[Congressional Bills 119th Congress]
[From the U.S. Government Publishing Office]
[S. 5090 Introduced in Senate (IS)]
<DOC>
119th CONGRESS
2d Session
S. 5090
To require operating system providers to require users to indicate
their age and developers of applications, covered internet website
operators, and browser providers to request a signal from operating
system providers that indicates a user's age, and for other purposes.
_______________________________________________________________________
IN THE SENATE OF THE UNITED STATES
July 22, 2026
Mr. Kim (for himself, Ms. Lummis, Mr. Schiff, and Mr. Barrasso)
introduced the following bill; which was read twice and referred to the
Committee on Commerce, Science, and Transportation
_______________________________________________________________________
A BILL
To require operating system providers to require users to indicate
their age and developers of applications, covered internet website
operators, and browser providers to request a signal from operating
system providers that indicates a user's age, and for other purposes.
Be it enacted by the Senate and House of Representatives of the
United States of America in Congress assembled,
SECTION 1. SHORT TITLE.
This Act may be cited as the ``Digital Age Assurance Act of 2026''.
SEC. 2. DEFINITIONS.
In this Act:
(1) Age bracket data.--The term ``age bracket data'' means
non-personally identifiable data derived from a user's date of
birth or age for the purpose of sharing information to indicate
the user's age range, including whether a user--
(A) has not attained 13 years of age;
(B) has attained 13 years of age but not 16 years
of age;
(C) has attained 16 years of age but not 17 years
of age; or
(D) has attained 17 years of age.
(2) Application.--
(A) In general.--The term ``application'' means a
software program that may be run or directed by a user
on a covered device.
(B) Exceptions.--The term ``application'' does not
include--
(i) telecommunications services (as defined
in section 3(53) of the Communications Act of
1934 (47 U.S.C. 153(53))); or
(ii) a software component that is not
offered to users as a standalone software
program through an application store.
(3) Application store.--
(A) In general.--The term ``application store''
means an application, online service, or platform that
distributes and facilitates the download of
applications from third party developers by users of a
covered device.
(B) Exception.--The term ``application store'' does
not include an online service or platform that
distributes extensions, plug-ins, add-ons, or other
software components that run exclusively within a
separate host application.
(4) Browser.--The term ``browser'' means an application
that enables a user to visit an internet website.
(5) Browser provider.--The term ``browser provider'' means
a person that owns, maintains, or controls a browser for use on
a covered device.
(6) Child.--The term ``child'' means an individual who has
not attained 17 years of age.
(7) Commission.--The term ``Commission'' means the Federal
Trade Commission.
(8) Covered device.--The term ``covered device'' means a
computer, mobile device, or other general purpose computing
device that has the capability to run an operating system.
(9) Covered internet website.--The term ``covered internet
website'' means an internet website that is required under
Federal or State law to verify the age of a user prior to
granting such user access to content or services provided on
such internet website.
(10) Covered internet website operator.--The term ``covered
internet website operator'' means a person that owns,
maintains, or controls a covered internet website that is
required under Federal or State law to verify the age of a user
prior to granting to such user access to content or services
provided on such covered internet website.
(11) Developer.--The term ``developer'' means a person that
owns, maintains, or controls an application (including an
application store).
(12) Operating system provider.--The term ``operating
system provider'' means a person that develops, licenses, or
controls the operating system software on a covered device.
(13) Signal.--The term ``signal'' means the age bracket
data of a user--
(A) sent by a real-time secure application
programming interface or operating system to a
developer, browser provider, or covered internet
website operator; or
(B) communicated by a browser provider to a covered
internet website operator in any technically feasible
manner.
(14) User.--The term ``user'' means an individual who
primarily uses a covered device.
(15) Verifiable credential.--The term ``verifiable
credential'' means a tamper-evident, cryptographically signed
digital credential that--
(A) enables a user to demonstrate such user's age
or age bracket data; and
(B) discloses no other information regarding such
user.
