What Happened

States including Texas, Utah, Louisiana, and California have begun shifting children’s online safety obligations from individual apps and websites to app stores and operating systems. These laws generally require centralized age checks, parental consent tracking, and tighter coordination between app stores and developers, and they are already generating litigation risk, including a pending First Amendment challenge to the Texas statute. For a deeper overview of these state approaches and the emerging legal challenges, see this article.

Alabama has now joined that trend. On March 9, Governor Kay Ivey signed House Bill 161, the App Store Accountability Act, into law. The statute applies to app store providers and developers serving users in Alabama and establishes age categorization, age verification, and parental consent requirements for minors’ use of mobile apps, including many preinstalled apps. The act takes effect October 1, with a phase‑in period for existing accounts running to October 1, 2027.

Alabama’s law follows the same basic app‑store‑centric model seen in Texas, Utah, and Louisiana, including rules on age categories, how age data can be used and shared, and when app stores and developers can rely on each other under a statutory safe harbor.

The Details

HB 161 applies to entities that own, operate, or control app stores serving Alabama users, and to developers that own or control apps made available through those stores (including many pre‑installed apps). Users must be placed in one of four age categories — under 13, 13 to 15, 16 to 17, or 18 and older — and “minors” are individuals under 18 (with narrow exceptions for married or emancipated minors).

App stores must request and verify a user’s age category at account creation using commercially reasonable methods or an AG‑approved system. For minors, the store must link the account to a verified parent account and obtain “verifiable parental consent” before the minor can download apps, purchase apps, or make in‑app purchases. Consent must follow clear disclosures about the app’s data practices and require an affirmative grant or denial. Parents must be able to withdraw consent, and stores must notify developers when that occurs.

The act closely ties product changes to consent. When a developer makes a “significant change” — for example, materially altering data collection or sharing, adding monetization where none existed, or changing age ratings or content descriptions — it must notify the app store. The store must then notify users and, for minors, notify parents and obtain renewed consent before providing access to the changed version.

App stores must limit their collection and use of personal age‑verification data to verifying age, obtaining consent, and maintaining compliance records, and must use industry‑standard encryption. For pre‑installed apps, stores must share available age category information with developers on request and take reasonable steps to facilitate parental consent.

Developers must use the app store’s data‑sharing mechanisms to confirm Alabama users’ age categories and, for minors, consent status, and must notify app stores of significant changes to their apps. They may use age category data only to enforce their own age‑based protections, comply with law, or implement safety features, and must apply the lowest age category indicated by store‑provided or independently collected data. Generally, developers may not request age category data more than once every 12 months per account (absent special circumstances) and are barred from enforcing contracts against minors without confirmed consent, misrepresenting parental disclosures, or sharing age category data with third parties.

The Alabama AG will issue rules on compliant age‑verification processes and may enforce violations as deceptive trade practices, with penalties up to $7,500 per violation, plus fees, costs, and potential punitive damages for patterns of knowing or reckless violations. There is no express private right of action. The act includes a narrow safe harbor for developers that in good faith rely on app‑store‑supplied age and consent data and otherwise comply with the statute, as well as a safe harbor for age ratings and content descriptions when widely accepted industry standards are applied consistently and in good faith.

Why It Matters

Alabama’s App Store Accountability Act confirms that “app store accountability” is no longer an outlier but an emerging state‑level model for children’s online safety. For developers, it means treating age category and consent status as operational signals that must be integrated into product design, access controls, monetization decisions, and release processes — particularly when making “significant changes” that can trigger renewed consent.

Because Alabama’s requirements layer onto existing and evolving regimes in Texas, Utah, Louisiana, and California, app stores and developers will need to design flexible, multijurisdictional age‑assurance and parental consent architectures rather than one‑off, state‑specific fixes. The combination of detailed statutory obligations, AG rulemaking, and potentially high per‑violation penalties makes early planning around account flows, data handling, contracting, and governance critical for companies that operate app stores or distribute apps into Al.

