S. 5090 — Digital Age Assurance Act of 2026

This section defines terms for the Act, including age bracket data for users under 13, 13 to 16, 16 to 17, and 17 years of age; applications and application stores; browsers and browser providers; children as individuals under 17; covered devices and covered internet websites; operating system providers; signals transmitting age bracket data; verifiable credentials; and zero-knowledge proofs.

This section requires operating system providers to collect users' dates of birth and ages for new accounts at creation and for existing accounts unless already known. It mandates classifying users into age brackets, transmitting age bracket data signals in real time via API to developers, browser providers, and covered website operators using verifiable credentials or zero-knowledge proofs where feasible, and requiring children to link accounts to a parent or guardian. It limits data use to the required signals, imposes security and deidentification rules, provides a safe harbor for technical outages, and requires age verification and signal updates upon receipt of conflicting information.

This section requires developers and covered internet website operators to request age bracket signals from operating system or browser providers upon first download or access of an app or site, and to use the signal as the primary age indicator. It bars access if the signal places a user in an age bracket the operator has deemed inappropriate. If an operator possesses clear and convincing contrary age information, it must use that data temporarily, transmit it back to the provider, notify the user or parent, and resolve any correction request within 30 days. Operators may not request additional user data or share signals with third parties, and good-faith reliance on erroneous signals provides a safe harbor.

This section requires developers of application stores to request a signal from an operating system provider the first time a user accesses the store on a covered device and to provide the signal to other developers upon request. It imposes the same requirements on browser providers, who must provide the signal to covered internet website operators upon request.

This section prohibits developers, covered internet website operators, and operating system providers from collecting more user data than necessary to generate age bracket data or perform basic application functions. It also bars them from selling age bracket data, using it for profiling or targeted advertising, or combining it with other personal or inferred information.

This section prohibits targeted advertising to a user the person knows or reasonably should know is a child. It also bars selling, licensing, renting, trading, transferring, or otherwise disclosing a child's personal data to a data broker, while permitting contextual advertising that does not rely on personal data or behavioral profiling.

This section treats violations of sections 3 through 7 as unfair or deceptive acts under the Federal Trade Commission Act and authorizes the Commission to enforce the Act using its existing powers, with civil penalties not to exceed $2,500 for negligent violations and $7,500 for knowing or intentional violations, multiplied by the number of affected children. It also authorizes state attorneys general to bring parens patriae civil actions for injunctive relief, damages, or other remedies, subject to notice and intervention rights for the Commission, and provides a safe harbor for good-faith compliance when users input inaccurate information.

This section requires operating system providers and application store providers to impose age-related restrictions on third-party applications that are the same as or less restrictive than those applied to their own applications. It prohibits using third-party age bracket data to offer more favorable terms to the provider's own applications or services and bars requiring proprietary software development kits or licensing agreements for signal verification unless reasonably necessary for security, privacy, fraud prevention, or process integrity. Violations constitute unlawful methods of competition under section 5 of the Federal Trade Commission Act and per se violations of section 1 of the Sherman Act, enforceable by the Federal Trade Commission, the Attorney General, and state attorneys general.

This section provides that the Act does not preempt the Family Educational Rights and Privacy Act of 1974 or the Children's Online Privacy Protection Act of 1998, alter the scope of Section 230 of the Communications Act of 1934, require collection of personal data for age verification beyond normal business practices or through government-issued identification, biometrics, or facial age estimation, or restrict cooperation with law enforcement, compliance with legal process, or responses to security incidents.

This section limits preemption of state laws to cases of direct conflict with the Act and preserves the authority of federal and state governments to enact or enforce laws and regulations that provide at least as much protection to individuals as the Act.