(16) Zero-knowledge proof.--The term ``zero-knowledge
proof'' means a cryptographic method by which a user
demonstrates the age bracket data of a user without revealing
any information beyond what is necessary to establish such age
bracket data (such as the exact age, date of birth, or other
personal information of the user).
SEC. 3. REQUIREMENTS FOR OPERATING SYSTEM PROVIDERS.
(a) In General.--
(1) Requirements.--Subject to paragraph (2), each operating
system provider shall--
(A) for each covered device, subject to clause
(ii), require that in order to use the operating system
of the provider on such device--
(i) with respect to an account created on
or after the effective date, require each user
to establish an account with the provider
through a process that requires the user to
indicate the date of birth and age of the user;
and
(ii) with respect to an account existing as
of the effective date, unless the operating
system provider knows the age of the user for
purposes of compliance with any legal
obligation, administration of its own terms of
services or policies, or confirming
authorization for any purchase within an
application, require the user who is the
account holder to provide the date of birth and
age of such user;
(B) using the information described in subparagraph
(A)--
(i) classify such information into age
bracket data associated with such user; and
(ii) provide to a developer, browser
provider, or covered internet website operator
who has requested a signal with respect to a
user a signal containing the age bracket data
of a user through a reliable real-time
application programming interface, using, where
technically feasible, in an interoperable
format, and subject to paragraph (3), a
verifiable credential or zero-knowledge proof;
(C) if the information described in subparagraph
(A) indicates that a user is a child, require that the
child link their account to the account of a parent or
legal guardian; and
(D) provide each user or parent or legal guardian
of a user if such user is a child with a mechanism to
allow such user or parent or legal guardian to view the
age bracket data of such user.
(2) Exceptions.--
(A) Emergency phone calls.--The requirements
described in paragraph (1) shall not apply in the event
that a user is using an operating system to make an
emergency phone call.
(B) Emancipated minors.--The requirement described
in paragraph (1)(C) shall not apply to a child who is
an emancipated minor.
(3) Consensus based interoperability standards.--An
operating system provider that uses a verifiable credential or
zero-knowledge proof to send a signal pursuant to paragraph
(1)(B)(ii) shall send such signal in a manner that is
consistent with widely adopted, consensus-based
interoperability standards.
(b) Limitation on Use and Deidentification of Age Bracket Data.--An
operating system provider--
(1) shall--
(A) only send age bracket data in accordance with
subsection (a)(1)(B)(ii);
(B) employ reasonable security safeguards to
protect such data;
(C) only retain such data that is necessary to
generate and transmit a signal under subsection
(a)(1)(B)(ii); and
(D) when a user deletes the account associated with
the operating system of such provider, deidentify or
securely delete such data associated with such account;
and
(2) except as provided in subsection (a)(1)(B)(ii), may not
share such data with a third party.
(c) Operating System Provider Safe Harbor.--An operating system
provider acting in good faith to comply with this section shall not be
liable if there is an electrical or internet outage or other technical
error that prevents such provider from providing a signal to a
developer under subsection (a)(1)(B)(ii).
(d) Conflicting Age Information.--If an operating system provider
receives clear and convincing information that a user's age is
different than the age range indicated in the age bracket data
contained in the signal provided pursuant to subsection (a)(1)(B) from
a developer or covered internet website operator under section
4(c)(1)(B), such operating system provider shall--
(1) verify the age of the user; and
(2) provide an updated signal regarding such user to each
developer, browser provider, or covered internet website
operator that was provided the original signal with respect to
such user.
SEC. 4. REQUIREMENTS FOR DEVELOPERS AND COVERED INTERNET WEBSITE
OPERATORS.
