R Street Testimony in Opposition to VA SB 237, App Store Accountability Act
Testimony from:
Josh Withrow, Fellow, Tech & Innovation Policy, R Street Institute
In OPPOSITION to Senate Bill 237, “App Store Accountability Act; civil penalties, civil action”
February 4, 2026
Senate Committee on General Laws and Technology
Chairman Ebbin and members of the Committee,
My name is Josh Withrow, and I am a resident fellow with the Technology and Innovation Policy team at the R Street Institute, which is a nonprofit, nonpartisan, public policy organization. Our mission at RSI is to engage in research and outreach to promote free markets and limited, effective government in many areas, including the technology and innovation sector. It’s for this reason we are opposed to SB 237.
SB 237, dubbed the “App Store Accountability Act,” would mandate that mobile device app stores must verify upon setup whether the device owner is an adult or a minor, and obtain verifiable parental consent for every app download, update, or purchase made by a minor’s account.[1] While we support the goal of protecting kids and teens from harmful content and interactions online, we do not believe that mandating age verification for access to all devices and apps is a proper means to that end.[2] And aside from practical concerns we have about the effects of this legislation, SB 237 is very likely to be struck down as an unconstitutionally broad barrier to accessing protected speech and content.
In order to verify the age of their users, every mobile device owner will have to have their age verified so that app stores can sort users into one of four age categories: under 13, 13-15, 16-17, and 18 or older. To establish where a customer falls within these categories, the app stores are allowed to use “commercially available methods reasonably designed to ensure accuracy” or whatever methods state regulators sign off on. Even the best available age verification technologies have significant error rates that guarantee some adult users will be forced to provide some sort of documentary evidence to prove they are not a minor.[3]
Adults who wish to set up parent accounts would likely have to verify their adult status via some sort of hard identification, such as a government ID, in order to enable their minors – up to age of 18 – access to their own device.[4] Although SB 237 instructs that only the data that is necessary to prove compliance with the law be kept by the app stores and whatever services they use for age verification, the risk of liability for errors will certainly lead to over-retention of far more sensitive personal data than would be the case otherwise.[5] This is especially true since the bill grants a private right of civil action if the age protections are deemed to have been enforced improperly.
The additional data that app stores will have to collect from consumers in order to comply with SB 237 creates a tempting new trove of information for hackers. Similar data security concerns were one component of why California’s Age Appropriate Design Code has been enjoined by the courts, with a district court finding that the law was “actually likely to exacerbate the problem by inducing covered businesses to require consumers, including children, to divulge additional personal information.”[6]
Courts have repeatedly held that attempts to age-gate general-use online platforms (as opposed to narrow constraints on accessing adult content) are unconstitutionally broad under the First Amendment.[7] Moreover, requiring parental consent for minors to access lawful, non-obscene content has also found to be unconstitutional, with Justice Scalia noting for the majority that “we note our doubts that punishing third parties for conveying protected speech to children just in case their parents disapprove of that speech is a proper governmental means of aiding parental authority.”[8]
Several other states passed versions of the App Store Accountability Act last year, and the first of these to come into effect, Texas SB 2420, was immediately enjoined by a district court.[9] Judge Robert Pitman, in his decision, likened app store age verification as “akin to a law that would require every bookstore to verify the age of every customer at the door and, for minors, require parental consent before the child or teen could enter and again when they try to purchase a book” and declared the law “unconstitutional in the vast majority of its applications.” Given that SB 237 is substantially similar to this Texas law, it is extremely likely that it will meet the same fate in court if enacted.
Finally, SB 237 represents a government mandate to solve a problem whose solution already exists in the marketplace. The major online platform owners have been investing heavily to make their parental control tools at the device, browser, and platform levels more accessible and effective.[10] In addition, there has long been a robust market for third-party software that grants parents even more granular control over their children’ s mobile device screen time and online access, along with easy to follow guides on how to use them effectively.[11] The fact that these effective alternatives are easily available to any parent is another reason that broad age verification mandates fail the First Amendment requirement to impose the least-restrictive means of limiting access to objectionable content.[12]
Ultimately, we believe that a better substitute for these government age-verification mandates would be to find ways that the state can help parents understand the power they already possess to keep their kids safe online, and to educate kids and teens about how to responsibly navigate social media and the internet. For example, Tennessee passed a law in 2025 to include digital literacy as part of the state’s public school curriculums.[13] The Federal Trade Commission’s “Protecting Kids Online” campaign demonstrates another way that the state can help empower parents by helping them navigate the multitude of parental already available to them.[14] This approach is likely to prove far more effective, and is far more compatible with freedom of speech on the internet, than a blunt age verification mandate.
