HB4140 104TH GENERAL ASSEMBLY

LRB104 15499 SPS 28662 b

104TH GENERAL ASSEMBLY
State of Illinois
2025 and 2026
HB4140

Introduced 10/15/2025, by Rep. Travis Weaver

SYNOPSIS AS INTRODUCED:

New Act

Creates the Digital Age Assurance Act. Provides that an operating system provider shall: (1) provide an accessible interface at account setup that requires an account holder to indicate the birth date or age of the user of that device for the purpose of providing a signal regarding the user's age bracket to applications available in a covered application store; and (2) provide a developer who has requested a signal with respect to a particular user with a digital signal by a reasonably consistent real-time application programming interface that identifies, at a minimum, which age bracket pertains to the user. Provides that a developer that receives a signal in accordance with the Act shall be deemed to have actual knowledge of the age range of the user to whom that signal pertains across all platforms of the application and points of access of the application. Limits the use of data collected under the Act. Provides that a person that violates the Act shall be subject to an injunction and a specified civil penalty. Sets forth provisions concerning nondiscrimination and the scope of the Act. Effective January 1, 2027.

A BILL FOR

AN ACT concerning business.

Be it enacted by the People of the State of Illinois, represented in the General Assembly:

Section 1. Short title. This Act may be cited as the Digital Age Assurance Act.

Section 5. Definitions. In this Act:

"Account holder" means an individual in this State who is at least 18 years of age or a parent or legal guardian of a user in this State who is under 18 years of age. "Account holder" does not include a parent of an emancipated minor or a parent or legal guardian who is not associated with a user's device.

"Age bracket data" means non-personally identifiable data derived from a user's birth date or age for the purpose of sharing with developers of applications that indicates the user's age range, including, at a minimum, the following:

(1) whether a user is under 13 years of age;

(2) whether the user is at least 13 years of age and under 16 years of age;

(3) whether the user is at least 16 years of age and under 18 years of age; or

(4) whether the user is at least 18 years of age.

"Application" means a software application that may be run or directed by a user on a computer, a mobile device, or any other general purpose computing device that can access a covered application store or download an application.

"Child" means a person who is under 18 years of age.

"Covered application store" means a publicly available Internet website, software application, online service, or platform that distributes and facilitates the download of applications from third-party developers to users of a computer, a mobile device, or any other general purpose computing device that can access a covered application store or can download an application. "Covered application store" does not mean an online service or platform that distributes extensions, plug-ins, add-ons, or other software applications that run exclusively within a separate host application.

"Developer" means a person or entity that owns, maintains, or controls an application.

"Operating system provider" means a person or entity that develops, licenses, or controls the operating system software on a computer, mobile device, or any other general purpose computing device.

"Signal" means age bracket data sent by a real-time secure application programming interface or operating system to an application.

"User" means a child that is the primary user of a device.

Section 10. Age verification; digital signals.

(a) An operating system provider shall:

(1) provide an accessible interface at account setup that requires an account holder to indicate the birth date or age of the user of that device for the purpose of providing a signal regarding the user's age bracket to applications available in a covered application store; and

(2) provide a developer who has requested a signal with respect to a particular user with a digital signal by a reasonably consistent real-time application programming interface that identifies, at a minimum, which of the following categories pertains to the user:

(A) under 13 years of age;

(B) at least 13 years of age and under 16 years of age;

(C) at least 16 years of age and under 18 years of age; or

(D) at least 18 years of age.

(b) An operating system provider shall send only the minimum amount of information necessary to comply with this Act and shall not share the digital signal information with a third party for a purpose not required by this Act.

(c) A developer shall request a signal with respect to a particular user from an operating system provider or a covered application store when the application is downloaded and launched.

(d) A developer that receives a signal in accordance with this Act shall be deemed to have actual knowledge of the age range of the user to whom that signal pertains across all platforms of the application and points of access of the application even if the developer willfully disregards the signal.

(e) A developer shall not willfully disregard internal clear and convincing information otherwise available to the developer that indicates that a user's age is different than the age bracket data indicated by a signal provided by an operating system provider or a covered application store.

(f) Except as provided in subsection (e), a developer shall treat a signal received in accordance with this Act as the primary indicator of a user's age range for purposes of determining the user's age. If a developer has internal clear and convincing information that a user's age is different than the age indicated by a signal received in accordance with this Act, the developer shall use that information as the primary indicator of the user's age.

(g) A developer that receives a signal in accordance with this Act shall use that signal to comply with all with applicable laws, but shall not:

(1) request more information from an operating system provider or a covered application store than the minimum amount of information necessary to comply with this Act; or

(2) share the signal with a third party for a purpose not required by this Act.

Section 15. Previously activated devices and applications.

(a) With respect to a device for which account setup was completed before January 1, 2027, an operating system provider shall, before July 1, 2027, provide an accessible interface that allows an account holder to indicate the birth date or age of the user of that device for the purpose of providing a signal regarding the user's age bracket to applications available in a covered application store.

(b) If an application last updated on or after January 1, 2026, was downloaded to a device before January 1, 2027, and the developer has not requested a signal with respect to the user of the device on which the application was downloaded, the developer shall request a signal from a covered application store with respect to that user before July 1, 2027.

Section 20. Nondiscrimination. An operating system provider or a covered application store shall comply with this Act in a nondiscriminatory manner, including, but not limited to, by complying the following:

(1) an operating system provider or a covered application store shall impose at least the same restrictions and obligations on its own applications and application distribution as it does on those from third-party applications or application distributors; and

(2) an operating system provider or a covered application store shall not use data collected from a third party in the course of compliance with this Act to compete against that third party, give the covered application store's services preference relative to those of a third party, or to otherwise use this data or consent mechanism in an anticompetitive manner.

Section 25. Penalties.

(a) A person that violates this Act shall be subject to an injunction and a civil penalty of not more than $2,500 per affected child for each negligent violation or not more than $7,500 per affected child for each intentional violation. An action to collect a civil penalty under this Act may be brought by the Attorney General.

(b) An operating system provider or a covered application store that makes a good faith effort to comply with this Act, taking into consideration available technology and any reasonable technical limitations or outages, shall not be liable for an erroneous signal indicating a user's age range or any conduct by a developer that receives a signal indicating a user's age range.

Section 30. Scope.

(a) This Act does not modify, impair, or supersede the operation of any antitrust law.

(b) This Act does not require the collection of any additional personal information from device owners or device users other than personal information necessary to comply with Section 10.

(c) The protections provided by this Act are in addition to those provided by any other applicable law.

(d) This Act does not apply to:

(1) a broadband Internet access service, as provided in 47 CFR 8.1(b);

(2) a telecommunications service, as defined in 47 U.S.C. 153; or

(3) the delivery or use of a physical product.

(e) This Act does not impose liability on an operating system provider, a covered application store, or a developer that arises from the use of a device or application by a person who is not the user to whom a signal pertains.

Section 97. Severability. If any provision of this Act or its application to any person or circumstance is held invalid, the invalidity of that provision or application does not affect other provisions or applications of this Act that can be given effect without the invalid provision or application.

Section 99. Effective date. This Act takes effect January 1, 2027.