(a) Requesting Age Bracket Data.--
(1) In general.--A developer and covered internet website
operator shall--
(A) for each application of the developer or
covered internet website of a covered internet website
operator published or updated on or after the effective
date of this Act, each time a user downloads and uses
such application or accesses such covered internet
website on a covered device for the first time, request
a signal from an operating system provider or, with
respect to a covered internet website operator, the
browser provider from which the covered internet
website is being accessed;
(B) for each application of the developer or
covered internet website of a covered internet website
operator published or updated before the effective date
of this Act, not later than 7 months after such date,
with respect to an application, each time a user uses
such application request a signal from an operating
system provider or, with respect to a covered internet
website operator, request a signal once from the
browser provider from which the website is being
accessed; and
(C) use the age bracket data contained in a
signal--
(i) except as described under subsection
(c) and subject to paragraph (2), as the
primary indicator of a user's age; and
(ii) to comply with any applicable law or
policy of an application store regarding age
requirements for a user of such application or
covered internet website.
(2) Actual knowledge.--If a developer or covered internet
website operator has received a signal with respect to a user
pursuant to paragraph (1), such developer or covered internet
website operator shall be deemed to have actual knowledge of
the age bracket data of such user across all platforms and
points of access of the application of the developer or covered
internet website of the covered internet website operator.
(b) Complying With Internal Policies.--It shall be unlawful for a
developer or covered internet website operator to allow a user to
access an application of such developer or covered internet website of
such operator if--
(1) the developer or covered internet website operator has
determined that access to such application, a feature of such
application, or covered internet website is inappropriate for
users within a certain age bracket; and
(2) the age bracket data of such user contained in a signal
indicates that the user falls within such age bracket.
(c) Other Age Information.--
(1) In general.--Subject to paragraph (2), if a developer
or covered internet website operator has clear and convincing
information that a user's age is different than the age range
indicated in the age bracket data contained in the signal
requested under subparagraph (A) or (B) of subsection (a)(1),
such developer or covered internet website operator shall--
(A) until the developer or covered internet website
operator receives an updated signal from an operating
system provider pursuant to paragraph (2), use such
clear and convincing information as the primary
indicator of the age of such user;
(B) to the extent technically feasible, transmit
such clear and convincing information to the operating
system provider from which such developer or covered
internet website operator received the signal regarding
such user by using the same mechanism such developer or
covered internet website operator used to receive such
signal; and
(C) provide a notice containing a general
description of such clear and convincing information
to--
(i) such user; or
(ii) if such user is a child, the parent or
legal guardian whose account is linked to the
account of the user pursuant to section
3(a)(1)(C).
(2) Conflicting age information.--If a developer or covered
internet website operator receives an updated signal from an
operating system provider pursuant to section 3(d)(2), such
developer or covered internet website operator shall use the
age bracket data contained in such updated signal with respect
to such user.
(3) Opportunity to correct.--A developer or internet
website operator that provides a notice described in paragraph
(1)(C) shall--
(A) provide a mechanism through which a user or the
parent or legal guardian of a user whose account is
linked to a user pursuant to section 3(a)(1)(C) may
provide updated age information; and
(B) not later than 30 days after receiving such
updated age information, provide such user or parent or
legal guardian with a determination with respect to the
age information of the user.
(d) Use of Information.--A developer or covered internet website
operator may not--
(1) request more information about a user from an operating
system provider than the signal described in subparagraph (A)
or (B) of subsection (a)(1); or
(2) share the signal or age bracket data contained in the
signal with a third party.
(e) Developer and Covered Internet Website Operator Safe Harbor.--A
developer or covered internet website operator acting in good faith to
comply with this section shall not be liable for conduct resulting from
an erroneous signal indicating a user's age range received from an
operating system provider pursuant to section 3(a)(B)(ii) or an
application store pursuant to section 5(a).
SEC. 5. REQUIREMENTS FOR DEVELOPERS OF APPLICATION STORES AND BROWSER
PROVIDERS.
(a) Developers of Application Stores.--A developer of an
application store shall--
(1) the first time a user accesses the application store on
a covered device, request a signal from an operating system
provider; and
(2) provide such signal to another developer upon request.
(b) Browser Providers.--A browser provider shall--
(1) the first time a user accesses the browser on a covered
device, request a signal from an operating system provider; and
(2) provide such signal to a covered internet website
operator upon request.
SEC. 6. REQUIREMENTS FOR DEVELOPERS, COVERED INTERNET WEBSITE
OPERATORS, AND OPERATING SYSTEM PROVIDERS REGARDING DATA
USE MINIMIZATION.
A developer, covered internet website operator, or operating system
provider may not--
(1) collect more data regarding a user than is necessary
to--
(A) generate age bracket data and transmit or
receive a signal; or
(B) perform the basic functions of an application,
covered internet website, or operating system;
(2) sell age bracket data contained in a signal;
(3) use age bracket data for profiling, engagement
optimization, or targeted advertising; or
(4) combine age bracket data with other personal or
inferred information regarding a user.
SEC. 7. PROHIBITING TARGETED ADVERTISING TO, AND DATA MONETIZATION OF,
CHILDREN.
(a) Targeted Advertising.--
(1) In general.--It shall be unlawful for any person to
engage in targeted advertising to a user the person knows, or
reasonably should know, is a child.
(2) Clarification.--Nothing in this subsection shall be
construed to prohibit contextual advertising that does not rely
on personal data or behavioral profiling.
(b) Data Monetization.--It shall be unlawful for any person to
sell, license, rent, trade, transfer, release, disclose, provide access
to, or otherwise make available to a data broker the personal data of a
user the person knows, or reasonably should know, is a child.
SEC. 8. ENFORCEMENT.
(a) Enforcement by the Commission.--
(1) Unfair or deceptive acts.--A violation of section 3, 4,
5, 6, or 7, or a regulation promulgated thereunder shall be
treated as a violation of a rule defining an unfair or
deceptive act or practice prescribed under section 18(a)(1)(B)
of the Federal Trade Commission Act (15 U.S.C. 57a(a)(1)(B)).
(2) Powers of commission.--
(A) In general.--The Commission shall enforce this
Act and any regulation promulgated under this Act, by
the same means, and with the same jurisdiction, powers,
and duties as though all applicable terms and
provisions of the Federal Trade Commission Act (15
U.S.C. 41 et seq.) were incorporated into and made a
part of this Act.
(B) Privileges and immunities.--Except as provided
in subparagraph (D), any person who violates section 3,
4, 5, 6, or 7 or any regulation promulgated thereunder,
shall be subject to the penalties and entitled to the
privileges and immunities provided in the Federal Trade
Commission Act (15 U.S.C. 41 et seq.).
(C) Authority preserved.--Nothing in this Act shall
be construed to limit the authority of the Commission
under any other provision of law.
(D) Civil penalties.--
(i) In general.--In addition to any other
penalties as may be prescribed by law, each
violation of section 3, 4, 5, 6, or 7 or a
regulation promulgated thereunder, shall carry
a civil penalty not to exceed--
(I) for a negligent violation,
$2,500; and
(II) for a knowing or intentional
violation, $7,500.
(ii) Affected children.--In any case in
which a violation of section 3, 4, 5, 6, or 7
affected a child (as determined by the
Commission), the penalties described in clause
(i) may be multiplied by the number of children
affected.
(E) Rulemaking.--Not later than 1 year after the
date of enactment of this Act, the Commission shall
promulgate in accordance with section 553 of title 5,
United States Code, such rules as may be necessary to
carry out this Act.
(b) Enforcement by State Attorneys General.--
(1) In general.--In any case in which the attorney general
of a State has reason to believe that an interest of the
residents of the State has been or is threatened or adversely
affected by the engagement of any person in an act or practice
that violates section 3, 4, 5, 6, or 7, the attorney general of
the State may, as parens patriae, bring a civil action on
behalf of the residents of the State in an appropriate district
court of the United States or a State court of appropriate
jurisdiction to--
(A) enjoin any further such violation by such
person;
(B) enforce compliance with such section;
(C) obtain a permanent, temporary, or preliminary
injunction;
(D) obtain damages, restitution, or other
compensation on behalf of residents of the State; or
(E) obtain such other relief as the court may
consider appropriate.
