S4669

An Act concerning app store operations and creating requirements for age verification and parental consent and supplementing Title 56 of the Revised Statutes.

Be It Enacted by the Senate and General Assembly of the State of New Jersey:

1. As used in P.L. , c. (C. ) (pending before the Legislature as this bill):

“Adult” means an individual who is at least 18 years old.

“Age category” means one of the following categories of individuals based on age: (1) child; (2) younger teenager; (3) older teenager; or (4) adult.

“Age category data” means information about a user’s age category that is collected by an app store provider and shared with a developer.

“Age rating” means a classification that provides an assessment of suitability of an app’s content for different age groups.

“App” means a software application or electronic service that a user may run or direct on a mobile device.

“App store” means a publically available website, software application, or electronic service that allows users to download apps from third-party developers onto a mobile device.

“Child” means an individual who is under 13 years old.

“Content description” means a description of the specific content that informed an app’s age rating.

“Developer” means a person that owns or controls an app made available through an app store in the State.

“Division” means the Division of Consumer Affairs in the Department of Law and Public Safety.

“Guardian” means, with respect to a minor, an individual who has legal authority to make decisions on behalf of the minor, other than a parent as defined in this section.

“Minor” means any individual under 18 years old.

“Minor account” means an account with an app store provider that is established by an individual who the app store provider has determined is under 18 years old through the app store provider’s age verification methods and requires affiliation with a parent account.

“Mobile device” means a phone or general purpose tablet that: (1) provides cellular or wireless connectivity; (2) is capable of connecting to the Internet; (3) runs a mobile operating system; and (4) is capable of running apps through the mobile operating system.

“Mobile operating system” means software that: (1) manages mobile device hardware resources; (2) provides common services for mobile device programs; (3) controls memory allocation; and (4) provides interfaces for applications to access device functionality.

“Older teenager” means an individual who is at least 16 years old and under 18 years old.

“Parent” means, with respect to a minor, an individual who has legal authority to make decisions on behalf of the minor.

“Parent account” means an account with an app store provider that is verified to be established by an individual who the app store provider has determined is at least 18 years old through the app store provider’s age verification methods and may be affiliated with one or more minor accounts.

“Parent consent disclosure” means the following information that an app store provider is required to provide to a parent or guardian before obtaining the consent of the parent or guardian: (1) if the app store provider has an age rating or content description for the app or in-app purchase, the app’s or in-app purchase’s age rating or content description; (2) a description of the personal data collected by the app from a user and the personal data shared by the app with a third party; and (3) if personal data is collected by the app, the methods implemented by the developer to protect the personal data.

“Significant change” means a material modification to an app’s terms of service or privacy policy that: (1) changes the categories of data collected, stored, or shared; (2) alters the app’s age rating or content descriptions; (3) adds new monetization features, including: in-app purchases or advertisements; or (4) materially changes the app’s functionality or user experience.

“Verifiable parental consent” means authorization that: (1) is provided by an individual who the app store provider has verified is an adult; (2) is given after the app store provider has clearly and conspicuously provided the parental consent disclosure to the individual; and (3) requires the parent or guardian to make an affirmative choice to grant consent or decline consent.

“Younger teenager” means an individual who is at least 13 years old and under 16 years old.

2. a. An app store provider shall:

(1) at the time an individual who is located in the State creates an account with the app store provider, request age information from the individual and verify the individual's age category using commercially available third-party methods that are reasonably designed to ensure accuracy or an age verification method or process that complies with rules made by the division under section 7 of P.L. , c. (C. ) (pending before the Legislature as this bill);

(2) if the age verification method or process described in paragraph (1) of subsection a. of this section determines the individual is a minor, require the account to be affiliated with a parent account and obtain verifiable parental consent from the holder of the affiliated parent account before allowing the minor to download an app, purchase an app, or make an in-app purchase;

(3) after receiving notice of a significant change from a developer, notify the user of the significant change and for a minor account, notify the holder of the affiliated parent account and obtain renewed verifiable parental consent;

