A Bill for an Act
Page 1, Line 101Concerning age attestation for users of computing devices.
Bill Summary
(Note: This summary applies to this bill as introduced and does not reflect any amendments that may be subsequently adopted. If this bill passes third reading in the house of introduction, a bill summary that applies to the reengrossed version of this bill will be available at http://leg.colorado.gov.)
The bill requires an operating system provider to:
- Provide an accessible interface at account setup that requires an account holder to indicate the birth date or age of the user of that device to provide a signal regarding the user's age bracket (age signal) to applications available in a covered application store;
- Provide an application developer (developer) that requests an age signal, with respect to a particular user, the technical ability to call an age signal via a reasonably consistent real-time application programming interface that identifies, at a minimum, the user's age-bracket data; and
- Send only the minimum amount of information necessary to comply with the bill. An operating system provider shall not share an age signal with a third party for a purpose not required by the bill.
- Request more information from an operating system provider or a covered application store than is necessary to comply with the bill; or
- Share an age signal with a third party for a purpose not required by the bill.
The bill requires a developer to request an age signal with respect to a particular user from an operating system provider or a covered application store when the developer's application is downloaded and launched. A developer that receives an age signal is deemed to have knowledge of the age range of the user to whom that age signal pertains across all platforms of the application and points of access of the application. However, if a developer has clear and convincing information that a user's age is different than the age indicated by an age signal, the developer shall use that information as the primary indicator of the user's age range.
A developer shall not:
A person that violates the bill must pay a civil penalty of not more than $2,500 for each minor affected by each negligent violation or not more than $7,500 for each minor affected by each intentional violation. The penalty is assessed and recovered in a civil action brought by the attorney general.
Page 2, Line 1Be it enacted by the General Assembly of the State of Colorado:
Page 2, Line 2SECTION 1. In Colorado Revised Statutes, add article 30 to title
Page 2, Line 36 as follows:
Page 2, Line 4ARTICLE 30
Page 2, Line 5Age Attestation for Online Users
Page 2, Line 66-30-101. Definitions.
Page 2, Line 7As used in this article 30, unless the context otherwise
Page 2, Line 8requires:
Page 2, Line 9(1) (a) "Account holder" means an individual in the state
Page 3, Line 1who is at least eighteen years old, or the parent or legal
Page 3, Line 2guardian of a user who is under eighteen years old, and who
Page 3, Line 3establishes an account on a device.
Page 3, Line 4(b) "Account holder" does not include:
Page 3, Line 5(I) A parent of an emancipated minor who is a user of a
Page 3, Line 6device; or
Page 3, Line 7(II) A parent or legal guardian of a minor who is a user of
Page 3, Line 8a device if the parent or legal guardian is not associated with
Page 3, Line 9the minor's device.
Page 3, Line 10(2) "Age-bracket data" means nonpersonally identifiable
Page 3, Line 11data derived from a user's birth date or age for the purpose of
Page 3, Line 12sharing with developers, which data indicates the user's age
Page 3, Line 13range , including, at a minimum, data that indicates whether a
Page 3, Line 14user is:
Page 3, Line 15(a) Under thirteen years old;
Page 3, Line 16(b) Thirteen years old or older but under sixteen years
Page 3, Line 17old;
Page 3, Line 18(c) Sixteen years old or older but under eighteen years
Page 3, Line 19old; or
Page 3, Line 20(d) Eighteen years old or older.
Page 3, Line 21(3) "Age signal" means age-bracket data sent by a
Page 3, Line 22real-time secure application programming interface or
Page 3, Line 23operating system to an application.
Page 3, Line 24(4) "Application" means a software application that may
Page 3, Line 25be run or directed by a user on a device.
Page 3, Line 26(5) (a) "Covered application store" means a publicly
Page 3, Line 27available internet website, software application, online service,
Page 4, Line 1or platform that distributes and facilitates the download of
Page 4, Line 2applications from third-party developers to users of devices.
Page 4, Line 3(b) "Covered application store" does not include an online
Page 4, Line 4service or platform that distributes any of the following
Page 4, Line 5applications if the application runs exclusively within a
Page 4, Line 6separate host application:
Page 4, Line 7(I) Extensions;
Page 4, Line 8(II) Plug-ins;
Page 4, Line 9(III) Add-ons; or
Page 4, Line 10(IV) Other software applications.
