On April 21, 2026, the Computer & Communications Industry Association (trade association) voluntarily dismissed its constitutional challenge to the Utah App Store Accountability Act (ASAA). The dismissal follows statutory amendments enacted earlier this year that removed the Utah Attorney General’s (AG) authority to enforce the law. This sequence of events underscores the increasingly complex and rapidly developing nature of minors’ online safety regulations.
Utah ASAA Background
Utah was the first state to enact an ASAA, imposing new obligations on app stores and app developers aimed at protecting users under the age of 18 (minors). Key requirements for app developers under the Utah ASAA include (1) verifying a user’s age category through app store-provided signals; (2) confirming the app store has obtained parental consent before a minor may download or purchase the app or make in-app purchases; and (3) notifying app stores of certain “significant changes” to the app’s terms or privacy policy.
The statute was originally set to take effect on May 6, 2026. In February 2026, however, the trade association filed a First Amendment challenge seeking to enjoin the Utah AG from enforcing the statute. The trade association asserted that the law would impose unconstitutional burdens on online speech by restricting dissemination and curation of protected speech or access to it.
Statutory Amendments and Dismissal
While the litigation was pending, Utah amended its ASAA by enacting House Bill 498 (HB 498) on March 18, 2026. HB 498 delayed the Utah ASAA’s effective date by one year, to May 6, 2027, and significantly revised its enforcement framework. Most notably, HB 498 eliminated the Utah AG’s authority to enforce the Utah ASAA. Under the revised statute, only minors injured by a violation of the statute or their parents or legal guardians can bring claims against app stores or app developers.
Because the trade association’s claim was directed solely at the Utah AG’s enforcement authority, the elimination of government enforcement authority rendered the trade association’s claim moot. As a result, the trade association voluntarily dismissed the case.
Looking Ahead
Although the amendments to the Utah ASAA removed both the immediate compliance deadline of May 6, 2026, and the risk of governmental enforcement, the statute’s express private right of action remains a significant consideration for app stores and app developers. Businesses should plan for continued regulatory fragmentation in this area.
Texas, Louisiana, and Alabama have enacted ASAAs that impose substantially similar obligations to the Utah ASAA’s requirements. These laws carry varying effective dates and enforcement status. For example, Louisiana’s ASAA will become effective and enforceable on July 1, 2026. Texas’s ASAA became effective on January 1, 2026, but its enforcement is currently preliminarily enjoined while a First Amendment challenge is being litigated. Alabama’s ASAA will become effective on January 1, 2027. Taken together, these developments highlight the need for ongoing monitoring and a flexible compliance strategy as legislators continue to refine the regulatory framework governing minors’ online safety.
Alston & Bird’s Privacy, Cyber & Data Strategy Team will continue to monitor developments relating to minors’ online safety, including age verification requirements. Please contact us if you have any questions.
