California’s Digital Age Assurance Act (DAA): Moving Age Verification to the Device

UPDATE: This article incorporates the amendments enacted through AB 1856 in September 2026 , before the Act’s January 1, 2027 operative date.

California’s growing collection of online child-safety laws presents a threshold problem: how does an online service know whether the person using it is a child?

That question becomes increasingly important as California imposes different obligations based on age. Some laws require special protections for users under 18. Others distinguish among younger children, teenagers, and adults. And California’s newly enacted companion-chatbot legislation, Adam’s Law, expressly relies on age determination to decide when its extensive child-safety protections apply. See California’s Adam’s Law: Building Child Safety Into AI Companion Chatbots.

The Digital Age Assurance Act (DAA), enacted through AB 1043 in 2025 and amended through AB1856 in 2026, is codified at California Civil Code §§ 1798.500–1798.505. The amendments clarify the framework’s coverage, establish express duties for application stores, address how developers’ knowledge extends to associated websites, and add restrictions on requesting age signals and protections for developers receiving erroneous signals.

Rather than requiring every application to independently determine the age of every user, the DAA creates an infrastructure for transmitting age-bracket signals from the operating-system or application-store level to application developers.

The Digital Age Assurance Act does not simply require applications to determine age. It creates infrastructure through which age information can travel from the device to the applications that need it.

The Digital Age Assurance Act supplies age-assurance infrastructure rather than a comprehensive set of child-safety requirements. Its protections supplement other applicable laws, and it does not modify, impair, or supersede antitrust law. Section 1798.504(d) expressly references the California Age-Appropriate Design Code Act, which separate 2026 legislation repeals and replaces. See California’s Age-Appropriate Design Code Gets a Rewrite: New Privacy Rules for Users Under 18.

When Does the Digital Age Assurance Act Take Effect?

The legislation became effective January 1, 2026, but the statutory framework does not become operative until January 1, 2027. Cal. Civ. Code § 1798.505.

For devices whose account setup occurred before January 1, 2027, operating-system providers must provide an accessible interface before July 1, 2027 allowing the account holder to supply the primary user’s birth date, age, or both.

The statute also addresses previously installed applications. If an application was downloaded before January 1, 2027, was last updated with updates on or after January 1, 2026, and its developer has not already requested an age signal for the user, the developer must request one from a covered application store or an operating-system provider before July 1, 2027. Cal. Civ. Code § 1798.502.

Who Is Subject to the Digital Age Assurance Act?

The Act distributes obligations across applications and the three principal actors involved in determining and communicating a user’s age: application developers, operating-system providers, and covered application stores.

The three actors are:

• Operating-system providers develop, license, or control operating-system software on computers, mobile devices, or other general-purpose computing devices. The definition excludes persons or entities distributing an operating system or application under license terms permitting recipients to copy, redistribute, and modify the software. Cal. Civ. Code § 1798.500(g)
• Covered application stores are publicly available websites, applications, services, or platforms that distribute and facilitate downloads of applications from third-party developers. Services or platforms distributing extensions, plug-ins, add-ons, or other software that runs exclusively within a separate host application are expressly excluded. Cal. Civ. Code § 1798.500(e)
• Developers are persons that own an application, or maintain or control its hosting, in a covered application store. Cal. Civ. Code § 1798.500(f)

Practice Tip: Map the age-assurance chain across your product: who provides the age information, who generates the age-bracket signal, and how the application receives and uses that signal to comply with applicable law.

An application is software that may be run or directed by a user on a computer, mobile device, or other general-purpose computing device capable of accessing a covered application store or downloading an application. The definition expressly excludes software components that are not themselves offered to consumers as standalone executable applications through a covered application store.  Cal. Civ. Code § 1798.500(c)

The statute also expressly excludes:

• broadband internet access services;
• telecommunications services; and
• the delivery or use of physical products.

Cal. Civ. Code § 1798.504(f).

