Bill Text: CA AB1856 | 2025-2026 | Regular Session | Amended

NOTE: There are more recent revisions of this legislation. Read Latest Draft

---

Bill Title: Age verification signals: software applications.

Sponsorship: Partisan Bill (Democrat 1)

Status: (Passed) 2026-09-10 - Chaptered by Secretary of State - Chapter 184, Statutes of 2026. [AB1856 Detail]

Download: California-2025-AB1856-Amended.html

---

Amended  IN  Senate  July 01, 2026

Amended  IN  Assembly  May 18, 2026

Amended  IN  Assembly  April 23, 2026

Amended  IN  Assembly  April 06, 2026

Amended  IN  Assembly  March 19, 2026

CALIFORNIA LEGISLATURE— 2025–2026 REGULAR SESSION

Assembly Bill

No. 1856

---

Introduced by Assembly Member Wicks

February 11, 2026

---

An act to amend Sections 1798.500, 1798.501, 1798.502, 1798.503, and 1798.504 of the Civil Code, relating to consumer protection.

LEGISLATIVE COUNSEL'S DIGEST

AB 1856, as amended, Wicks. Age verification signals: software applications and online services. applications.

Existing law, the Digital Age Assurance Act, Act (DAAA), beginning January 1, 2027, requires, among other things related to age verification with respect to software applications, an operating system provider, as defined, to provide an accessible interface at account setup that requires an account holder, as defined, to indicate the birth date, age, or both, of the user of that device for the purpose of providing a signal regarding the user’s age bracket to applications available in a covered application store. Existing law defines the term “user” for these purposes to mean a child that is the primary user of a device.

This bill would, among other things, delete that definition of “user” and “user,” would specify that the requirement of an operating system provider to provide an accessible interface applies if the operating system provider’s operating system has an account setup feature with respect to the use of the operating system on a particular device device, and would require the signal to be provided to a covered application store, application developer, browser provider, or an internet website operator, store or application developer, as prescribed. The bill would prohibit a person from requesting a signal with respect to a particular user from an operating system provider or a covered application store if not required to do so by the DAAA or any other applicable law.

Existing law deems a developer that receives a signal pursuant to these provisions to have actual knowledge of the age range of the user to whom that signal pertains across all platforms of the application and points of access of the application even if the developer willfully disregards the signal.

This bill would recast those provisions to instead deem a developer or internet website operator that receives a signal to have actual knowledge of the age range of the user to whom that signal pertains when the user accesses the application from a specified device and would delete the provision that deems the developer to have actual knowledge across all platforms of the application and points of access of the application.

Digest Key

Vote: MAJORITY   Appropriation: NO   Fiscal Committee: YES   Local Program: NO  

---

Bill Text

The people of the State of California do enact as follows:

SECTION 1.

 Section 1798.500 of the Civil Code is amended to read:

1798.500.

 For the purposes of this title:

(a) (1) “Account holder” means an individual who is at least 18 years of age or a parent or legal guardian of a user who is under 18 years of age in the state.

(2) “Account holder” does not include a parent of an emancipated minor or a parent or legal guardian who is not associated with a user’s device.

(b) “Age bracket data” means nonpersonally identifiable data derived from a user’s birth date or age for the purpose of sharing with developers of applications that indicates the user’s age range, including, at a minimum, the following:

(1) Whether a user is under 13 years of age.

(2) Whether the user is at least 13 years of age and under 16 years of age.

(3) Whether the user is at least 16 years of age and under 18 years of age.

(4) Whether the user is at least 18 years of age.

(c) (1) “Application” means a software application that may be run or directed by a user on a computer, a mobile device, or any other general purpose general-purpose computing device that can access a covered application store or download an application.

(2) “Application” does not include software components that are not themselves offered to consumers as a stand-alone executable application through a covered application store.

(d)“Browser” means an application that enables a user to visit an internet website.

(e)“Browser provider” means a person or entity that controls or operates a browser for use on a computer, mobile device, or any other general purpose computing device.

(f)

(d) “Child” means a natural person who is under 18 years of age.

