SB 372 — Enacting the app store accountability act to regulate app store and developer operations with respect to minors, create requirements for age verification and parental consent and provide for enforcement under the Kansas consumer protection act and through a private cause of action.

AsAmended by House Committee {As Amended by Senate Committee of the Whole} As Amended by Senate Committee Session of 2026 SENATE BILLNo.

(e)(5) "App" means a software application or electronic service that a user may run or direct on a mobile device, including pre-installed applications.SB 372—Am.

(f)(6) "Appby store"HC means2 aapplications. publicly available website, software SB 372—Am.

by(f)(6) "App SCWstore" 2means a publicly available website, software application or electronic service that allows account holders to download apps from third-party developers onto a mobile device.

and (2)(B) maySB be372—Am. affiliated with one or more minor accounts.

(p)(18) "Parentalby consentHC disclosure"3 means(2)(B) may thebe followingaffiliated SBwith 372—Am.one or more minor accounts.

by(p)(18) "Parental SCWconsent 3disclosure" means the following information that an app store provider is required to clearly and conspicuously provide to the holder of a parent account prior to obtaining parental consent:

3. (a) At the time an individual who is located in this state createsSB an372—Am. account with an app store provider, or by December 31, 2026, for accounts created prior to July 1, 2026, such app store provider shall:

SBby 372—Am.HC 4 creates an account with an app store provider, or by December 31, 2026, for accounts created prior to July 1, 2026, such app store provider shall:

by SCW 4 (1) Request age category information from the individual;

and (C) maintaining compliance records;records, which shall not include copies of identification documents, biometric identifiers, verification data or other personally identifiable information collected solely for the purpose of age verification;

and (2) transmitting age category data using industry-standard encryption protocolsSB that372—Am. ensure data integrity and data confidentiality.

by HC 5 protocols that ensure data integrity and data confidentiality;

and (3) deleting or destroying any personally identifiable information or verification data collected for the purpose of verifying an account holder's age category pursuant to this act immediately after the age verification process is completed and shall not retain, use, process or disclose such information for any other purpose.

(2) knowingly misrepresent the information in the parental consent SBdisclosure; 372—Am.

or (3) share age category data or any associated data except as required by SCWsections 51 disclosure;through 8, and amendments thereto, or as otherwise required by law;

or (3) share(4) use, ageretain category data or disclose any associatedpersonally dataidentifiable exceptinformation ascollected requiredfor byverifying sectionsan 1account throughholder's 8,age andcategory amendmentsuse thereto,information orcollected asfor otherwiseadvertising, requiredbehavior bytargeting law.profiling, data brokerage or other commercial monetizations.

(h) The(h) An provisionsapp store provider shall provide each developer the option to direct the app store provider to prevent downloads of thisthe sectiondeveloper's shallapplication beby effectiveusers based on andthe afterage Januaryof 1,the 2027.user as determined by the app store provider.

(i) The provisions of this section shall be effective on and after January 1, 2027.

(i) AccountSB transfer;372—Am.

by HC 6 (i) Account transfer;

or (2) age data independently collected by the developer.developer may rely on an assessment of the age category of an individual that is different from the signal provided by the app store provider if the developer possesses clear and convincing evidence that the assessment of the age category is of greater accuracy than the signal provided by the app store provider.

A developer bears the burden of producing clear and convincing evidence that an assessment of the age of an individual is more accurate than the signal provided by an app store provider.

(2) knowingly misrepresent any information in the parental consent SBdisclosure; 372—Am.

by SCW 6 disclosure;

6. (a) (1) A violation of section 3 or 4, and amendments thereto, is an unconscionable act and practice under the Kansas consumer protection act.

(1) The(1)(A) The person alleging a violation of section 3 or 4, and amendments thereto, shall be deemed a consumer, and the app store provider or developer that violates such section shall be deemed the supplier;

and (2) proof(2)(B) proof of a consumer transaction shall not be required.

SB 372—Am.

by HC 7 (2) Nothwithstanding any provision of the Kansas consumer protection act to the contrary, only the attorney general or the attorney general's designee may bring a civil action alleging a violation of the Kansas consumer protection act pursuant to this section.

This section shall not be construed as creating or allowing a private right of action under K.S.A.

50-634, and amendments thereto.

and SB(3) complied 372—Am.with the requirements of section 4, and amendments thereto.

by SCW 7 (3) complied with the requirements of section 4, and amendments thereto.

(c) The provisions of this section only apply to actions brought pursuant to section 6, and amendments thereto, and shall not limit the liabilitySB of372—Am. any developer or app store provider under any other applicable state or federal law.

by HC 8 liability of any developer or app store provider under any other applicable state or federal law.

(c) allow(c) require ana appdeveloper, storedigital service provider or developerapp tostore implementprovider anyto measuresdisclose requiredpersonally byidentifiable sectionsinformation 1to throughanother 7,entity andexcept amendmentsas thereto,necessary into acomply mannerwith thatthis isact arbitrary,or capricious,as anticompetitiveotherwise orrequired unlawful;by law;

(d) require(d) allow aan app store provider or developer to collect,implement retain,any reidentifymeasures orrequired linkby anysections information,1 exceptthrough information7, and amendments thereto, in a manner that is:is arbitrary, capricious, anticompetitive or unlawful;

(d)(e) require a developer to collect, retain, reidentify or link any information, except information that is:

or (e) require(e)(f) require an app store provider or developer to block access to an app that an account holder has downloaded or installed onto a mobile device prior to July 1, 2026, except access to such app shall be blocked if: