US senators propose operating system-based age assurance framework

A bipartisan group of U.S. senators introduced legislation that would require most computer and mobile device users to register their age with an operating system provider, creating a nationwide signaling system designed to tell apps and certain websites when protections for children should apply.

The Digital Age Assurance Act of 2026, introduced by Senators Andy Kim, Adam Schiff, Cynthia Lummis and John Barrasso, would make operating system providers the primary source of age signals used by apps and certain websites.

It has the support of the American Psychological Association, Mission Kids Child Advocacy Center, The Arc of New Jersey, Digital Defenders United, and New Jersey Children’s Alliance.

The bill was referred to the Senate Commerce, Science, and Transportation Committee.

Primary users would establish an account with the operating system provider and supply their date of birth. The provider would translate that information into one of four age brackets and make it available through a secure API without revealing the user’s exact age. Accounts for users younger than 17 would generally have to be linked to a parent or guardian.

The operating system’s signal would serve as the primary indicator of a user’s age for app developers and covered websites.

App stores and browsers would also have to obtain the signal from the operating system provider and provide it to developers or covered websites upon request.The browser provision would not require every website on the Internet to request an age signal. It would apply only to websites already required under federal or state law to verify a user’s age before granting access to content or services.

A browser provider would request the signal when a user first accessed the browser on a device and pass it to a covered website when requested.

Once a developer or covered website operator received a signal, it would be deemed to have actual knowledge of the user’s age bracket across every platform and point of access for that app or website.

It would be unlawful to allow access when the company’s own policies classified the app, website or a particular feature as inappropriate for users in that bracket.

The legislation identifies verifiable credentials and zero-knowledge proofs as privacy preserving methods for transmitting age information.

Operating system providers would use those methods where technically feasible and follow widely adopted, consensus-based interoperability standards. The bill also says it should not be interpreted as requiring any single method of generating, transmitting, or verifying an age signal.

Kim and the other sponsors have presented the framework as an alternative to making government identification or facial scans a required part of online age-assurance.

“The Digital Age Assurance Act puts kids’ data privacy first as we make sure Congress and tech companies do their part to make online spaces safer for our kids,” Kim said.

“By keeping government IDs and facial scans out of the equation, the Digital Age Assurance Act gives parents real protection for their children while giving platforms a trusted, privacy-protective way to know when those protections should apply,” Lummis added.

The statutory language is more limited. It says the legislation should not be interpreted as requiring age verification through government-issued identification, biometric information, other sensitive personal information or facial age-estimation technology.

It does not categorically prohibit a company from using one of those methods when otherwise legally permitted.

The initial registration process would be based on information entered by the user rather than mandatory documentary verification. An operating system provider, developer or covered website operator acting in good faith would not be liable under the act when a user submitted inaccurate information.

Developers and website operators would also receive liability protection for conduct resulting from an erroneous signal supplied by an operating system provider or app store.

A more formal verification process could be triggered when a developer or covered website operator obtained “clear and convincing information” indicating that a user’s age differed from the bracket contained in the signal.

The service would temporarily use the conflicting information as its primary age indicator and notify the user or, when the user was a child, the linked parent, or guardian.

To the extent technically feasible, it would send the information to the operating system provider, which would verify the user’s age and distribute an updated signal.

The developer or website operator would also have to provide a mechanism through which the user or parent could submit corrected age information and issue a determination within 30 days after receiving an update.

The bill does not specify how the operating system provider would conduct the resulting verification.

Developers, covered websites, and operating system providers would be prohibited from collecting more information than necessary to create or use the signal or perform their basic functions.

They could not sell age-bracket data, combine it with other personal or inferred information, or use it for profiling, engagement optimization, or targeted advertising.

The bill would separately make it unlawful for any person to direct targeted advertising to someone the person knew or reasonably should have known was younger than 17.

Contextual advertising based on the content being viewed, rather than personal data or behavioral profiling, would remain permissible. It would also prohibit selling, licensing, transferring, disclosing, or otherwise making a child’s personal data available to a data broker.

Operating system providers would have to employ reasonable security safeguards and delete or de-identify age-related information when the associated account was deleted.

The Federal Trade Commission (FTC) and state attorneys general would enforce the age-assurance, privacy and advertising provisions. Civil penalties could reach $2,500 for each negligent violation and $7,500 for each knowing or intentional violation.

When a violation affected children, the penalty could be multiplied by the number of children involved. The bill does not expressly create a private consumer right of action for violations of those provisions.

The legislation also contains competition rules intended to prevent Apple, Google, Microsoft, and other platform operators from using the age-assurance system to favor their own products.

Operating system and app store providers could not impose stricter age-related requirements on third-party applications than they impose on their own products.

They also could not require developers, browsers, or covered websites to use proprietary software or other exclusive technical dependencies unless reasonably necessary for security, privacy, fraud prevention, or the integrity of the verification process.

Violations of those provisions would be treated as unlawful methods of competition under the Federal Trade Commission Act and as per se violations of the Sherman Act. The FTC, Department of Justice, and state attorneys general would have authority to enforce them.

The bill would preempt state laws only when they conflicted with its provisions and would preserve federal or state requirements that provided protections at least as strong. It also would leave the Children’s Online Privacy Protection Act and federal and state student privacy laws in place.

The legislation would take effect 18 months after enactment. The FTC would have one year to issue implementing regulations, meaning none of the requirements would take effect unless the bill passes both chambers of Congress and is signed into law.

Article Topics

age verification  |  biometric age estimation  |  legislation  |  OS-level age verification  |  U.S. Government