(g)

(e) (1) “Covered application store” means a publicly available internet website, software application, online service, or platform that distributes and facilitates the download of applications from third-party developers to users of a computer, a mobile device, or any other general purpose general-purpose computing that can access a covered application store or can download an application.

(2) “Covered application store” does not mean an online service or platform that distributes extensions, plug-ins, add-ons, or other software applications that run exclusively within a separate host application.

(h)

(f) “Developer” means a person that owns an application, or maintains or controls the hosting of the application, in a covered application store.

(i)“Internet website operator” means a person that owns, maintains, or controls an internet website that is subject to a law that requires the internet website operator to verify the age of users.

(j)

(g) (1) “Operating system provider” means a person or entity that develops, licenses, or controls the operating system software on a computer, mobile device, or any other general purpose general-purpose computing device.

(2) “Operating system provider” does not mean a person or entity that distributes an operating system or application under license terms that permit a recipient to copy, redistribute, and modify the software.

(k)

(h) “Signal” means age bracket data that pertains to the primary user of a device that is either of the following: sent by a real-time secure application programming interface or operating system to an application.

(1)Sent by a real-time secure application programming interface or operating system to an application.

(2)Communicated by a browser provider to an internet website operator in any technically feasible manner.

SEC. 2.

 Section 1798.501 of the Civil Code is amended to read:

1798.501.

 (a) If an operating system provider’s operating system has an account setup feature with respect to the use of the operating system on a particular device, an operating system provider shall do all of the following:

(1) Provide an accessible interface, at account setup, that requires an account holder to indicate the birth date, age, or both, of the primary user of that device for the purpose of providing a signal regarding the primary user’s age bracket to all of the following:

(A) A covered application store.

(B) A developer.

(C)A browser provider.

(D)An internet website operator.

(2) Provide a developer, developer or covered application store, or browser provider store who has requested a signal with respect to a particular user with a digital signal via a reasonably consistent real-time application programming interface that identifies, at a minimum, which of the following categories pertains to the user:

(A) Under 13 years of age.

(B) At least 13 years of age and under 16 years of age.

(C) At least 16 years of age and under 18 years of age.

(D) At least 18 years of age.

(3) Send only the minimum amount of information necessary to comply with this title.

(b) An operating system provider shall not share the digital signal information with a third party for a purpose not required by this title.

(c) (1)A covered application store shall do both of the following with respect to a user of the covered application store:

(A)

(1) Request a signal from the user’s operating system provider.

(B)

(2) Provide the signal received pursuant to subparagraph (A) paragraph (1) to a developer upon request.

(2)A browser provider shall do both of the following with respect to a user of the browser:

(A)Request a signal from the user’s operating system provider.

(B)Provide the signal received pursuant to subparagraph (A) to an internet website operator upon request.

(d) (1) (A) A developer shall request a signal with respect to a particular user from an operating system provider or a covered application store when the application is downloaded onto, and launched from, a particular device.

(B)An internet website operator shall request a signal with respect to a particular user from the user’s browser provider when the user accesses the internet website.

(C)

(B) An entity subject to this title shall not prompt the user to change the user’s age information.

(2) (A) Subject to subparagraph (B) or paragraph (3), a developer or internet website operator that receives a signal pursuant to this title shall be deemed to have actual knowledge of the age range of the user to whom that signal pertains when the user accesses the application or internet website from the device referenced in paragraph (1) even if the developer or internet website operator willfully disregards the signal. across all platforms of an application, including an internet website owned, maintained, or controlled by a developer, and points of access of the application, including an internet website owned, maintained, or controlled by a developer and accessed by a user to create an account or log into an account, from the device referenced in paragraph (1) even if the developer willfully disregards the signal.

(B) A developer or internet website operator shall not willfully disregard internal clear and convincing information otherwise available to the developer or internet website operator that indicates that a user’s age is different than the age bracket data indicated by a signal provided by an operating system provider, browser provider, provider or covered application store.

