Colorado law requires age-range signals for covered apps

Operating system providers and covered app stores must make age signals available to covered apps. This applies to an operating system provider that runs a covered app store or pre-installs one, and to covered app stores that commercially distribute third-party apps. Some software distributors are excluded. At account setup, an account holder must provide the device user’s birth date, age, or age range; for an adult, the provider may allow the account holder to choose an age range without giving a birth date or age. Providers and stores must send only the information needed to comply with the law and may not share an age signal for an unrelated purpose. These requirements take effect July 1, 2028.

Covered apps must request and use age signals under specified rules. These rules cover consumer apps accessed through covered app stores that may be run or directed by a device user. Apps that do not process personal data and apps from free, public code repositories are excluded. Apps must generally treat the signal as the main indicator of a user’s age. If a developer has clear and convincing information that the user’s age differs, it must use that information instead. Apps may use signals only to comply with applicable law, must limit requests to necessary information, and may not share signals for unrelated purposes. A family account app may use the primary account holder’s age for safety defaults and access to features, and may let that person attest to subaccount users’ ages. These rules take effect July 1, 2028. Certain previously downloaded apps must request an age signal by January 1, 2029.

The law allows civil penalties for violations and protects some providers that make a good-faith effort to comply. Penalties apply to a person who violates the law. The good-faith protection applies to operating system providers and covered app stores. The attorney general may recover up to $2,500 for each minor harmed by each negligent violation, or up to $7,500 for each minor harmed by each intentional violation. An operating system provider or covered app store that makes a good-faith effort to comply, considering available technology and reasonable technical limits or outages, is not liable for an incorrect age signal or for an app’s conduct based on that signal. These provisions take effect July 1, 2028, subject to the referendum condition.

The law excludes certain services and software, and bars providers and stores from favoring their own apps when complying. These exclusions and limits apply to the age-attestation rules for operating system providers, covered app stores, and developers. The law does not apply to broadband or telecommunications services, physical products, certain government and higher education data used for noncommercial purposes, or software distributed under licenses that permit unrestricted copying, redistribution, and modification. Certain business communication apps, enterprise software, and apps that provide or obtain technical support are also excluded. Providers and stores may not impose less strict rules on their own apps than on third-party apps, or misuse nonpublic data gathered for compliance to compete, favor their services, or violate applicable law. These provisions take effect July 1, 2028, subject to the referendum condition.