What Does the Digital Age Assurance Act Require?

The Digital Age Assurance Act creates a system for communicating a user’s age bracket from the device level to applications. Rather than requiring each application to independently collect a user’s precise birth date or age, the Act divides responsibility between account holders, operating-system providers, covered application stores, and application developers.

1. Account Holders Provide Age Information at the Device Level

If an operating system operates on a device and has an account-setup feature, its provider must supply an accessible interface requiring the account holder to indicate the primary user’s birth date, age, or both. That information supports an age-bracket signal made available to covered application stores and developers. Cal. Civ. Code § 1798.501(a)(1).

An account holder is an adult or the parent or legal guardian of a user under 18 in California, subject to exclusions for parents of emancipated minors and parents or guardians not associated with the user’s device. The 2026 amendments delete the original definition limiting “user” to a child who is the primary user of a device. The signal nevertheless remains expressly tied to the device’s primary user. Cal. Civ. Code § 1798.500(a), (h).

2. Operating Systems Convert Age Information Into an Age-Bracket Signal

Applications receive an age-bracket signal rather than necessarily receiving the birth date or precise age supplied by the account holder. Operating-system providers must make the signal available to requesting developers and covered application stores through a reasonably consistent, real-time application programming interface. Cal. Civ. Code § 1798.501(a)(2)

• “Signal” means age-bracket data pertaining to the primary user of a device, sent to an application by a real-time secure application programming interface or operating system. Cal. Civ. Code § 1798.500(h)
• “Age bracket data” is nonpersonally identifiable data derived from the user’s birth date or age and used to indicate an age range. Cal. Civ. Code § 1798.500(b) At minimum, the signal must identify which of four age ranges applies:

Operating-system providers must transmit only the minimum amount of information necessary to comply with the Act. Cal. Civ. Code § 1798.501(a)(3)

3. Covered Application Stores Must Request and Relay Signals

The 2026 amendments establish express duties for covered application stores. With respect to a user of the store, they must request a signal from the user’s operating-system provider and provide the received signal to a developer upon request. Cal. Civ. Code § 1798.501(c).

Practice Tip: The framework supports both a direct route from operating-system provider to developer and a route through a covered application store.

4. Developers Must Request the Age Signal and Comply with Applicable Law

When an application is downloaded onto and launched from a particular device, its developer must request an age signal for the particular user from an operating-system provider or covered application store. Cal. Civ. Code § 1798.501(d)(1)(A).

Subject to the rules for contradictory age information, the developer must treat the signal as the primary indicator of the user’s age range. Receipt gives the developer deemed actual knowledge of that range across the application platforms and access points specified in the statute, even if the developer willfully disregards the signal. Cal. Civ. Code § 1798.501(d)(2)–(3).

• That knowledge can extend to associated websites. The statute expressly includes developer-owned, maintained, or controlled websites through which the user may create an account for the platform accessed by the same application. It also includes developer-controlled websites used to create or log into an account from the device on which the application was downloaded and launched. Cal. Civ. Code § 1798.501(d)(2)(A)(i)–(ii).
• These provisions connect a received application signal to specified website activity. They do not establish a universal mechanism requiring every standalone website to receive a visitor’s age signal.

Once the signal arrives, the developer cannot treat the user as age-unknown.

If the developer has internal clear and convincing information that the user’s age differs from the signal, it must prioritize that information and is deemed to have actual knowledge of the corresponding age range. The statute identifies age information supplied to the developer about subaccount users or users associated with an account or account settings as examples. Cal. Civ. Code § 1798.501(d)(3)(B).

The developer must use the signal to comply with applicable law. The Act supplies age information and establishes knowledge; other applicable laws determine the protections that the user must receive. Cal. Civ. Code § 1798.501(d)(4).

Practice Tip: Map how an age signal follows a user across your application, associated accounts, and covered website access. Document how conflicting account or subaccount information is handled and which age-dependent legal obligations the resulting determination triggers.

