Apple's Declared Age Range API returns an age range, a declaration type and parental-control flags to an iPhone app, inside the app process. Apple keeps the birthday. Apple has applied it to new Texas accounts since June 4, 2026; California deems a developer to know the range from January 1, 2027.
Google Play's Age Signals API gives an Android app the user's age range and how it was established, never the birthdate. It returns signals in Brazil and Texas; Google announced a global expansion on July 29, 2026. The call, the four tiers, spoofing, SDK access, and what a scan and a capture show.
Since October 1, 2026, Maryland HB 895 (Chapter 154 of 2026) bars food retailers of 15,000+ square feet and third-party delivery service providers from using a consumer's personal data to set a higher price for tax-exempt food. The Consumer Protection Division enforces it after a 45-day cure.
Since October 1, 2026, Connecticut SB 4 (Public Act 26-64) provides: "No controller shall sell any consumer's precise geolocation data" and "No third party shall sell any consumer's precise geolocation data." The ban has no consent clause. The Attorney General enforces it under CUTPA.
California SB 690, Chapter 976, makes § 638.51 pen register claims over websites, online applications and mobile applications an Attorney General action from 2027-01-01, and applies to pending claims filed in the prior two years. Sections 631 and 632 keep their private right of action.
California AB 2561, Chapter 478 of 2026, bars an operating system or app from undoing a user's affirmative configuration of a privacy setting without the user's consent, from January 1, 2027. The text names no penalty or enforcer; the rule requiring the most protective default was cut in April.
On September 16, 2026 Apple announced an alternative App Tracking Transparency prompt for the EU from iOS 27.2: a full-page sheet, Markdown text, an Additional Information button and a re-prompt after one year. It is the only prompt for apps in Germany, France, Italy, Poland and Romania.
On September 10, 2026, California enacted SB 1119 (Chapter 190). From July 1, 2027, a companion chatbot open to users under 18 must ship with parent-only default settings, may not show children cross-context behavioral ads or sell a child's chatbot data. Penalties reach $15,000 per affected child.
On September 10, 2026, California signed AB 1856, AB 1709 and AB 2246. From January 1, 2027, a developer that requests and receives the age bracket signal is deemed to know the user's age range. A state table, the Apple and Google APIs, and what a binary and a traffic capture can show.
On September 2, 2026, Delaware Governor Matt Meyer signed HB 380, amending the Delaware Personal Data Privacy Act from January 1, 2027. The law will apply at 10,000 consumers, and a sale of sensitive data must be "strictly necessary" to a product or service the consumer requested.
Governor Mikie Sherrill signed the New Jersey Kids Code Act (A4015/S3413) on August 11, 2026, as P.L.2026, c.73. It takes effect September 1, 2027. A covered child or minor, a parent or the Attorney General can sue, and a court may award $5,000 per violation or treble damages, whichever is greater.
EU AI Act Article 50 applies from August 2, 2026. A chatbot, AI companion or AI agent in the EU must tell each user at the first interaction that it is an AI unless that is obvious, and generative AI outputs must carry a machine-readable mark. Commission guidelines of July 20 set out what counts.
Since August 1, 2026, California Civil Code § 1798.99.86(c) requires every data broker to access the Delete Request and Opt-out Platform (DROP) at least once every 45 days and process deletion requests within 45 days. The fine is $200 per deletion request per day.
From April 22, 2026, operators must comply with the FTC's amended COPPA Rule (16 CFR Part 312). It adds separate parental consent for disclosures to third parties, biometric and government-issued identifiers, a mixed audience definition, and written security and retention programs.