The Supreme Court of the United States declined to block Texas SB 2420, the nation’s first app store age-assurance law. The decision means the Texas law remains in full effect and signals growing judicial tolerance for state-level age-assurance mandates at a time when similar laws are advancing across the country. Below, we summarize the Supreme Court’s decision and its implications, the broader state landscape, and what app developers should be doing now.
The Supreme Court’s decision
Texas SB 2420 requires app stores to verify users' ages, obtain parental approval for minor users to download apps, and provide age and consent signals to app developers. A federal district court initially enjoined the law in December 2025, finding it likely violated the First Amendment. But on May 28, 2026, the U.S. Court of Appeals for the Fifth Circuit reversed and lifted the injunction, allowing the law to take effect immediately.
The challengers then filed an emergency application with the Supreme Court on June 10, asking the Court to vacate the Fifth Circuit's stay and restore the injunction. The Texas attorney general responded on June 22, urging the Court to deny the application and leave the law in place on the grounds that it is likely constitutional. The next day, Florida and 26 other states filed an amicus brief supporting Texas.
On July 6, the Supreme Court denied both applications, with no noted dissents. While the denial of an emergency application is not a ruling on the merits, it is a meaningful signal: The Court was not persuaded that the challengers would suffer irreparable harm sufficient to warrant halting the law. Combined with the 27-state amicus brief, the decision underscores the political and legal momentum behind app store age-assurance legislation nationwide.
What other states are doing
Texas is not alone. A growing number of states have enacted or are advancing age-assurance laws, and the Supreme Court’s decision is likely to accelerate that trend.
App store accountability laws
Utah, Louisiana, and Alabama have enacted laws similar to the Texas model, requiring app stores to (1) verify users’ ages and obtain parental approval for minor users to download apps and (2) transmit age and parental consent status to app developers.[1] The Utah law will go into effect May 6, 2027, and the Louisiana and Alabama laws could come into force in 2027, as well.
OS-level age assurance laws
Some states have taken a different approach, shifting age assurance from the app-store layer to the operating-system or device level. The California Digital Age Assurance Act, which takes effect January 1, 2027, establishes a device-level age-assurance framework under which operating system providers must collect a user’s age at account setup and transmit an age-range signal to app developers, indicating whether the user is under 13, 13 to 15, 16 to 17, or 18+.[2] The law itself imposes virtually no substantive obligations on app developers beyond ingesting the age signal. Its purpose and practical effect is to give developers “actual knowledge” that a user is a minor, which in turn triggers obligations under other teen privacy laws.
Colorado has followed California’s lead, enacting its own age-assurance law in June 2026.[3] The Colorado law will take effect for new device accounts in July 2028 and existing accounts by January 2029.
The California and Colorado laws have not been subject to legal challenges, and we think they are likely to be enforced. In California, developer obligations are expected to present a more significant enforcement-risk vector than in other states given the legislature's intent to use the age-signaling framework to activate compliance obligations under other laws.
States to watch
Illinois is another state to watch in this space. HB 5511, which is awaiting the governor's signature, would adopt a similar age-signal concept, though in a narrower form targeted to covered social media platforms, including platforms with addictive feeds, rather than app developers generally. Given the Supreme Court’s decision and the broad coalition of states that supported Texas, additional states are likely to introduce comparable legislation.
What developers should be doing now
With the Texas law in effect and enforcement risk rising, developers should take the following steps:
- Comply with Texas SB 2420: This means developers must (1) assign age ratings to each app and in-app purchase using the four statutory age categories (under 13, 13 to 15, 16 to 17, and 18+) and provide each app store with the rating and supporting content descriptors; (2) notify app stores of significant changes to terms, privacy practices, data collection, age ratings, monetization, functionality, or user experience; (3) ingest each user's age category and parental consent status from the app store and apply that information to enforce age-based restrictions; and (4) use app store age data only for permitted purposes (enforcing age protections, complying with law, and supporting safety features or defaults) and delete the data once verification is complete.
- Integrate with platform APIs: For developers that distribute apps through the App Store and Google Play, compliance requires parallel integrations with Apple's Declared Age Range API and Google's Play Age Signals API. Both platforms have published developer guidance specific to the Texas law (see here and here), which we recommend reviewing carefully.
- Prepare for the next wave of state laws: Developers should begin planning now for the Utah law (effective May 2027), the California Digital Age Assurance Act (effective January 2027), and the Colorado age assurance law (effective 2028-2029). In California in particular, the age-signaling framework will activate compliance obligations under other laws, making it a significant enforcement-risk vector.
- Audit downstream privacy obligations: Once a developer has "actual knowledge" that a user is a minor—whether through a Texas-style app store signal or a California-style OS-level signal—additional privacy obligations may attach. For example, under the California Consumer Privacy Act, developers will be prohibited from selling personal data or engaging in targeted advertising using personal data of individuals under 16. Developers should map which laws are triggered by the receipt of age signals and ensure their data practices are compliant.
- Monitor legislative and litigation developments: This area of law is evolving rapidly. The underlying constitutional questions remain unresolved, and additional legal challenges may follow as more states enact and enforce these laws. Companies should track developments at both the state and federal levels and be prepared to adjust their compliance strategies accordingly.
Endnotes
[1] S.B. 142, 2025 Gen. Sess. (Utah 2025), as amended by H.B. 498, 2026 Gen. Sess. (Utah 2026); S.B. 2420, 89th Leg., R.S. (Tex. 2025); H.B. 570, 2025 Leg., Reg. Sess. (La. 2025), as amended by H.B. 977, 2026 Leg., Reg. Sess. (La. 2026); H.B. 161, 2026 Leg., Reg. Sess. (Ala. 2026).
[2] Cal. Civ. Code §§1798.500–.505.
