Bill > SB051

This bill establishes a framework for "age attestation" on computing devices to help applications comply with existing privacy laws, particularly the "Colorado Privacy Act," which has stricter rules for processing the personal data of minors (individuals under 18 years old). Starting July 1, 2028, operating system providers, such as those who make Windows or iOS, must provide an interface during account setup where the account holder can indicate the user's birth date, age, or age bracket. This information will be used to generate an "age signal," which is age-bracket data sent from the operating system or an app store to an application via a secure interface. Applications that are available through an app store and collect user data ("covered applications") will use this age signal to determine how to handle a user's data, especially if the user is a minor, thereby enabling them to follow legal obligations like avoiding targeted advertising or profiling for minors. Developers are required to use this age signal as the primary indicator of a user's age unless they have clear evidence to the contrary, and they can only use this information to comply with applicable laws, not for other purposes. The bill also includes provisions for existing devices and outlines penalties for violations, with higher penalties for intentional violations.