California's Digital Age Assurance Act (the "DAAA") has been top of mind for me lately as its January 1, 2027 effective date approaches. Broadly, the law requires operating system providers to collect age information and provide developers with age-band signals. Plus, California recently amended the DAAA to clarify, among other things, the law's scope and signal requirements.
The DAAA is one of the most sweeping age-assurance laws enacted to date, with the potential to fundamentally reshape the tech world. While the law technically targets operating system providers and software application developers, its practical effects are likely to be felt across virtually all industries – basically any company with a mobile app and beyond.
Below is a quick breakdown of what to expect and some practical considerations for compliance.
The Countdown to January 1, 2027
Last year, we wrote about California's Digital Age Assurance Act ("DAAA"), enacted through AB 1043. Unlike other similar state laws (such as Texas' App Store Accountability Act), the DAAA creates a system in which operating system providers, rather than app stores alone, collect age information during account setup, place users into age bands, and make those age signals available to developers (of both software applications and mobile apps – the definition is pretty broad).
Historically, many apps have relied on self-reported birthdates, age gates, or the assumption that they operate as general-audience services. Under the DAAA, however, developers can expect to receive age signals from app stores and/or operating system providers. Perhaps most importantly, developers are deemed to have "actual knowledge" of a user's age range once they receive those signals.
As a practical matter, this makes it functionally impossible for companies to argue that they do not know whether their users are children, particularly in the context of COPPA, which applies not only to child-directed services but also to operators with actual knowledge that they are collecting personal information from children under the age of 13. Ignorance is no longer bliss, because under this new law, ignorance will be non-existent.
The Lookback Window
There's one additional date to pay attention to. While the DAAA takes effect on January 1, 2027 for new accounts, the law gives operating system providers until July 1, 2027 to implement a system for collecting age information from users with existing accounts. As a result, age signals will likely arrive in phases rather than all at once.
For at least part of 2027, companies will likely be operating in a mixed environment where some users are associated with age-band signals and others are not. Developers should start thinking now about how they will handle users who have not yet been age-banded and how newly received age signals will interact with age information already collected.
Covered App Stores
As noted, California has further amended the DAAA to address certain implementation questions and clarify how the law will operate in practice. While the amendments refine portions of the statute, they do not fundamentally change the DAAA's core terms.
Among other changes, the amendment created a third role of “covered application stores,” which are functionally a middleman between the operating system providers and developers, with their own set of obligations. The amendment also clarifies aspects of the law's scope, addresses cross-platform age signals, and provides additional guidance regarding when developers may rely on other "clear and convincing" age information rather than a received age signal. The amendment also creates a limited exception for open-source software.
What Companies Should Be Doing Now
Companies should evaluate:
- Whether they qualify as an operating system provider, covered application store, developer, or some combination of the three;
- What obligations attach to each role under the DAAA;
- How they will send, receive, process, and use age signals, including implementing any platform-specific APIs, such as with Apple's and Google's recent rollout;
- How age signals will interact with existing account systems and age-gating measures already maintained by the company; and
- Whether app ratings, privacy disclosures, child-safety features, and COPPA compliance programs are still compliant.
With January 1, 2027 now in sight, companies should treat compliance planning as a current project rather than a future one. The first step is implementation, and it is a big step.
/Passle/644c41cc474c4c94b77327c8/SearchServiceImages/2026-09-09-04-48-18-909-6aa0e512414b094d694c464a.jpg)
/Passle/644c41cc474c4c94b77327c8/MediaLibrary/Images/6373fcf4f636e919680b254a/2024-02-12-23-06-45-859-65caa4857f5a53a7bf1fc7df.jpg)
/Passle/644c41cc474c4c94b77327c8/SearchServiceImages/2026-08-06-00-31-43-267-6a73d5ef5b401acf132e82f2.jpg)
/Passle/644c41cc474c4c94b77327c8/SearchServiceImages/2026-07-31-20-35-17-885-6a6d07053b461f4f57bdf9b8.jpg)
