The app store becomes the age gate

Requiring every website to check a visitor's age is unenforceable, and legislatures spent several years discovering it. The approach that replaced it is narrower and considerably more likely to work: put the obligation on the two companies that distribute nearly all mobile software.

Several states have now enacted app store accountability laws. Counsel tracking them describe obligations that fall on both store operators and individual developers, which is the part developers tend to miss when they read the headlines.

The mechanism is account-level. The store verifies the age of the account holder, sorts accounts into brackets, links a minor's account to a parent's, and obtains verifiable consent before that minor downloads a covered app or makes a purchase.

That design is the point. There are thousands of apps and two stores, so an obligation placed at the store reaches the whole market through two compliance programs rather than thousands, and it is enforceable because both operators are large, identifiable and within reach.

Effective dates are staggered and have already moved. Analysis of the state laws describes a group of states adopting the app store approach on their own schedules, with obligations phasing in across this year and next.

Litigation has shaped the rollout more than drafting has. One state's law is operating while an appeal proceeds; another had its substantive obligations pushed back a full year and its enforcement narrowed to private suits rather than action by the attorney general.

For developers the practical burden is not verification, which the store performs. It is the signal the store passes back: an app now learns something about the age bracket of the person installing it, and has to behave differently depending on the answer.

That obligation is easy to state and awkward to build. An app designed on the assumption that every user is the same has to grow a second mode, with different defaults, different data handling and in some cases different features, and it has to do so before the compliance date rather than after the first complaint.

The privacy objection is real and unresolved. A regime that reliably establishes age has, by construction, collected something that establishes identity, and the assurance that the data stays at the store is a policy commitment rather than a technical property.

Advocates for the approach answer that the alternative was worse: every site collecting identity documents individually, with no shared standard and no meaningful oversight of what happened to the scans afterwards.

Neither position resolves the underlying tension, and the states have chosen. Age assurance now lives in the distribution layer, and the interesting question for the next two years is whether a duty concentrated in two companies proves easier to enforce or easier to lobby.