HB 6244

HOUSE BILL NO. 6244
A bill to regulate certain app store providers and
developers; to regulate certain individuals downloading apps; to require
verifiable parental consent for certain activities of minors; to provide for
the powers and duties of certain state and local governmental officers and
entities; to prescribe civil sanctions; to provide remedies; and to declare
certain contractual provisions unenforceable.
the people of the state of michigan enact:
Sec. 1. This act may be
cited as the "app store accountability act".
Sec. 2. As used in this
act:
(a) "Account holder" means the individual who is
associated with an app store account.
(b) "Adult" means an individual who is 18 years of
age or older.
(c) "Age category" means the category of an
individual based on the individual's age, including all of the following
categories:
(i)
Child.
(ii)
Younger teenager.
(iii)
Older teenager.
(iv)
Adult.
(d) "Age category data" means information about an
account holder's age category.
(e) "Age rating" means 1 or more classifications
that assess the suitability of an app's content and functions for different age
categories.
(f) "App" means a software application or electronic
service that an account holder may run or direct on a mobile device, including
preinstalled applications.
(g) "App store" means a publicly available website,
software application, or electronic service that allows an account holder to
download apps from a developer onto a mobile device.
(h) "App store provider" means a person that owns,
operates, or controls an app store.
(i) "Child" means an individual who is less than 13
years of age.
(j) "Content description" means a description of the
specific content elements or functions that inform an
app's age rating.
(k) "Developer" means a person that owns or controls
an app made available through an app store or a preinstalled application.
(l) "Knowingly"
means to act with actual knowledge or to act with knowledge fairly inferred
based on objective circumstances.
(m) "Minor" means
an individual who is less than 18 years of age.
(n) "Minor account
holder" means an account holder who is a
minor.
(o) "Mobile device"
means a phone or general purpose tablet that does all of the following:
(i)
Is capable of providing cellular or wireless connectivity.
(ii)
Is capable of connecting to the internet.
(iii)
Runs a mobile operating system.
(iv)
Runs apps through the mobile operating system.
(p) "Mobile operating
system" means software that does all of the following:
(i)
Manages mobile device hardware resources.
(ii)
Provides common services for mobile device programs or apps.
(iii)
Controls memory allocation.
(iv)
Provides app interfaces for an account holder to access device functionality.
(q) "Older
teenager" means an individual who is at least 16 years of age but is less
than 18 years of age.
(r) "Parent" means,
with respect to a minor, an adult with the legal right to make decisions on
behalf of the minor, including all of the following:
(i)
A natural parent.
(ii)
An adoptive parent.
(iii)
A legal guardian.
(iv)
An individual with legal custody over the minor.
(s) "Parent account
holder" means an account holder who meets
both of the following:
(i)
Is established by an individual whom the app
store provider has determined is an adult through the app store provider's age
verification method or process under section 3.
(ii)
Is affiliated with at least 1 minor account holder or prospective minor account
holder.
(t) "Preinstalled
application" means any app, or portion of an app, that is present on a
mobile device at the time of purchase, initial activation, or first use by the
account holder, including browsers, search engines, and messaging. Preinstalled
application does not include core operating system functions, essential device
drivers, and apps necessary for basic device operation, including phone,
settings, and emergency services apps.
(u) "Significant
change" means a material modification to an app's terms of service or
privacy policy that does 1 of the following:
(i)
Changes the category of data collected, stored, or shared.
(ii)
Alters the app's age rating or content description.
(iii)
Introduces in-app purchases or advertisements that were not previously present
in the app.
(v) "Verifiable parental
consent" means the authorization that is provided by a parent account
holder under section 3.
(w) "Younger
teenager" means an individual who is at least 13 years of age but is less
than 16 years of age.
Sec. 3. (1) Not later than
12 months after the effective date of this act, and subject to subsection (3),
an app store provider shall do both of the following for existing account
holders:
(a) Request the existing account holder's age category.
(b) Verify the existing account holder's age category using 1
of the following methods:
(i)
A commercially available method that is reasonably designed to ensure accuracy.
(ii)
An age verification method or process established by the attorney general under section 5.
(2) Not later than 12 months after the effective date of this
act, and subject to subsection (3), if an individual creates a new account with
an app store, an app store provider shall do both of the following:
(a) Request the individual's age category.
(b) Verify the individual's age category using 1 of the
following methods:
(i)
A commercially available method that is reasonably designed to ensure accuracy.
(ii)
An age verification method or process established by the attorney general under section 5.
(3) If an app store provider determines that an account holder
under subsection (1) or (2) is a minor, the app store provider shall do both of the following:
(a) Require the minor account holder to be affiliated with a
parent account holder.
(b) Obtain verifiable parental consent from the affiliated
parent account holder before allowing the minor account holder to do any of the
following:
(i)
Download an app.
(ii)
Purchase an app.
(iii)
Make an in-app purchase.
(4) Not later than 12 months after
the effective date of this act, an app store provider shall do all of
the following:
(a) Provide a method to obtain verifiable parental consent
under subsection (3) that requires the parent account holder to make an
affirmative choice to either grant or decline verifiable parental consent.
(b) After receiving notice of a significant change from a
developer under section 4, do both of the following, as applicable:
(i)
Notify the account holder of the significant
change.
(ii)
For a minor account holder, notify the affiliated parent account holder and
obtain a new verifiable parental consent before providing the minor account
holder access to the app.
(c) Provide a data sharing method for a developer to obtain an
account holder's age category data and the status of verifiable parental
consent if the account holder is a minor.
(d) Provide a mechanism for a parent account holder to revoke
verifiable parental consent.
