signal user, to a general exemption for any entity from liability arising from 'a shared device or application' being used by someone other than the signal user. This broadens which entities are protected but narrows the scenario to 'shared' devices.

Browser providers and internet website operators are now explicitly covered entities under the bill. A browser provider must request an age signal from the operating system and pass it to internet website operators upon request. An internet website operator must request a signal from the user's browser provider when the user accesses the site.

New Section 1798.504 adds antitrust protections requiring operating system providers and covered application stores to apply the same restrictions to their own applications as to third-party apps, and prohibits using compliance data to compete against third parties or give preferential treatment.

New Section 1798.504 clarifies that the title does not require collection of additional personal information beyond what is necessary for compliance, does not apply to broadband internet access services, telecommunications services, or delivery of physical products, and does not impose liability for use of a device by someone other than the user to whom a signal pertains.

New definitions added for 'browser,' 'browser provider,' and 'internet website operator' (a person that owns, maintains, or controls an internet website subject to age verification law).

The definition of 'signal' was expanded to include signals communicated by a browser provider to an internet website operator in any technically feasible manner, not just signals sent by an operating system to an application.

Operating system providers must now provide age signals to four types of recipients (covered application stores, developers, browser providers, and internet website operators) rather than just developers or covered application stores.

A new prohibition prevents any entity subject to the title from prompting a user to change their age information.

The 'actual knowledge' deeming provision now applies to both developers and internet website operators, and when a developer or website operator uses internal clear-and-convincing information that differs from a signal, they are deemed to have actual knowledge of the true age range.

New Section 1798.503 establishes civil penalties of up to $2,500 per affected child for negligent violations and $7,500 per affected child for intentional violations, enforceable only through civil action by the Attorney General.

A safe harbor provision shields operating system providers, browser providers, and covered application stores from liability for erroneous signals or downstream conduct by developers or website operators when they have made a good faith effort to comply, considering available technology and reasonable technical limitations.

The definition of 'application' is expanded from only 'a software application' to 'a software application or online service, product, or feature.' This brings a much wider range of digital services under the age verification signal requirements.

A new subsection (g) defines what is excluded from 'online service, product, or feature': broadband internet access services (Section 3100), telecommunications services (47 U.S.C. 153), and the delivery or use of a physical product.

The definition of 'user' as 'a child that is the primary user of the device' is deleted from Section 1798.500.

A new clause in Section 1798.501(c)(3)(B)(ii) defines 'clear and convincing information' to include, but not be limited to, age information shared with a developer by an account holder regarding the age of a user of a subaccount of the primary account.

The fiscal committee requirement changed from 'no' to 'yes,' meaning the bill now requires review by the Legislative Fiscal Committee before passage.

The bill now amends three Civil Code sections (1798.500, 1798.501, and 1798.502) instead of just Section 1798.501, expanding its reach across the age verification framework.

A new Section 1798.500 is added providing definitions for 'account holder,' 'age bracket data,' 'application,' 'child,' 'covered application store,' 'developer,' 'operating system provider,' 'signal,' and 'user.' The definition of 'user' is specified as a child who is the primary user of a device.

Section 1798.501 now conditions the operating system provider's obligation on whether its operating system has an account setup feature for the particular device, meaning OS providers without such a feature are exempt from the interface requirement.

Developers' deemed actual knowledge of a user's age range is now limited to 'when the user accesses the application from the device referenced in paragraph (1)' rather than applying broadly across all platforms and points of access without qualification.

The signal request timing language changed from 'when the application is downloaded and launched' to 'when the application is downloaded onto, and launched from, a particular device,' tying the obligation to a specific device.

A new Section 1798.502 adds transitional deadlines: operating system providers must provide an accessible interface for pre-2027 devices by July 1, 2027, and developers of applications last updated on or after January 1, 2026 that were downloaded before January 1, 2027 must request a signal by July 1, 2027.

The fiscal committee designation changed from 'no' to 'yes,' indicating the bill now requires review by the Legislative Fiscal Committee, suggesting potential state fiscal impact was identified.