S. 5090

119 S5090 IS: Digital Age Assurance Act of 2026
 U.S. Senate
 2026-07-22
 text/xml
 EN
 Pursuant to Title 17 Section 105 of the United States Code, this file is not subject to copyright protection and is in the public domain.
 II  119th CONGRESS  2d Session  S. 5090  IN THE SENATE OF THE UNITED STATES   July 22, 2026   Mr. Kim  (for himself,  Ms. Lummis ,  Mr. Schiff , and  Mr. Barrasso ) introduced the following bill; which was read twice and referred to the  Committee on Commerce, Science, and Transportation    A BILL
To require operating system providers to require users to indicate their age and developers of applications, covered internet website operators, and browser providers to request a signal from operating system providers that indicates a user's age, and for other purposes.
1.
Short title
This Act may be cited as the   Digital Age Assurance Act of 2026  .
2.
Definitions
In this Act:
(1)
Age bracket data
The term  age bracket data  means non-personally identifiable data derived from a user's date of birth or age for the purpose of sharing information to indicate the user's age range, including whether a user—
(A)
has not attained 13 years of age;
(B)
has attained 13 years of age but not 16 years of age;
(C)
has attained 16 years of age but not 17 years of age; or
(D)
has attained 17 years of age.
(2)
Application
(A)
In general
The term  application  means a software program that may be run or directed by a user on a covered device.
(B)
Exceptions
The term  application  does not include—
(i)
telecommunications services (as defined in section 3(53) of the Communications Act of 1934 ( 47 U.S.C. 153(53) )); or
(ii)
a software component that is not offered to users as a standalone software program through an application store.
(3)
Application store
(A)
In general
The term  application store  means an application, online service, or platform that distributes and facilitates the download of applications from third party developers by users of a covered device.
(B)
Exception
The term  application store  does not include an online service or platform that distributes extensions, plug-ins, add-ons, or other software components that run exclusively within a separate host application.
(4)
Browser
The term  browser  means an application that enables a user to visit an internet website.
(5)
Browser provider
The term  browser provider  means a person that owns, maintains, or controls a browser for use on a covered device.
(6)
Child
The term  child  means an individual who has not attained 17 years of age.
(7)
Commission
The term  Commission  means the Federal Trade Commission.
(8)
Covered device
The term  covered device  means a computer, mobile device, or other general purpose computing device that has the capability to run an operating system.
(9)
Covered internet website
The term  covered internet website  means an internet website that is required under Federal or State law to verify the age of a user prior to granting such user access to content or services provided on such internet website.
(10)
Covered internet website operator
The term  covered internet website operator  means a person that owns, maintains, or controls a covered internet website that is required under Federal or State law to verify the age of a user prior to granting to such user access to content or services provided on such covered internet website.
(11)
Developer
The term  developer  means a person that owns, maintains, or controls an application (including an application store).
(12)
Operating system provider
The term  operating system provider  means a person that develops, licenses, or controls the operating system software on a covered device.
(13)
Signal
The term  signal  means the age bracket data of a user—
(A)
sent by a real-time secure application programming interface or operating system to a developer, browser provider, or covered internet website operator; or
(B)
communicated by a browser provider to a covered internet website operator in any technically feasible manner.
(14)
User
The term  user  means an individual who primarily uses a covered device.
(15)
Verifiable credential
The term  verifiable credential  means a tamper-evident, cryptographically signed digital credential that—
(A)
enables a user to demonstrate such user's age or age bracket data; and
(B)
discloses no other information regarding such user.
(16)
Zero-knowledge proof
The term  zero-knowledge proof  means a cryptographic method by which a user demonstrates the age bracket data of a user without revealing any information beyond what is necessary to establish such age bracket data (such as the exact age, date of birth, or other personal information of the user).
3.