(3) (A) Except as provided in subparagraph (B), a developer or internet website operator shall treat a signal received pursuant to this title as the primary indicator of a user’s age range for purposes of determining the user’s age.

(B) (i) If a developer or internet website operator has internal clear and convincing information that a user’s age is different than the age indicated by a signal received pursuant to this title, the developer or internet website provider shall use that information as the primary indicator of the user’s age and shall be deemed to have actual knowledge of the age range of the user to whom that information pertains.

(ii) As used in this subparagraph, “clear and convincing information” includes, but is not limited to, age information shared with a developer or internet website operator by an account holder regarding the age of a user of a subaccount of the primary account of the account holder or age information shared with a developer by an account holder regarding the age of a user associated with the account.

(4) A developer or internet website operator that receives a signal pursuant to this title shall use that signal to comply with applicable law but shall not do either any of the following:

(A) Request more information from an operating system provider, internet website operator, provider or covered application store than the minimum amount of information necessary to comply with this title.

(B) Share the signal with a third party for a purpose not required by this title.

(e) A person shall not request a signal with respect to a particular user from an operating system provider or a covered application store if not required to do so by this title or any other applicable law.

SEC. 3.

 Section 1798.502 of the Civil Code is amended to read:

1798.502.

 (a) With respect to a device for which account setup was completed before January 1, 2027, an operating system provider shall, before July 1, 2027, provide an accessible interface that allows an account holder to indicate the birth date, age, or both, of the primary user of that device for the purpose of providing a signal regarding the primary user’s age bracket to applications available in a covered application store.

(b) If an application last updated with updates on or after January 1, 2026, was downloaded to a device before January 1, 2027, and a developer has not requested a signal with respect to the user of the device on which the application was downloaded, the developer shall request a signal from a covered application store or an operating system provider with respect to that user before July 1, 2027.

SEC. 4.

 Section 1798.503 of the Civil Code is amended to read:

1798.503.

 (a) A person that violates this title shall be subject to an injunction and liable for a civil penalty of not more than two thousand five hundred dollars ($2,500) per affected child for each negligent violation or not more than seven thousand five hundred dollars ($7,500) per affected child for each intentional violation, which shall be assessed and recovered only in a civil action brought in the name of the people of the State of California by the Attorney General.

(b) An operating system provider, browser provider, or covered application store that makes a good faith effort to comply with this title, taking into consideration available technology and any reasonable technical limitations or outages, shall not be liable for an erroneous signal indicating a user’s age range or any conduct by a developer or internet website operator that receives a signal indicating a user’s age range.

SEC. 5.

 Section 1798.504 of the Civil Code is amended to read:

1798.504.

 (a) This title does not modify, impair, or supersede the operation of any antitrust law.

(b) This title does not require the collection of additional personal information from device owners or device users other than that which is necessary to comply with Section 1798.501.

(c) An operating system provider or a covered application store shall comply with this title in a nondiscriminatory manner, including, but not limited to, by complying with both of the following:

(1) An operating system provider or a covered application store shall impose at least the same restrictions and obligations on its own applications and application distribution as it does on those from third-party applications or application distributors.

(2) An operating system provider or a covered application store shall not use data collected from a third party in the course of compliance with this title to compete against that third party, give the covered application store’s services preference relative to those of a third party, or to otherwise use this data or consent mechanism in an anticompetitive manner.

(d) The protections provided by this title are in addition to those provided by any other applicable law, including, but not limited to, the California Age-Appropriate Design Code Act (Title 1.81.47 (commencing with Section 1798.99.28)).

(e) If any provision of this title, or application thereof, to any person or circumstance is held invalid, that invalidity shall not affect other provisions or applications of this title that can be given effect without the invalid provision or application, and to this end the provisions of this title are declared to be severable.

(f) This title does not apply to any of the following:

(1) A broadband internet access service, as defined in Section 3100.

(2) A telecommunications service, as defined in Section 153 of Title 47 of the United States Code.

(3) The delivery or use of a physical product.

(g) This title does not impose liability that arises from the use of a shared device or application by a person who is not the user to whom a signal pertains.