BILL ANALYSIS

C.S.S.B. 2420

By: Paxton

Trade, Workforce & Economic Development

Committee Report (Substituted)

BACKGROUND AND PURPOSE

The bill sponsor has informed the committee of growing concerns regarding the rise of social media and its pervasiveness in the lives of children and teens, leaving parents in the position to determine the best ways to protect their children. Unlike transactions at brick and mortar stores, which require verification of a consumer's age before the purchase of age-restricted products such as alcohol and cigarettes, the digital world allows minors to enter into contracts regarding the usage of their data with few parameters. C.S.S.B. 2420, the App Store Accountability Act, seeks to remedy this issue by requiring app stores to employ age verification, obtain parental consent to the use of mobile applications by minors, and provide information from app developers regarding an app's rating.

CRIMINAL JUSTICE IMPACT

It is the committee's opinion that this bill does not expressly create a criminal offense, increase the punishment for an existing criminal offense or category of offenses, or change the eligibility of a person for community supervision, parole, or mandatory supervision.

RULEMAKING AUTHORITY

It is the committee's opinion that this bill does not expressly grant any additional rulemaking authority to a state officer, department, agency, or institution.

ANALYSIS

C.S.S.B. 2420 amends the Business & Commerce Code to require the owner of an app store, when an individual in Texas creates an account with the app store, to use a commercially reasonable method of verification to verify the individual's age category, using the following age categories for assigning a designation:

· an individual who is younger than 13 years of age is considered a "child";

· an individual who is at least 13 years of age but younger than 16 years of age is considered a "younger teenager";

· an individual who is at least 16 years of age but younger than 18 years of age is considered an "older teenager"; and

· an individual who is at least 18 years of age is considered an "adult."

C.S.S.B. 2420 defines the following terms for purposes of the bill's provisions:

· "age category" as information collected by the owner of an app store to designate a user based on the age categories described by the bill's provisions;

· "app store" as a publicly available website, software application, or other electronic service that distributes software applications from the owner or developer of a software application to the user of a mobile device; and

· "mobile device" as a portable, wireless electronic device, including a tablet or smartphone, capable of transmitting, receiving, processing, and storing information wirelessly that runs an operating system designed to manage hardware resources and perform common services for software applications on handheld electronic devices.

C.S.S.B. 2420 requires the owner of an app store, if the owner determines under the bill's provisions that an individual is a minor who belongs to an age category that is not "adult," to require that the minor's account be affiliated with a parent account belonging to the minor's parent or guardian. The bill defines "minor" as a child who is younger than 18 years of age who has not had the disabilities of minority removed for general purposes. For an account to be affiliated with a minor's account as a parent account, the owner of an app store must use a commercially reasonable method to verify that the account belongs to an individual who the owner has verified belongs to the age category of "adult" and has legal authority to make a decision on behalf of the minor with whose account the individual is seeking affiliation. The bill authorizes a parent account to be affiliated with multiple minors' accounts.

C.S.S.B. 2420 requires the owner of an app store to obtain consent from a minor's parent or guardian through the parent account affiliated with the minor's account before allowing the minor to download a software application, purchase a software application, or make a purchase in or using a software application. The owner must obtain consent for each individual download or purchase sought by the minor and notify the developer of each applicable software application if a minor's parent or guardian revokes consent through a parent account. The bill authorizes the owner, for the purpose of obtaining such consent from a minor's parent or guardian, to use any reasonable means to do the following:

· disclose to the parent or guardian the following information:

o the specific software application or purchase for which consent is sought;

o the rating assigned to the software application or purchase under the bill's provisions;

o the specific content or other elements that led to that rating;

o the nature of any collection, use, or distribution of personal data that would occur because of the software application or purchase; and

o any measures taken by the developer of the software application or purchase to protect the personal data of users;

· give the parent or guardian a clear choice to give or withhold consent for the download or purchase; and

· ensure that the consent is given by the parent or guardian and through the account affiliated with a minor's account.