Requirements for operating system providers
(a)
In general
(1)
Requirements
Subject to paragraph (2), each operating system provider shall—
(A)
for each covered device, subject to clause (ii), require that in order to use the operating system of the provider on such device—
(i)
with respect to an account created on or after the effective date, require each user to establish an account with the provider through a process that requires the user to indicate the date of birth and age of the user; and
(ii)
with respect to an account existing as of the effective date, unless the operating system provider knows the age of the user for purposes of compliance with any legal obligation, administration of its own terms of services or policies, or confirming authorization for any purchase within an application, require the user who is the account holder to provide the date of birth and age of such user;
(B)
using the information described in subparagraph (A)—
(i)
classify such information into age bracket data associated with such user; and
(ii)
provide to a developer, browser provider, or covered internet website operator who has requested a signal with respect to a user a signal containing the age bracket data of a user through a reliable real-time application programming interface, using, where technically feasible, in an interoperable format, and subject to paragraph (3), a verifiable credential or zero-knowledge proof;
(C)
if the information described in subparagraph (A) indicates that a user is a child, require that the child link their account to the account of a parent or legal guardian; and
(D)
provide each user or parent or legal guardian of a user if such user is a child with a mechanism to allow such user or parent or legal guardian to view the age bracket data of such user.
(2)
Exceptions
(A)
Emergency phone calls
The requirements described in paragraph (1) shall not apply in the event that a user is using an operating system to make an emergency phone call.
(B)
Emancipated minors
The requirement described in paragraph (1)(C) shall not apply to a child who is an emancipated minor.
(3)
Consensus based interoperability standards
An operating system provider that uses a verifiable credential or zero-knowledge proof to send a signal pursuant to paragraph (1)(B)(ii) shall send such signal in a manner that is consistent with widely adopted, consensus-based interoperability standards.
(b)
Limitation on use and deidentification of age bracket data
An operating system provider—
(1)
shall—
(A)
only send age bracket data in accordance with subsection (a)(1)(B)(ii);
(B)
employ reasonable security safeguards to protect such data;
(C)
only retain such data that is necessary to generate and transmit a signal under subsection (a)(1)(B)(ii); and
(D)
when a user deletes the account associated with the operating system of such provider, deidentify or securely delete such data associated with such account; and
(2)
except as provided in subsection (a)(1)(B)(ii), may not share such data with a third party.
(c)
Operating system provider safe harbor
An operating system provider acting in good faith to comply with this section shall not be liable if there is an electrical or internet outage or other technical error that prevents such provider from providing a signal to a developer under subsection (a)(1)(B)(ii).
(d)
Conflicting age information
If an operating system provider receives clear and convincing information that a user's age is different than the age range indicated in the age bracket data contained in the signal provided pursuant to subsection (a)(1)(B) from a developer or covered internet website operator under section 4(c)(1)(B), such operating system provider shall—
(1)
verify the age of the user; and
(2)
provide an updated signal regarding such user to each developer, browser provider, or covered internet website operator that was provided the original signal with respect to such user.
4.
Requirements for developers and covered internet website operators
(a)
Requesting age bracket data
(1)
In general
A developer and covered internet website operator shall—
(A)
for each application of the developer or covered internet website of a covered internet website operator published or updated on or after the effective date of this Act, each time a user downloads and uses such application or accesses such covered internet website on a covered device for the first time, request a signal from an operating system provider or, with respect to a covered internet website operator, the browser provider from which the covered internet website is being accessed;
(B)
for each application of the developer or covered internet website of a covered internet website operator published or updated before the effective date of this Act, not later than 7 months after such date, with respect to an application, each time a user uses such application request a signal from an operating system provider or, with respect to a covered internet website operator, request a signal once from the browser provider from which the website is being accessed; and
(C)
use the age bracket data contained in a signal—
(i)
except as described under subsection (c) and subject to paragraph (2), as the primary indicator of a user's age; and
(ii)
to comply with any applicable law or policy of an application store regarding age requirements for a user of such application or covered internet website.
(2)
Actual knowledge
If a developer or covered internet website operator has received a signal with respect to a user pursuant to paragraph (1), such developer or covered internet website operator shall be deemed to have actual knowledge of the age bracket data of such user across all platforms and points of access of the application of the developer or covered internet website of the covered internet website operator.
(b)
Complying with internal policies
It shall be unlawful for a developer or covered internet website operator to allow a user to access an application of such developer or covered internet website of such operator if—
(1)
the developer or covered internet website operator has determined that access to such application, a feature of such application, or covered internet website is inappropriate for users within a certain age bracket; and
(2)
the age bracket data of such user contained in a signal indicates that the user falls within such age bracket.