5. Age Signals Have Limits on Collection, Sharing, and Repeat Requests

A person may not request an age signal from an operating-system provider or covered application store unless the Act or another applicable law requires the request. An entity subject to the Act also may not prompt a user to change the user’s age information. Cal. Civ. Code § 1798.501(d)(1)(B), (e).

Operating-system providers must transmit only the minimum information necessary for compliance. Developers may not request more information than necessary, and operating-system providers and developers may not share signal information with third parties for purposes not required by the Act. Cal. Civ. Code § 1798.501(a)(3), (b), (d)(4).

A compliant developer need not request a new signal at every account login after initial account creation. Periodic requests after download and launch are permitted to maintain compliance. Cal. Civ. Code § 1798.504(h)–(i).

Shared Devices, Erroneous Signals, Non-Discrimination, and Anti-Competitive Behavior

Shared Devices: The Act does not impose liability arising from the use of a shared device or application by someone other than the user to whom the signal pertains. This recognizes that a signal concerning the device’s primary user may not identify every person who uses it. Cal. Civ. Code § 1798.504(g).

Erroneous Signals: The Act retains a good-faith protection for operating systems and covered application stores against liability for erroneous signals or conduct by developers receiving those signals. The 2026 amendments add a corresponding protection for developers that make a good-faith compliance effort: they are protected against liability for an erroneous signal or conduct by the operating system that sent it. Both protections take account of available technology and reasonable technical limitations or outages. They do not provide blanket immunity for failures to comply with the Act. Cal. Civ. Code § 1798.503(b)-(c).

Non-Discrimination/Anti-Competitive Behaviour: Operating-system providers and covered application stores must comply nondiscriminatorily, applying at least the same restrictions to their own applications and distribution activities as to third parties. They also may not use third-party data obtained through the Act to compete with third parties, give preference to their own services, or otherwise act anticompetitively. Cal. Civ. Code § 1798.504(c).

Together, these provisions recognize the practical limitations of device-level age assurance while preventing the infrastructure from becoming either a source of automatic liability or a competitive advantage.

Enforcement: Up to $7,500 Per Affected Child

The Digital Age Assurance Act is enforceable exclusively through a civil action brought in the name of the people of California by the Attorney General.

Violations may result in:

• injunctive relief;
• up to $2,500 per affected child for each negligent violation; or
• up to $7,500 per affected child for each intentional violation.

Cal. Civ. Code § 1798.503(a).

Conclusion

The Digital Age Assurance Act provides the infrastructure for a broader system of age-aware online regulation. By moving age assurance toward the device level and communicating age brackets rather than precise age information, California seeks to make child-safety laws easier to implement without requiring every application to independently verify its users’ ages. Its significance will ultimately depend on how this age-signal infrastructure interacts with the growing body of laws that provide different protections based on a user’s age.

Additional Resources

Legislation and Statutory Text

• Digital Age Assurance Act—original enactment — The 2025 legislation establishing California’s device-level age-signal framework.
• 2026 amendments to the Digital Age Assurance Act — The chaptered legislation revising coverage definitions, app-store duties, developers’ knowledge across associated websites, signal restrictions, and liability protections.
• California Civil Code §§ 1798.500–1798.505 — The Act’s codified provisions. If you are reviewing the statutory text before January 1st 2026, check the version displayed against the 2026 amendments (the amendments will not be added to the official online version of the California Civil Code until January 1st 2026.)

Related Articles in The de la Torre Review

• California’s Adam’s Law: Building Child Safety Into AI Companion Chatbots — Age assurance, protective defaults, parental controls, and other safeguards for companion chatbots used by children.
• California’s Age-Appropriate Design Code Gets a Rewrite: New Privacy Rules for Users Under 18 — Privacy and design obligations for online services, products, and features likely to be accessed by children.