The bill requires the owner, if a software developer provides the owner with notice of a change to the terms of service or privacy policy of a software application under the bill's provisions, to notify any individual who has given consent for a minor's use or purchase relating to a previous version of the changed software application and obtain consent from the individual for the minor's continued use or purchase of the software application. The bill defines "personal data" as any information, including sensitive data, that is linked or reasonably linkable to an identified or identifiable individual, including pseudonymous data when the data is used by a person who processes or determines the purpose and means of processing the data in conjunction with additional information that reasonably links the data to an identified or identifiable individual. The term does not include deidentified data or publicly available information.

C.S.S.B. 2420 establishes that the owner of an app store is not required to obtain consent from a minor's parent or guardian for the following:

· the download of a software application that does the following:

o provides a user with direct access to emergency services, including 9-1-1 emergency services, a crisis hotline, or an emergency assistance service that is legally available to a minor;

o limits data collection to information collected in compliance with the federal Children's Online Privacy Protection Act of 1998 and necessary for the provision of emergency services;

o allows a user to access and use the software application without requiring the user to create an account with the software application; and

o is operated by or in partnership with a governmental entity, a nonprofit organization, or an authorized emergency service provider; or

· the purchase or download of a software application that is operated by or in partnership with a nonprofit organization that does the following:

o develops, sponsors, or administers a standardized test used for purposes of admission to or class placement in a postsecondary educational institution or a program within a postsecondary educational institution; and

o is subject to Education Code provisions relating to protection of personally identifiable student information.

C.S.S.B. 2420 requires the owner of an app store that operates in Texas to do the following:

· using a commercially available method, allow the developer of a software application to access current information related to the age category assigned to each user and whether consent has been obtained for each minor user; and

· protect the personal data of users by doing the following:

o limiting the collection and processing of personal data to the minimum amount necessary for verifying the age of an individual, obtaining consent under the bill's provisions, and maintaining compliance records; and

o transmitting personal data using industry-standard encryption protocols that ensure data integrity and confidentiality.

C.S.S.B. 2420 establishes that the owner of an app store that operates in Texas violates the bill's provisions relating to the duties of app stores if the owner does any of the following:

· enforces a contract or a provision of a terms of service agreement against a minor that the minor entered into or agreed to without consent under the bill's provisions;

· knowingly misrepresents information disclosed to the parent or guardian of a minor for the purpose of obtaining consent under the bill's provisions;

· obtains a blanket consent to authorize multiple downloads or purchases; or

· shares or discloses personal data obtained for purposes of the bill's provisions relating to the duty to verify the age of a user and age categories, except as required by the bill's provisions relating to information for software application developers or other law.

The bill exempts the owner of an app store from liability for a violation of the bill's provisions relating to the duty to verify the age of a user and age categories or the bill's provisions relating to required parental consent if the owner uses widely adopted industry standards to verify the age of each user and obtain parental consent as required by those provisions and applies those standards consistently and in good faith.

C.S.S.B. 2420 prohibits anything in the bill's provisions relating to the duties of app stores from being construed to do the following:

· prevent the owner of an app store that operates in Texas from taking reasonable measures to block, detect, or prevent the distribution of obscene material, defined by reference to Penal Code provisions relating to obscenity, or other material that may be harmful to minors;

· require such an owner to disclose a user's personal data to the developer of a software application, except as provided by these provisions;

· allow the owner to use a measure required by the bill's provisions in a manner that is arbitrary, capricious, anticompetitive, or unlawful;

· block or filter spam;

· prevent criminal activity; or

· protect the security of an app store or software application.