(4) provide to a developer age category data for a user located in the State and the status of verified parental consent for a minor located in the State;

(5) notify a developer when a parent or guardian revokes parental consent; and

(6) protect personal age verification data by limiting collection and processing to data necessary for verifying a user's age, obtaining parental consent, or maintaining compliance records and transmitting personal age verification data using industry-standard encryption protocols that ensure data integrity and data confidentiality.

b. An app store provider shall not:

(1) enforce a contract or terms of service against a minor unless the app store provider has obtained verifiable parental consent;

(2) knowingly misrepresent the information in the parental consent disclosure; or

(3) share personal age verification data, except with a developer as required by P.L. , c. (C. ) (pending before the Legislature as this bill); or as otherwise required by law.

3. a. A developer shall:

(1) verify, through the app store’s data sharing methods, the age category of users located in the State, and for a minor account, whether verifiable parental consent has been obtained;

(2) notify app store providers of a significant change to the app;

(3) use age category data received from an app store provider pursuant to subsection a. of section 2 of P.L. , c. (C. ) (pending before the Legislature as this bill) to enforce any developer-created age-related restrictions, ensure compliance with applicable laws and regulations, and implement any developer-created safety-related features or defaults; and

(4) request personal age verification data or parental consent at the time a user downloads an app or purchases an app, when implementing a significant change to the app, or to comply with applicable laws or regulations.

b. A developer may request personal age verification data or parental consent:

(1) no more than once during each 12-month period to verify accuracy of user age verification data or continued account use within the verified age category;

(2) when there is reasonable suspicion of account transfer or misuse outside the verified age category; or

(3) at the time a user creates a new account with the developer.

c. When implementing any developer-created safety-related features or defaults, a developer shall use the lowest age category indicated by age verification data provided by an app store provider or age data independently collected by the developer.

d. A developer shall not:

(1) enforce a contract or terms of service against a minor unless the developer has verified through the app store provider that verifiable parental consent has been obtained;

(2) knowingly misrepresent any information in the parental consent disclosure; or

(3) share age category data with any person.

4. a. It shall be an unlawful act and a violation of P.L.1960, c.39 (C.56:8-1 et seq.) for an app store provider or a developer to violate the provisions of P.L. , c. (C. ) (pending before the Legislature as this bill).

b. A minor, or the parent or guardian of the minor, who has been harmed by a violation of subsection b. of section 2 of P.L. , c. (C. ) (pending before the Legislature as this bill) or subsection d. of section 3 of P.L. , c. (C. ) (pending before the Legislature as this bill) may bring a civil action against an app store provider or a developer. An action pursuant to this subsection shall be brought in the Superior Court of the county in which the individual bringing the action resides.

c. If a court finds that an app store or a developer has violated any provision of P.L. , c. (C. ) (pending before the Legislature as this bill), the individual bringing an action pursuant to subsection b. of this section shall be entitled to:

(1) reasonable attorney fees and court costs; and

(2) the greater of actual damages or $1,000 for each violation.

5. a. A developer is not liable for a violation of P.L. , c. (C. ) (pending before the Legislature as this bill) if the developer demonstrates that the developer relied in good faith on personal age verification data provided by an app store provider and notification from an app store provider that verifiable parental consent was obtained if the personal age verification data indicates that the user is a minor and complied with the requirements described in section 3 of P.L. , c. (C. ) (pending before the Legislature as this bill).

b. For purposes of setting the age category of an app and providing content description disclosures to an app store provider, a developer complies with paragraph (2) of subsection d. of section 3 of P.L. , c. (C. ) (pending before the Legislature as this bill) if the developer uses widely adopted industry standards to determine the app's age category and the content description disclosures and applies those standards consistently and in good faith.

c. This section applies only to actions brought under P.L. , c. (C. ) (pending before the Legislature as this bill) and does not limit a developer or app store provider's liability under any other applicable law.

d. Nothing in P.L. , c. (C. ) (pending before the Legislature as this bill) shall displace any other available remedies or rights authorized under the laws of this State or the United States.