Troutman Pepper Locke State Attorneys General Team

	Ashley Taylor – Co-leader and Firm Vice Chair Ashley is co-leader of the firm’s nationally ranked State Attorneys General practice, vice chair of the firm, and a partner in its Regulatory Investigations, Strategy + Enforcement (RISE) Practice Group. He helps his clients navigate the complexities involved with multistate attorneys general investigations and enforcement actions, federal agency actions, and accompanying litigation.
	Clay Friedman – Co-leader Clay co-leads the firm’s State Attorneys General practice and is nationally ranked by Chambers USA for AG Government Relations and in Best Lawyers for Advertising Law. He has dedicated his entire career to state attorney general and federal work, serving for nearly a decade in a senior role and more than 25+ years in private practice. Clay focuses his practice on helping industry-leading companies mitigate the risks associated with state and federal regulatory investigations and associated litigation.
	Chris Carlson Chris advises clients on regulatory, civil, and criminal investigations and litigation. With a background as an assistant attorney general, he provides practical guidance to clients with matters involving state attorneys general and federal regulatory agencies.
	Lauren Fincher Lauren has vast experience handling state attorneys general investigations, navigating complex regulatory compliance matters, and providing strategic counsel in enforcement actions across various industries. She helps clients manage high-stakes regulatory matters and guides them through complex legal landscapes.
	Stephen Piepgrass Stephen leads the firm’s Regulatory Investigations, Strategy + Enforcement (RISE) Practice Group, representing clients in single and multistate enforcement actions, including inquiries and investigations, as well as litigation involving state attorneys general and other state and federal governmental enforcement bodies. He has significant experience handling actions with federal agencies, including the CFPB and FTC, as well as single plaintiff and class action litigation for clients in highly regulated sectors such as financial services, health care, pharmaceutical, and education.
	Michael Yaghi Mike handles high-profile state attorneys general, FTC, and CFPB investigations by advising clients through these complex government inquiries. He assists clients through the entire life cycle of investigations, from regulatory enforcement through formal litigation.
	Matthew J. Berns Drawing on his experience in senior leadership roles in the New Jersey Attorney General’s and Governor’s Offices and as a trial attorney for the U.S. Department of Justice, Matt provides an insider’s perspective when guiding clients through complex government investigations, litigation, and other actions.
	Samuel E. “Gene” Fishel Gene is a former regulator with two decades of experience who has overseen state privacy and cybersecurity regulation enforcement, led national, multistate attorneys general privacy investigations, and prosecuted computer crimes at the state and federal levels. He has served at the forefront of state attorney general and federal enforcement, and utilizes this experience to proficiently represent client interests.
	Jeff Johnson Jeff helps clients navigate complex regulatory and litigation challenges with local, state, and federal authorities. His clients benefit from his decade of broad litigation experience, understanding of emerging state and federal regulatory issues, and strong relationships with attorneys general across the U.S. In addition to handling cases from trial through state or federal appeals, Jeff serves as amicus counsel in advancing legal rules to support his clients’ vital interests.
	Jay Myers Jay assists clients in heavily regulated industries, including health care, energy, insurance, emerging industries, and data privacy. He provides both regulatory legal advice and government relations strategies. Jay’s past and current clients include Fortune 10 companies, startups, nonprofits, industry associations, and advocacy groups. Recognizing that state government matters are often complex and multifaceted, he utilizes regulatory guidance, government advocacy, or both in tandem to deliver tailored solutions for each client’s unique needs.
	Zoe Schloss Zoe represents clients in litigation and government investigations. As former deputy attorney general for the Delaware Department of Justice, she is an experienced litigator who understands the enforcement priorities that impact her clients. Zoe works with individuals and corporate entities in highly regulated industries, including financial services, health care, and energy.
	Jessica Birdsong Jessica is an associate in the firm’s Regulatory Investigations, Strategy + Enforcement Practice Group. She received her J.D. from the University of Richmond School of Law, magna cum laude, where she served as associate articles editor of the Journal of Law & Technology.
	Nick Gouverneur Nick is an associate in the firm’s Regulatory Investigations, Strategy + Enforcement Practice Group. He received his J.D. from the University of Illinois College of Law, where he served as a member of the Journal of Law, Technology & Policy.
	Troy Homesley Troy is an accomplished litigator who has represented and defended clients across a wide range of complex, high-stakes disputes at both the trial and appellate levels. He has represented technology companies, business executives, law firms, investment funds, high-ranking federal officials, international non-profits, and asylum seekers. Troy draws on his broad litigation experience to advise clients before litigation arises, while claims are pending or threatened, and leading up to and through trial and appeals.
	Namrata Kang Namrata (Nam) is an associate in the firm’s Regulatory Investigations, Strategy + Enforcement (RISE) Practice Group, based in the Washington, D.C. office. She routinely advises clients on a wide variety of state and federal regulatory matters, with a particular emphasis on state consumer protection laws relating to consumer financial services and marketing and advertising. Nam’s experience transcends multiple industries, including financial services, telecommunications, media, and sports betting.
	Michael Lafleur Michael is an associate in the firm’s Regulatory Investigations, Strategy, and Enforcement Practice Group. Based out of the firm’s Boston office, Mike has deep experience in litigation, investigations, and other regulatory matters involving state-level regulators and state attorneys general.
	William LaRosa Bill represents clients in complex regulatory investigations, state attorneys general matters, and enforcement proceedings, drawing on his experience as a former assistant U.S. attorney and private sector litigator in high stakes, multistate AG and regulatory matters.
	Philip Nickerson Philip represents clients in sectors such as financial, tech, real estate, and energy in a range of litigation matters. He is experienced in matters involving trade secrets, government investigations, commercial contracts, construction and product defect.
	Lane Page Lane specializes in federal and state regulatory investigations and complex civil litigation. He focuses on representing financial institutions and other businesses, with a particular emphasis on consumer protection and fair lending issues.
	Dascher Pasco Dascher is an attorney within the Regulatory Investigations, Strategy, and Enforcement practice, based in the Richmond office. She joined our firm after working in personal injury and medical malpractice for a Virginia trial law firm. Dascher brings varied legal experience to the firm with strong litigation and regulatory strategy capabilities.
	Kyara Rivera Rivera Kyara is an associate in the firm’s Regulatory Investigations, Strategy + Enforcement Practice Group. She received her J.D. from the University of Richmond School of Law, cum laude, where she served as publications and online editor of the Public Interest Law Review.
	Timothy Shyu Timothy is an associate in the firm’s Regulatory Investigations, Strategy + Enforcement Practice Group.
	Trey Smith Trey focuses his practice on representing and advising regulated utilities before state public utility commissions. He routinely helps clients obtain certificates of public convenience and necessity for transmission infrastructure. In this role, Trey works with his clients’ subject-matter experts to manage administrative proceedings, including by preparing initial filings; responding to discovery requests; drafting rebuttal testimony; and litigating any disputed issues.
	Daniel Waltz Dan helps clients navigate all aspects highly regulated relationships between industry participants and federal, state and local governments. Whether engaging with regulators, negotiating transactions or representing clients in the courtroom, he delivers solutions that help his clients achieve their strategic goals.
	Stephanie Kozol Stephanie is Troutman Pepper Locke’s senior government relations manager in the state attorneys general department.