C.S.S.B. 2420 requires the developer of a software application that the developer makes available to users in Texas through an app store to assign to each software application and to each purchase that can be made through the software application an age rating based on the age categories described by the bill's provisions. The bill requires such a developer to provide to each app store through which the developer makes the software application available each assigned rating and the specific content or other elements that led to each rating. If the owner does not have a mechanism for displaying an age rating or other content notice, the owner must display for each software application available for download and purchase on the app store the rating assigned to the software application under these provisions and the specific content or other elements that led to that rating. If the owner has such a mechanism, the owner must make available to users an explanation of the mechanism and display for each software application available for download and purchase on the app store the age rating and other content notice. The bill requires the displayed information to be clear, accurate, and conspicuous.

C.S.S.B. 2420 requires the developer to provide notice to each app store through which the developer makes the software application available before making any significant change to the terms of service or privacy policy of the software application. For these purposes, a change is significant if it does any of the following:

· changes the type or category of personal data collected, stored, or shared by the developer;

· affects or changes the rating assigned to the software application under the bill's provisions or the content or elements that led to that rating;

· adds new monetization features to the software application, including new opportunities to make a purchase in or using the software application or new advertisements in the software application; or

· materially changes the functionality or user experience of the software application.

C.S.S.B. 2420 requires the developer to create and implement a system to use information received from the owner of an app store as required under the bill's provisions to verify the following:

· for each user of the software application, the age category assigned to that user under the bill's provisions; and

· for each minor user of the software application, whether consent has been obtained under the bill's provisions.

The bill requires the developer to use information received from the owner of an app store as required under the bill's provisions to perform this required verification.

C.S.S.B. 2420 authorizes the developer to use personal data provided to the developer by the owner of an app store as required under the bill's provisions only for the following purposes:

· enforcing restrictions and protections on the software application related to age;

· ensuring compliance with applicable laws and regulations; and

· implementing safety-related features and default settings.

The bill requires the developer to delete personal data provided by the owner of an app store under the bill's provisions on completion of the age verification which must be performed by the developer.

C.S.S.B. 2420 establishes that the developer violates the bill's provisions relating to the duties of software application developers if the developer does any of the following:

· enforces a contract or a provision of a terms of service agreement against a minor that the minor entered into or agreed to without consent;

· knowingly misrepresents an age rating or reason for that rating; or

· shares or discloses the personal data of a user that was acquired under those provisions.

C.S.S.B. 2420 exempts the developer from liability for the following:

· a violation of the bill's provisions relating to the designation of age ratings, if the developer uses widely adopted industry standards to determine the required rating and specific content and applies those standards consistently and in good faith; and

· a violation of the bill's provisions relating to age verification, if the developer relied in good faith on age category and consent information received from the owner of an app store and otherwise complied with applicable requirements.

C.S.S.B. 2420 establishes the following:

· a violation of the bill's provisions constitutes a deceptive trade practice in addition to the practices described by the Deceptive Trade Practices-Consumer Protection Act, and is actionable under that act; and

· the remedies provided by the bill's provisions are not exclusive and are in addition to any other action or remedy provided by law.

C.S.S.B. 2420 establishes the intent of the legislature that every provision, section, subsection, sentence, clause, phrase, or word in the bill, and every application of the bill's provisions to every person, group of persons, or circumstances, is severable from each other. If any application of any of the bill's provisions to any person, group of persons, or circumstances is found by a court to be invalid for any reason, the remaining applications of that provision to all other persons and circumstances must be severed and may not be affected.

EFFECTIVE DATE

January 1, 2026.

COMPARISON OF SENATE ENGROSSED AND SUBSTITUTE

While C.S.S.B. 2420 may differ from the engrossed in minor or nonsubstantive ways, the following summarizes the substantial differences between the engrossed and committee substitute versions of the bill.

The substitute omits the provisions from the engrossed that did the following:

· authorized the parent or guardian of a minor to bring an action against the owner of an app store or the developer of a software application for a violation of the bill's provisions;

· entitled a parent or guardian who prevails in such an action to receive injunctive relief, actual damages, punitive damages, reasonable attorney's fees, court costs, and any other relief the court considers appropriate; and

· established that a violation of the bill's provisions constitutes an injury in fact to a minor.