(c)
Other age information
(1)
In general
Subject to paragraph (2), if a developer or covered internet website operator has clear and convincing information that a user's age is different than the age range indicated in the age bracket data contained in the signal requested under subparagraph (A) or (B) of subsection (a)(1), such developer or covered internet website operator shall—
(A)
until the developer or covered internet website operator receives an updated signal from an operating system provider pursuant to paragraph (2), use such clear and convincing information as the primary indicator of the age of such user;
(B)
to the extent technically feasible, transmit such clear and convincing information to the operating system provider from which such developer or covered internet website operator received the signal regarding such user by using the same mechanism such developer or covered internet website operator used to receive such signal; and
(C)
provide a notice containing a general description of such clear and convincing information to—
(i)
such user; or
(ii)
if such user is a child, the parent or legal guardian whose account is linked to the account of the user pursuant to section 3(a)(1)(C).
(2)
Conflicting age information
If a developer or covered internet website operator receives an updated signal from an operating system provider pursuant to section 3(d)(2), such developer or covered internet website operator shall use the age bracket data contained in such updated signal with respect to such user.
(3)
Opportunity to correct
A developer or internet website operator that provides a notice described in paragraph (1)(C) shall—
(A)
provide a mechanism through which a user or the parent or legal guardian of a user whose account is linked to a user pursuant to section 3(a)(1)(C) may provide updated age information; and
(B)
not later than 30 days after receiving such updated age information, provide such user or parent or legal guardian with a determination with respect to the age information of the user.
(d)
Use of information
A developer or covered internet website operator may not—
(1)
request more information about a user from an operating system provider than the signal described in subparagraph (A) or (B) of subsection (a)(1); or
(2)
share the signal or age bracket data contained in the signal with a third party.
(e)
Developer and covered internet website operator safe harbor
A developer or covered internet website operator acting in good faith to comply with this section shall not be liable for conduct resulting from an erroneous signal indicating a user’s age range received from an operating system provider pursuant to section 3(a)(B)(ii) or an application store pursuant to section 5(a).
5.
Requirements for developers of application stores and browser providers
(a)
Developers of application stores
A developer of an application store shall—
(1)
the first time a user accesses the application store on a covered device, request a signal from an operating system provider; and
(2)
provide such signal to another developer upon request.
(b)
Browser providers
A browser provider shall—
(1)
the first time a user accesses the browser on a covered device, request a signal from an operating system provider; and
(2)
provide such signal to a covered internet website operator upon request.
6.
Requirements for developers, covered internet website operators, and operating system providers regarding data use minimization
A developer, covered internet website operator, or operating system provider may not—
(1)
collect more data regarding a user than is necessary to—
(A)
generate age bracket data and transmit or receive a signal; or
(B)
perform the basic functions of an application, covered internet website, or operating system;
(2)
sell age bracket data contained in a signal;
(3)
use age bracket data for profiling, engagement optimization, or targeted advertising; or
(4)
combine age bracket data with other personal or inferred information regarding a user.
7.
Prohibiting targeted advertising to, and data monetization of, children
(a)
Targeted advertising
(1)
In general
It shall be unlawful for any person to engage in targeted advertising to a user the person knows, or reasonably should know, is a child.
(2)
Clarification
Nothing in this subsection shall be construed to prohibit contextual advertising that does not rely on personal data or behavioral profiling.
(b)
Data monetization
It shall be unlawful for any person to sell, license, rent, trade, transfer, release, disclose, provide access to, or otherwise make available to a data broker the personal data of a user the person knows, or reasonably should know, is a child.
8.
Enforcement
(a)
Enforcement by the Commission
(1)
Unfair or deceptive Acts
A violation of section 3, 4, 5, 6, or 7, or a regulation promulgated thereunder shall be treated as a violation of a rule defining an unfair or deceptive act or practice prescribed under section 18(a)(1)(B) of the Federal Trade Commission Act ( 15 U.S.C. 57a(a)(1)(B) ).
(2)
Powers of Commission
(A)
In general
The Commission shall enforce this Act and any regulation promulgated under this Act, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act ( 15 U.S.C. 41 et seq. ) were incorporated into and made a part of this Act.
(B)
Privileges and immunities
Except as provided in subparagraph (D), any person who violates section 3, 4, 5, 6, or 7 or any regulation promulgated thereunder, shall be subject to the penalties and entitled to the privileges and immunities provided in the Federal Trade Commission Act ( 15 U.S.C. 41 et seq. ).