Page 4, Line 11(6) "Developer" means a person that writes, creates,
Page 4, Line 12maintains, or controls an application.
Page 4, Line 13(7) "Device" means any general-purpose computing device
Page 4, Line 14that can access a covered application store or download an
Page 4, Line 15application.
Page 4, Line 16(8) "Minor" means an individual who is under eighteen
Page 4, Line 17years old.
Page 4, Line 18(9) "Operating system provider" means a person that
Page 4, Line 19develops, licenses, or controls the operating system software
Page 4, Line 20on a device.
Page 4, Line 21(10) "User" means a minor who is the primary user of a
Page 4, Line 22device.
Page 4, Line 236-30-102. Requirements for operating system providers and
Page 4, Line 24developers.
Page 4, Line 25(1) An operating system provider shall do the following:
Page 4, Line 26(a) Provide an accessible interface at account setup that
Page 4, Line 27requires an account holder to indicate the birth date or age of
Page 5, Line 1the user of that device for the purpose of providing an age
Page 5, Line 2signal to applications available in a covered application store;
Page 5, Line 3(b) Provide a developer that requests an age signal, with
Page 5, Line 4respect to a particular user, the technical ability to call an age
Page 5, Line 5signal via a reasonably consistent real-time application
Page 5, Line 6programming interface; and
Page 5, Line 7(c) Send only the minimum amount of information
Page 5, Line 8necessary to comply with this article 30. An operating system
Page 5, Line 9provider shall not share an age signal with a third party for a
Page 5, Line 10purpose not required by this article 30.
Page 5, Line 11(2) (a) A developer shall request an age signal with
Page 5, Line 12respect to a particular user from an operating system provider
Page 5, Line 13or a covered application store when the developer's application
Page 5, Line 14is downloaded and launched.
Page 5, Line 15(b) (I) A developer that willfully disregards an age
Page 5, Line 16signal is deemed to have knowledge of the age range of the user
Page 5, Line 17to whom the signal pertains across all platforms of the
Page 5, Line 18application and points of access of the application.
Page 5, Line 19(II) A developer shall not willfully disregard clear and
Page 5, Line 20convincing information that indicates that a user's age is
Page 5, Line 21different than the age-bracket data indicated by an age signal
Page 5, Line 22provided by an operating system provider or by a covered
Page 5, Line 23application store.
Page 5, Line 24(c) (I) Except as provided in subsections (2)(b)(II) and
Page 5, Line 25(2)(c)(II) of this section, a developer shall treat an age signal
Page 5, Line 26received pursuant to this article 30 as the primary indicator of
Page 5, Line 27a user's age range.
Page 6, Line 1(II) If a developer has clear and convincing information
Page 6, Line 2that a user's age is different than the age indicated by an age
Page 6, Line 3signal received pursuant to this article 30, the developer shall
Page 6, Line 4use that information as the primary indicator of the user's age.
Page 6, Line 5(d) A developer that receives an age signal pursuant to
Page 6, Line 6this article 30 shall use the age signal to comply with applicable
Page 6, Line 7law.
Page 6, Line 8(e) A developer that receives an age signal pursuant to
Page 6, Line 9this article 30 shall not:
Page 6, Line 10(I) Request more information concerning the user from an
Page 6, Line 11operating system provider or a covered application store than
Page 6, Line 12the minimum amount of information necessary to comply with
Page 6, Line 13this article 30; or
Page 6, Line 14(II) Communicate the age signal to a third party for a
Page 6, Line 15purpose not required by this article 30.
Page 6, Line 166-30-103. Applicability to existing devices.
Page 6, Line 17(1) With respect to a device for which account setup was
Page 6, Line 18completed before January 1, 2028, an operating system provider
Page 6, Line 19shall provide, before July 1, 2028, an accessible interface that
Page 6, Line 20allows an account holder to indicate the birth date or age of
Page 6, Line 21the user of that device for the purpose of providing an age
Page 6, Line 22signal regarding the user's age-bracket data to applications
Page 6, Line 23available in a covered application store.
Page 6, Line 24(2) If an application last updated on or after January 1,
Page 6, Line 252027, was downloaded to a device before January 1, 2028, and the
Page 6, Line 26developer has not requested an age signal with respect to the
Page 6, Line 27user of the device on which the application was downloaded, the
Page 7, Line 1developer shall request an age signal from a covered
Page 7, Line 2application store with respect to that user before July 1, 2028.