(e) Notify a developer when a parent account holder revokes
verifiable parental consent under subdivision (d).
(f) Protect the confidentiality of age category data and
associated verification data by doing both of
the following:
(i)
Limiting the collection and processing to what is necessary to verify an
account holder's age category, obtain
verifiable parental consent, or maintain compliance records.
(ii)
Transmitting age category data using widely adopted industry standard
encryption protocols that ensure data integrity and data confidentiality.
(5) Subject to section 4(1)(c), if a mobile device contains a
preinstalled application and a developer requests information regarding an
account holder's use of the preinstalled application, an app store provider
shall both of the following:
(a) Provide any available age category data to the developer.
(b) Take reasonable measures to obtain verifiable parental
consent for a minor account holder's use of the preinstalled application.
(6) An app store provider shall not do any of the following:
(a) Enforce a contract or terms of service against a minor
account holder unless the app store provider has obtained verifiable parental
consent.
(b) Knowingly misrepresent the information in the verifiable
parental consent.
(c) Distribute or share age category data and associated
verification data except as required by law.
Sec. 4. (1) Not later than 12 months after the effective date of this
act, a developer shall do all of the following:
(a) Notify app store providers of a significant change to an
app.
(b) Use an app store provider's data sharing method under
section 3 to enforce any developer-created age rating restrictions,
safety-related features, or defaults, and
ensure compliance with this act.
(c) Not more than once in a 12-month
period, request and verify through an app store provider's data sharing
method under section 3 the age category data of account holders, and, for a
minor account holder, whether the app store provider has obtained verifiable
parental consent in either of the following circumstances:
(i)
If a minor account holder does any of the
following:
(A) Downloads an app.
(B) Purchases an app.
(C) Launches a preinstalled application for the first time.
(ii)
If the developer implements a significant change to an app.
(d) Use widely adopted industry standards to assign an age
rating and content description to an app.
(2) Except as otherwise provided under subsection (1)(c), a
developer may request age category data only if the developer has reasonable
suspicion to believe an account holder has engaged in either of the following:
(a) Account transfer.
(b) Misuse of an app outside of the age category.
(3) A developer shall implement age rating restrictions,
safety-related features, or defaults to an
app. When implementing the age rating restrictions, safety-related features, or defaults to an app, a
developer shall use the lowest age category indicated by either of the
following:
(a) Age category data received through an app store provider's
data sharing method under section 3.
(b) Age category data independently collected by the
developer.
(4) A developer shall not do any of the following:
(a) Enforce a contract or terms of service against a minor
account holder unless the developer has verified through an app store
provider's data sharing method under section 3 that verifiable parental consent
has been obtained.
(b) Knowingly misrepresent the information in the verifiable
parental consent.
(c) Distribute or share age category data with any person.
Sec. 5. The attorney general shall promulgate rules under the
administrative procedures act of 1969, 1969 PA 306, MCL 24.201 to 24.328, to
establish a process for an app store provider to use to verify an account
holder's age category.
Sec. 6. (1) A person
alleging a violation of this act may bring a civil action in a court of
appropriate jurisdiction for appropriate injunctive relief, actual damages or
presumed damages of $1,000.00, or both injunctive relief and actual or presumed
damages.
(2) An app store provider or a developer that violates this
act is subject to a civil fine of not more than $7,500.00. A civil fine collected must be deposited in the
general fund.
(3) If the attorney general determines that an app store
provider or developer violates this act, the attorney general may bring a civil
action against the app store provider or developer for appropriate relief,
including injunctive relief, or to collect the civil fine as provided for under
subsection (2).
(4) In addition to the relief under subsection (1) or (3), a
court rendering a judgment in an action brought under this act may award all or
a portion of the costs of litigation, including reasonable attorney fees and
witness fees, to the complainant in the action
if the court determines that the award is appropriate.
Sec. 7. (1) A developer is not liable for a violation of
this act if the developer demonstrates any of the following:
(a) The developer relied in good faith on applicable age
category data received through an app store provider's data sharing method under section 3.
(b) The developer relied in good faith on notification from
the app store provider that verifiable parental consent was obtained if the
account holder was a minor.
(c) The developer complied with the requirements described
under section 4.
(d) The developer used widely adopted industry standards to
assign an app's age rating and content description under section 4, and applied
those standards consistently and in good faith.
(2) Subsection (1) must not be
construed as limiting an app store provider or a developer's liability under
any other applicable law.
(3) This act does not limit the
rights or remedies available to a person under the laws of this state or the
United States.
Sec. 8. This act shall not be
construed to do any of the following:
(a) Prevent an app store provider from taking reasonable
measures to block, detect, or prevent the distribution of any of the following
to minor account holders:
(i)
Unlawful material.
(ii)
Obscene material.
(iii)
Sexually explicit material.
(b) Prevent an app store provider from taking reasonable
measures to do any of the following:
(i)
Block or filter spam.
(ii)
Prevent criminal activity.
(iii)
Protect the app store or app security.
(c) Require an app store provider to disclose account holder
information to a developer beyond age category data or the status of verifiable
parental consent.
(d) Allow an app store provider or a developer to implement
measures required under this act in a manner that is arbitrary, capricious,
anticompetitive, or unlawful.
(e) Require a developer to collect, retain, reidentify, or
link any information beyond what is necessary to verify age category data as is
required under section 4 or for the developer's ordinary course of business.
(f) Require an app store provider or a developer to block
access to an app that an account holder has downloaded or installed onto a
mobile device before this act's effective
date, unless either of the following applies:
(i)
A parent account holder revokes verifiable consent for an affiliated minor
account holder under section 3.
(ii)
There is a significant change to the app.