(C)
Authority preserved
Nothing in this Act shall be construed to limit the authority of the Commission under any other provision of law.
(D)
Civil penalties
(i)
In general
In addition to any other penalties as may be prescribed by law, each violation of section 3, 4, 5, 6, or 7 or a regulation promulgated thereunder, shall carry a civil penalty not to exceed—
(I)
for a negligent violation, $2,500; and
(II)
for a knowing or intentional violation, $7,500.
(ii)
Affected children
In any case in which a violation of section 3, 4, 5, 6, or 7 affected a child (as determined by the Commission), the penalties described in clause (i) may be multiplied by the number of children affected.
(E)
Rulemaking
Not later than 1 year after the date of enactment of this Act, the Commission shall promulgate in accordance with section 553 of title 5, United States Code, such rules as may be necessary to carry out this Act.
(b)
Enforcement by State attorneys general
(1)
In general
In any case in which the attorney general of a State has reason to believe that an interest of the residents of the State has been or is threatened or adversely affected by the engagement of any person in an act or practice that violates section 3, 4, 5, 6, or 7, the attorney general of the State may, as parens patriae, bring a civil action on behalf of the residents of the State in an appropriate district court of the United States or a State court of appropriate jurisdiction to—
(A)
enjoin any further such violation by such person;
(B)
enforce compliance with such section;
(C)
obtain a permanent, temporary, or preliminary injunction;
(D)
obtain damages, restitution, or other compensation on behalf of residents of the State; or
(E)
obtain such other relief as the court may consider appropriate.
(2)
Rights of the Commission
(A)
Notice to the Commission
(i)
In general
Except as provided in clause (ii), before initiating a civil action under paragraph (1), the attorney general of a State shall provide to the Commission a written notice of such action and a copy of the complaint for such action.
(ii)
Exception
If the attorney general determines that it is not feasible to provide the notice described in clause (i) before initiating a civil action under paragraph (1), the attorney general shall provide written notice of the action and a copy of the complaint to the Commission immediately upon initiating the civil action.
(B)
Intervention
The Commission may—
(i)
intervene in any civil action brought by the attorney general under paragraph (1); and
(ii)
upon intervening—
(I)
if applicable, remove the action to an appropriate United States district court;
(II)
be heard on all matters arising in the civil action; and
(III)
file petitions for appeal of a decision in the civil action.
(3)
Investigatory powers
Nothing in this subsection may be construed to prevent the attorney general of a State from exercising the powers conferred on the attorney general by the laws of the State to conduct investigations, to administer oaths or affirmations, or to compel the attendance of witnesses or the production of documentary or other evidence.
(4)
Limitation on State action while Federal action is pending
If the Commission has instituted a civil action for a violation of section 3, 4, 5, 6, or 7, no State attorney general may, without the approval of the Commission, bring an action under this subsection during the pendency of that action against any defendant named in the complaint of the Commission for any violation of this section alleged in the complaint.
(5)
Venue; Service of process
(A)
Venue
Any action brought under paragraph (1) may be brought in—
(i)
the district court of the United States that meets applicable requirements relating to venue under section 1391 of title 28, United States Code; or
(ii)
another court of competent jurisdiction.
(B)
Service of process
In an action brought under paragraph (1) in a district court of the United States, process may be served in any district in which—
(i)
the defendant is an inhabitant, may be found, or transacts business; or
(ii)
venue is proper under section 1391 of title 28, United States Code.
(c)
Safe harbor
An operating system provider, covered internet website operator, or developer acting in good faith to comply with this Act shall not be liable under this Act if a user inputs inaccurate information under section 3(a)(1).
9.
Prohibition on anticompetitive practices
(a)
Consistent age-Related requirements
An operating system provider or an application store provider shall, with respect to an application developed by a third party, impose age-related restrictions and obligations on the application and distribution of the application that are the same as or less restrictive than the restrictions and obligations it imposes on its own applications and distribution of its own applications.
(b)
Use of collected data
An operating system provider or an application store may not use age bracket data collected from a third party with respect to the applications or distribution of the applications of the third party to engage in anticompetitive behavior with respect to the third party, including by—
(1)
offering the applications or services of the operating system provider or application store at terms and conditions such that users will prefer such applications or services to the applications or services of a third party; and
(2)
using age bracket data.