(2) Rights of the commission.--
(A) Notice to the commission.--
(i) In general.--Except as provided in
clause (ii), before initiating a civil action
under paragraph (1), the attorney general of a
State shall provide to the Commission a written
notice of such action and a copy of the
complaint for such action.
(ii) Exception.--If the attorney general
determines that it is not feasible to provide
the notice described in clause (i) before
initiating a civil action under paragraph (1),
the attorney general shall provide written
notice of the action and a copy of the
complaint to the Commission immediately upon
initiating the civil action.
(B) Intervention.--The Commission may--
(i) intervene in any civil action brought
by the attorney general under paragraph (1);
and
(ii) upon intervening--
(I) if applicable, remove the
action to an appropriate United States
district court;
(II) be heard on all matters
arising in the civil action; and
(III) file petitions for appeal of
a decision in the civil action.
(3) Investigatory powers.--Nothing in this subsection may
be construed to prevent the attorney general of a State from
exercising the powers conferred on the attorney general by the
laws of the State to conduct investigations, to administer
oaths or affirmations, or to compel the attendance of witnesses
or the production of documentary or other evidence.
(4) Limitation on state action while federal action is
pending.--If the Commission has instituted a civil action for a
violation of section 3, 4, 5, 6, or 7, no State attorney
general may, without the approval of the Commission, bring an
action under this subsection during the pendency of that action
against any defendant named in the complaint of the Commission
for any violation of this section alleged in the complaint.
(5) Venue; service of process.--
(A) Venue.--Any action brought under paragraph (1)
may be brought in--
(i) the district court of the United States
that meets applicable requirements relating to
venue under section 1391 of title 28, United
States Code; or
(ii) another court of competent
jurisdiction.
(B) Service of process.--In an action brought under
paragraph (1) in a district court of the United States,
process may be served in any district in which--
(i) the defendant is an inhabitant, may be
found, or transacts business; or
(ii) venue is proper under section 1391 of
title 28, United States Code.
(c) Safe Harbor.--An operating system provider, covered internet
website operator, or developer acting in good faith to comply with this
Act shall not be liable under this Act if a user inputs inaccurate
information under section 3(a)(1).
SEC. 9. PROHIBITION ON ANTICOMPETITIVE PRACTICES.
(a) Consistent Age-Related Requirements.--An operating system
provider or an application store provider shall, with respect to an
application developed by a third party, impose age-related restrictions
and obligations on the application and distribution of the application
that are the same as or less restrictive than the restrictions and
obligations it imposes on its own applications and distribution of its
own applications.
(b) Use of Collected Data.--An operating system provider or an
application store may not use age bracket data collected from a third
party with respect to the applications or distribution of the
applications of the third party to engage in anticompetitive behavior
with respect to the third party, including by--
(1) offering the applications or services of the operating
system provider or application store at terms and conditions
such that users will prefer such applications or services to
the applications or services of a third party; and
(2) using age bracket data.
(c) Interoperable Credentialing.--An operating system provider or
application store may not require a developer, browser provider, or
covered internet website operator to use a proprietary software
development kit, licensing agreement, or other exclusive technical
dependency as a condition of verifying a signal, unless such
requirement is reasonably necessary to ensure security, privacy, fraud
prevention, or the integrity of the verification process.
(d) Enforcement.--
(1) Unlawful method of competition.--A violation of this
section or a regulation promulgated under this section shall be
deemed to be an unlawful method of competition in violation of
section 5 of the Federal Trade Commission Act (15 U.S.C. 45)
and a per se violation of section 1 of the Sherman Act (15
U.S.C. 1).