For the reasons outlined above, we strongly urge your opposition to SB 237.
Thank you for your consideration,
Josh Withrow
Fellow, Technology & Innovation Policy
R Street Institute
jwithrow@rstreet.org
[1] SB 237, Virginia State Senate, 2026 Legislative Session. https://lis.virginia.gov/bill-details/20261/SB237.
[2] See Shoshana Weissmann and Josh Withrow. “No, conscripting the app stores doesn’t solve the problems with age verification,” R Street Institute, Jan. 29, 2025. https://www.rstreet.org/commentary/no-conscripting-the-app-stores-doesnt-solve-the-problems-with-age-verification/.
[3] On error rates for the best age estimation technologies, see: Kayee Hanaoka, et al., “Face Analysis Technology Evaluation: Age Estimation and Verification,” NIST Internal Report 8525, May 2024. https://nvlpubs.nist.gov/nistpubs/ir/2024/NIST.IR.8525.pdf.
[4] “The State of Play: Is Verifiable Parental Consent Fit for Purpose?” Future of Privacy Forum, June 2023. https://fpf.org/verifiable-parental-consent-the-state-of-play/.
[5] Shoshana Weissmann, “Age verification legislation discourages data minimization even when legislators don’t intend that,” R Street Institute, May 24, 2023. https://www.rstreet.org/commentary/age-verification-legislation-discourages-data-minimization-even-when-legislators-dont-intend-that/.
[6] Adrian Moore and Eric Goldman, “California’s Online Age-Verification Law is Unconstitutional,” Reason, Nov. 28, 2023. https://reason.org/commentary/californias-online-age-verification-law-is-unconstitutional/.
[7] See Reno v. ACLU, 521 U.S. 844 (1997), U.S. Supreme Court, June 26, 1997. https://supreme.justia.com/cases/federal/us/521/844, and Ashcroft v. ACLU, 542 U.S. 656 (2004), U.S. Supreme Court, June 29, 2004. https://supreme.justia.com/cases/federal/us/542/656/.
[8] Brown et al. v. Entertainment Merchants Assn. et al., 564 U.S. 786 (2011). U.S. Supreme Court, June 27, 2011. https://supreme.justia.com/cases/federal/us/564/786.
[9] CCIA v. Paxton, case n. 1:25-CV-1660-RP (United States District Court Western District of Texas, Austin Division, filed December 23, 2025), https://storage.courtlistener.com/recap/gov.uscourts.txwd.1172869998/gov.uscourts.txwd.1172869998.65.0.pdf.
[10] See, “Helping Protect Kids Online,” Apple.com, Feb. 2025. https://developer.apple.com/support/downloads/Helping-Protect-Kids-Online-2025.pdf, “Leading Technology Companies and Foundations Back New Initiative to Provide Free, Open-Source Tools for a Safer Internet in the AI Era,” PR Newswire, Feb. 10, 2025. https://www.prnewswire.com/news-releases/leading-technology-companies-and-foundations-back-new-initiative-to-provide-free-open-source-tools-for-a-safer-internet-in-the-ai-era-302371243.html.
[11] For example, a quick step-by-step walkthrough for how to enable parental controls on any commonly-owned mobile device: “Parental Controls,” Internet Matters, https://www.internetmatters.org/parental-controls/.
[12] Ben Sperry, “The Law & Economics of Online Age Verification and Parental Consent: App Store Edition,” Truth on the Market, Sept. 26, 2024. https://truthonthemarket.com/2024/09/26/the-law-economics-of-online-age-verification-and-parental-consent-app-store-edition/.
[13] HB 0285, Tennessee General Assembly, 2025 Legislative Session. https://wapp.capitol.tn.gov/apps/BillInfo/default.aspx?BillNumber=HB0825&GA=114.
[14] “How to Use Parental Controls to Keep Your Kid Safer Online”, Federal Trade Commission, April 2025. https://consumer.ftc.gov/articles/how-use-parental-controls-keep-your-kid-safer-online.