(c)
Interoperable credentialing
An operating system provider or application store may not require a developer, browser provider, or covered internet website operator to use a proprietary software development kit, licensing agreement, or other exclusive technical dependency as a condition of verifying a signal, unless such requirement is reasonably necessary to ensure security, privacy, fraud prevention, or the integrity of the verification process.
(d)
Enforcement
(1)
Unlawful method of competition
A violation of this section or a regulation promulgated under this section shall be deemed to be an unlawful method of competition in violation of section 5 of the Federal Trade Commission Act ( 15 U.S.C. 45 ) and a per se violation of section 1 of the Sherman Act ( 15 U.S.C. 1 ).
(2)
Enforcement
(A)
In general
The Commission shall enforce this section and any regulation promulgated under this section in the same manner, by the same means, and with the same jurisdiction, powers, and duties as though all applicable terms and provisions of the Federal Trade Commission Act ( 15 U.S.C. 41 et seq. ) were incorporated into and made a part of this section.
(B)
Enforcement authorities
(i)
Federal trade commission
If the Federal Trade Commission has reason to believe that a person violated this section, and in so doing, committed a violation of section 5 of the Federal Trade Commission Act ( 15 U.S.C. 45 ), the Commission may commence a civil action, in its own name by any of its attorneys designated by it for such purpose, to recover a civil penalty and seek other appropriate relief.
(ii)
Attorney general
The Attorney General shall enforce this section in the same manner, by the same means, and with the same jurisdiction, powers and duties as though all applicable terms of the Sherman Act ( 15 U.S.C. 1 et seq. ), Clayton Act ( 15 U.S.C. 12 et seq. ), and Antitrust Civil Process Act ( 15 U.S.C. 1311 et seq. ) were incorporated into and made a part of this section.
(iii)
State attorneys general
Any attorney general of a State shall enforce this section in the same manner, by the same means, and with the same jurisdiction, powers and duties as though all applicable terms of the Sherman Act ( 15 U.S.C. 1 et seq. ) and the Clayton Act ( 15 U.S.C. 12 et seq. ) were incorporated into and made a part of this section.
10.
Rules of construction and other matters
Nothing in this Act shall be construed to—
(1)
preempt section 444 of the General Educational Provisions Act ( 20 U.S.C. 1232g ) (commonly known as the  Family Educational Rights and Privacy Act of 1974 ) or any other Federal or State law governing student privacy;
(2)
preempt the Children's Online Privacy Protection Act of 1998 ( 15 U.S.C. 6501 et seq. ) or any rule promulgated under such Act;
(3)
authorize any action that would conflict with section 18(h) of the Federal Trade Commission Act ( 15 U.S.C. 57a(h) );
(4)
expand, limit, or alter the meaning or scope of section 230 of the Communications Act of 1934 ( 47 U.S.C. 230 );
(5)
require—
(A)
except as provided in sections 3, 4, and 5 an operating system provider, covered internet website operator, application store, browser provider, or developer to affirmatively collect personal data with respect to a user's age beyond what an operating system provider, covered internet website operator, application store, browser provider, or developer collects in their normal course of business; or
(B)
any person to verify the age of a user through—
(i)
the collection of a government-issued identification document, biometric information, or other sensitive personal information; or
(ii)
facial age estimation technology;
(6)
restrict the ability of an operating system provider, covered internet website operator, developer, browser provider, or application store to—
(A)
cooperate with law-enforcement agencies regarding activity reasonably believed to violate Federal, State, or local law;
(B)
comply with lawful civil, criminal, or regulatory process, including a subpoena or summons;
(C)
investigate, establish, or defend legal claims; or
(D)
prevent, detect, or respond to security incidents, fraud, or other illegal activity; or
(7)
require a particular technological method of generating, transmitting, or verifying a signal.
11.
Effective date
This Act shall take effect on the date that is 18 months after the date of the enactment of this Act.
12.
Severability
If any provision or application of this Act is held invalid, the remainder of such Act shall remain in effect.
13.
Relationship to other laws
The provisions of this Act shall preempt any State law or regulation only to the extent that such State law or regulation conflicts with a provision of this Act. Nothing in this Act or any regulation promulgated thereunder shall be construed to prohibit or otherwise affect the enactment or enforcement of any Federal law or regulation or State law or regulation that is at least as protective of individuals as this Act and the regulations promulgated thereunder.