R Street Letter to Governor Abbott in Opposition to SB 2420 “The App Store Accountability Act”
May 15, 2025,
The Honorable Greg Abbott
Governor of Texas
P.O. Box 12428
Austin, Texas 78711-2428
RE: The R Street Institute OPPOSES Senate Bill 2420: “An act relating to the regulation of platforms for the sale and distribution of software applications for mobile devices.”
Gov. Abbott,
My name is Josh Withrow, and I am a resident fellow with the Technology and Innovation Policy team at the R Street Institute, which is a nonprofit, nonpartisan, public policy research organization. Our mission is to engage in policy analysis and outreach to promote free markets and limited, effective government in many areas, including the technology and innovation sector.
I am writing to you today on behalf of the R Street Institute to urge you to veto Senate Bill 2420, dubbed the “App Store Accountability Act.” As we advised in testimony to the Texas Senate in March, we are concerned that “instead of empowering parents, SB 2420 merely imposes a government mandate to replicate protections that are already easily available to them” and that “it erects barriers to accessing speech and content for all mobile device users and creates novel data privacy and security problems.”[1]
No matter how the law is enforced, Texans would be forced to hand over a great deal of sensitive personal data, including potentially government IDs, to Google and Apple merely in order to be able to download apps to their mobile devices. It would be impossible for app stores to implement the level of age verification required by SB 2420 without collecting more data on all of their users than they do presently, and even the best age estimation services commercially available have error rates that would force many users to produce further evidence such as a state ID in order to verify they are not a minor.[2] Verifying parental consent is even harder to do without resorting to documentary identification.[3]
Whether the age and parental consent verification are performed by the app store developers themselves or by a third party, the data collected creates an extra cybersecurity hazard, as companies would be incentivized to keep at least some of the data in order to be able to prove compliance with the law.[4] Indeed, a major provider of age verification was attacked and breached by hackers just last year.[5]
The burdens that mandatory age verification pose to users’ privacy and online anonymity are one reason why such mandates have repeatedly been deemed unconstitutional by the courts, and SB 2420 would undoubtedly be similarly enjoined and eventually struck down on First Amendment grounds if enacted.[6] Shifting the burden of age verification from websites and apps themselves to the app stores does not solve the underlying practical and constitutional concerns that are inherent to broad age restrictions on access to internet content and speech.[7]
Aside from these difficulties, at a practical level SB 2420 wouldn’t keep kids and teens safe from most online harms – they can simply bypass access to the app stores by using their mobile device’s web browser. And rather than empowering parents to protect their children from harmful content online, SB 2420 would compromise their privacy and force them to respond to permission requests for any app download, be it a social media app or a calculator. The parental controls that have already been built into mobile devices are easily accessible and far more effective than anything that this bill would accomplish.[8]
Thank you for your consideration,
Josh Withrow
Fellow, Technology & Innovation
R Street Institute
CC:
Robert Black, Chief of Staff
Toby Baker, Deputy Chief of Staff
Adriana Cruz, Executive Director, Texas Economic Development & Tourism
Daniel Mittnacht, Policy Advisor
[1] Josh Withrow, “R Street Testimony in Opposition to SB 2420,” R Street Institute, Mar. 31, 2025. https://www.rstreet.org/outreach/r-street-testimony-opposition-to-sb-2420-an-act-relating-to-the-regulation-of-platforms-for-the-sale-and-distribution-of-software-applications-for-mobile-devices/.
[2] On error rates for the best age estimation technologies, see: Kayee Hanaoka, et al., “Face Analysis Technology Evaluation: Age Estimation and Verification,” NIST Internal Report 8525, May 2024. https://nvlpubs.nist.gov/nistpubs/ir/2024/NIST.IR.8525.pdf.
[3] The State of Play: Is Verifiable Parental Consent Fit for Purpose?” Future of Privacy Forum, June 2023. https://fpf.org/verifiable-parental-consent-the-state-of-play/
[4] Shoshana Weissmann, “Age verification legislation discourages data minimization even when legislators don’t intend that,” R Street Institute, May 24, 2023. https://www.rstreet.org/commentary/age-verification-legislation-discourages-data-minimization-even-when-legislators-dont-intend-that/
[5] Jason Kelley, “Hack of Age Verification Company Shows Privacy Danger of Social Media Laws,” Electronic Frontier Foundation, June 26, 2024. https://www.eff.org/deeplinks/2024/06/hack-age-verification-company-shows-privacy-danger-social-media-laws
[6] See, e.g.: Netchoice LLC v. David Yost, U.S. District Court for the Southern District of Ohio, Eastern Division, 2:24-cv-00047. https://netchoice.org/wp-content/uploads/2024/01/2024.01.09-ECF-27-ORDER-Granting-TRO.pdf, NetChoice LLC v. Lynn Fitch, U.S. District Court for the Southern District of Mississippi, Southern Division, 1:24-cv-170-HSO-BWR https://netchoice.org/wp-content/uploads/2024/07/NetChoice-v-Fitch-District-Court-Preliminary-Injuction-Ruling-July-1-2024.pdf , and NetChoice v. Sean Reyes, U.S. District Court for the District of Utah, 2:23-cv-00911-RJS-CMR and 2:24-cv-00031-RJS-CMR https://netchoice.org/wp-content/uploads/2024/09/NetChoice-v-Reyes-2024.09.10-ECF-86-ORDER-Granting-PI.pdf
[7] Shoshana Weissmann and Josh Withrow. “No, conscripting the app stores doesn’t solve the problems with age verification,” R Street Institute, Jan. 29, 2025. https://www.rstreet.org/commentary/no-conscripting-the-app-stores-doesnt-solve-the-problems-with-age-verification/.
[8] For example, a quick step-by-step walkthrough for how to enable parental controls on any commonly-owned mobile device: “Parental Controls,” Internet Matters, https://www.internetmatters.org/parental-controls/