Page 7, Line 36-30-104. Enforcement - penalties.
Page 7, Line 4(1) A person that violates this article 30 shall pay a civil
Page 7, Line 5penalty of no more than two thousand five hundred dollars for
Page 7, Line 6each minor affected by each negligent violation, or no more
Page 7, Line 7than seven thousand five hundred dollars for each minor
Page 7, Line 8affected by each intentional violation. The attorney general
Page 7, Line 9shall assess and recover the penalty in a civil action.
Page 7, Line 10(2) If an operating system provider or a covered
Page 7, Line 11application store makes a good faith effort to comply with this
Page 7, Line 12article 30, taking into consideration available technology and
Page 7, Line 13any reasonable technical limitations or outages, the operating
Page 7, Line 14system provider or covered application store is not liable for an
Page 7, Line 15erroneous age signal indicating a user's age range or for
Page 7, Line 16conduct by a developer that receives an age signal indicating a
Page 7, Line 17user's age range.
Page 7, Line 186-30-105. Applicability - limitations.
Page 7, Line 19(1) This article 30 does not modify, impair, or supersede
Page 7, Line 20any antitrust law, including the "Colorado State Antitrust Act
Page 7, Line 21of 2023", article 4 of this title 6.
Page 7, Line 22(2) This article 30 does not require the collection of
Page 7, Line 23additional personal information from device owners or device
Page 7, Line 24users that is not necessary to comply with this article 30.
Page 7, Line 25(3) An operating system provider or a covered application
Page 7, Line 26store shall comply with this article 30 in a nondiscriminatory
Page 7, Line 27manner, including by:
Page 8, Line 1(a) Imposing at least the same restrictions and obligations
Page 8, Line 2on its own applications and application distribution as it does on
Page 8, Line 3those from third-party applications or application distributors,
Page 8, Line 4respectively; and
Page 8, Line 5(b) Not using nonpublicly available data collected from
Page 8, Line 6a third party in the course of compliance with this article 30 to
Page 8, Line 7compete against that third party, give the covered application
Page 8, Line 8store's services preference relative to those of a third party, or
Page 8, Line 9use the nonpublicly available data in an anticompetitive manner
Page 8, Line 10in violation of applicable law.
Page 8, Line 11(4) This article 30 does not apply to:
Page 8, Line 12(a) A broadband internet access service, as defined in
Page 8, Line 13section 40-15-209 (4)(a);
Page 8, Line 14(b) A telecommunications service, as defined in 47 U.S.C.
Page 8, Line 15sec. 153 (53); or
Page 8, Line 16(c) The delivery of or use of a physical product.
Page 8, Line 17(5) This article 30 does not impose liability that arises
Page 8, Line 18from the use of a device or application by an individual who is
Page 8, Line 19not the user to whom an age signal pertains on an operating
Page 8, Line 20system provider, a covered application store, or a developer.
Page 8, Line 21(6) Notwithstanding any provision of this article 30 to the
Page 8, Line 22contrary, this article 30 does not apply to a developer if the
Page 8, Line 23predominant or exclusive function of the application that the
Page 8, Line 24developer writes, creates, maintains, or controls is:
Page 8, Line 25(a) Facilitating communication within a business or an
Page 8, Line 26enterprise among employees or affiliates of the business or
Page 8, Line 27enterprise, so long as access to the application is restricted to
Page 9, Line 1employees or affiliates of the business or enterprise;
Page 9, Line 2(b) Selling enterprise software to businesses,
Page 9, Line 3governments, or nonprofit organizations; or
Page 9, Line 4(c) Providing or obtaining technical support for a
Page 9, Line 5software platform, product, or service.
Page 9, Line 6SECTION 2. Act subject to petition - effective date. This act
Page 9, Line 7takes effect January 1, 2028; except that, if a referendum petition is filed
Page 9, Line 8pursuant to section 1 (3) of article V of the state constitution against this
Page 9, Line 9act or an item, section, or part of this act within the ninety-day period
Page 9, Line 10after final adjournment of the general assembly, then the act, item,
Page 9, Line 11section, or part will not take effect unless approved by the people at the
Page 9, Line 12general election to be held in November 2026 and, in such case, will take
Page 9, Line 13effect January 1, 2028.