6. Nothing in P.L. , c. (C. ) (pending before the Legislature as this bill) shall be construed to:

a. prevent an app store provider or developer from taking reasonable measures to:

(1) block, detect, or prevent distribution to minors of unlawful material, obscene material, or other harmful material;

(2) block or filter spam;

(3) prevent criminal activity; or

(4) protect app store or app security;

b. require an app store provider to disclose user information to a developer beyond age category or verification of parental consent status;

c. allow an app store provider or developer to implement measures required by P.L. , c. (C. ) (pending before the Legislature as this bill) in a manner that is arbitrary, capricious, anticompetitive, or unlawful;

d. require an app store provider or developer to obtain parental consent for an app that:

(1) provides direct access to emergency services, including 9-1-1, crisis hotlines, or emergency assistance services legally available to minors;

(2) limits data collection to information necessary to provide emergency services in compliance with the “Children's Online Privacy Protection Act” (15 U.S.C. s.6501 et seq.);

(3) provides access without requiring account creation or collection of unnecessary personal information; and

(4) is operated by or in partnership with a government entity, a nonprofit organization, or an authorized emergency service provider; or

e. require a developer to collect, retain, reidentify, or link any information beyond what is necessary to verify age categories and parental consent status as required by P.L. , c. (C. ) (pending before the Legislature as this bill) and collected, retained, reidentified, or linked in the developer's ordinary course of business.

7. The division shall adopt, pursuant to the “Administrative Procedure Act,” P.L.1968, c.410 (C.52:14B-1 et seq.), such rules and regulations as are necessary to effectuate the purposes of P.L. , c. (C. ) (pending before the Legislature as this bill).

8. This act shall take effect immediately, except that sections 2 and 3 shall take effect one year after the date of enactment.

STATEMENT

This bill imposes several requirements on app stores and developers related to age verification. Under the bill, an app store provider is required to verify the age of all State residents who create an account with the app store provider and if the individual is a minor, require the account to be affiliated with a parent account and obtain parental consent from the holder of the affiliated parent account before allowing the minor to download an app, purchase an app, or make an in-app purchase.

Specifically the bill requires app store providers to: (1) request age information from an individual located in the State when the individual creates an account with the app store provider and verify the individual’s age category; (2) if the age verification method determines the individual is a minor, require the account to be affiliated with a parent account and obtain verifiable parental consent from the holder of the affiliated parent account before the minor can download an app, purchase an app, or make an in-app purchase; (3) after receiving notice of a significant change, as defined in this bill, from the developer, notify the user of the significant change and for a minor account, notify the holder of the affiliated parent account and obtain renewed verifiable parental consent; (4) provide certain information to a developer as required under this bill; (5) notify a developer when a parent or guardian revokes parental consent; and (6) protect personal age verification data by various methods provided in the bill.

Additionally, the bill requires developers to: (1) verify the age category of users located in the State and for a minor account verify whether verifiable parental consent has been obtained; (2) notify app store providers of a significant change to the app; (3) use age category data received from an app store provider to enforce any developer-created age-related restrictions, ensure compliance with applicable laws and regulations, and implement any developer-created safety-related features or defaults; and (4) request personal age verification data or parental consent, at the time a user downloads an app or purchases an app, when implementing a significant change to the app, or to comply with applicable laws or regulations. The bill authorizes developers to request personal age verification data or parental consent: (1) no more than once during each 12-month period, (2) when there is reasonable suspicion of account transfer or misuse outside the verified age category, or (3) when a user creates a new account with the developer.

Under the bill, if an app store provider of a developer violates the bill, it is a violation of the New Jersey Consumer Fraud Act. Additionally, bill permits a minor, or parent or guardian of a minor, who has been harmed by a violation of certain provisions on the bill to bring an action in the Superior Court against an app store provider or a developer. If the suit is successful, an individual would be entitled to reasonable attorney fees and court costs. An individual would also be entitled to up to the greater of actual damages or $1,000 for each violation.

The bill includes a provision that includes circumstances under which developers would not be liable for a violation of the bill.