(2) Enforcement.--
(A) In general.--The Commission shall enforce this
section and any regulation promulgated under this
section in the same manner, by the same means, and with
the same jurisdiction, powers, and duties as though all
applicable terms and provisions of the Federal Trade
Commission Act (15 U.S.C. 41 et seq.) were incorporated
into and made a part of this section.
(B) Enforcement authorities.--
(i) Federal trade commission.--If the
Federal Trade Commission has reason to believe
that a person violated this section, and in so
doing, committed a violation of section 5 of
the Federal Trade Commission Act (15 U.S.C.
45), the Commission may commence a civil
action, in its own name by any of its attorneys
designated by it for such purpose, to recover a
civil penalty and seek other appropriate
relief.
(ii) Attorney general.--The Attorney
General shall enforce this section in the same
manner, by the same means, and with the same
jurisdiction, powers and duties as though all
applicable terms of the Sherman Act (15 U.S.C.
1 et seq.), Clayton Act (15 U.S.C. 12 et seq.),
and Antitrust Civil Process Act (15 U.S.C. 1311
et seq.) were incorporated into and made a part
of this section.
(iii) State attorneys general.--Any
attorney general of a State shall enforce this
section in the same manner, by the same means,
and with the same jurisdiction, powers and
duties as though all applicable terms of the
Sherman Act (15 U.S.C. 1 et seq.) and the
Clayton Act (15 U.S.C. 12 et seq.) were
incorporated into and made a part of this
section.
SEC. 10. RULES OF CONSTRUCTION AND OTHER MATTERS.
Nothing in this Act shall be construed to--
(1) preempt section 444 of the General Educational
Provisions Act (20 U.S.C. 1232g) (commonly known as the
``Family Educational Rights and Privacy Act of 1974'') or any
other Federal or State law governing student privacy;
(2) preempt the Children's Online Privacy Protection Act of
1998 (15 U.S.C. 6501 et seq.) or any rule promulgated under
such Act;
(3) authorize any action that would conflict with section
18(h) of the Federal Trade Commission Act (15 U.S.C. 57a(h));
(4) expand, limit, or alter the meaning or scope of section
230 of the Communications Act of 1934 (47 U.S.C. 230);
(5) require--
(A) except as provided in sections 3, 4, and 5 an
operating system provider, covered internet website
operator, application store, browser provider, or
developer to affirmatively collect personal data with
respect to a user's age beyond what an operating system
provider, covered internet website operator,
application store, browser provider, or developer
collects in their normal course of business; or
(B) any person to verify the age of a user
through--
(i) the collection of a government-issued
identification document, biometric information,
or other sensitive personal information; or
(ii) facial age estimation technology;
(6) restrict the ability of an operating system provider,
covered internet website operator, developer, browser provider,
or application store to--
(A) cooperate with law-enforcement agencies
regarding activity reasonably believed to violate
Federal, State, or local law;
(B) comply with lawful civil, criminal, or
regulatory process, including a subpoena or summons;
(C) investigate, establish, or defend legal claims;
or
(D) prevent, detect, or respond to security
incidents, fraud, or other illegal activity; or
(7) require a particular technological method of
generating, transmitting, or verifying a signal.
SEC. 11. EFFECTIVE DATE.
This Act shall take effect on the date that is 18 months after the
date of the enactment of this Act.
SEC. 12. SEVERABILITY.
If any provision or application of this Act is held invalid, the
remainder of such Act shall remain in effect.
SEC. 13. RELATIONSHIP TO OTHER LAWS.
The provisions of this Act shall preempt any State law or
regulation only to the extent that such State law or regulation
conflicts with a provision of this Act. Nothing in this Act or any
regulation promulgated thereunder shall be construed to prohibit or
otherwise affect the enactment or enforcement of any Federal law or
regulation or State law or regulation that is at least as protective of
individuals as this Act and the regulations promulgated thereunder.
<all>