What happens when app downloads start to feel like buying a bottle of wine? Google is about to find out. The company has begun rolling out a YouTube-style age verification system for the Play Store, a move driven less by corporate whim than by the tightening grip of U.S. state laws in Texas, Utah, and Louisiana. These states’ App Store Accountability Acts (ASAAs) require that app stores check users’ ages, obtain parental consent for minors, and provide age-related data to developers-all requirements due to be enforced between January and July 2026.
The new Play Store system will ask users to prove that they are over the age of 18 before they download certain apps. Verification is available through multiple channels, including uploading a government-issued ID, facial age estimation via a selfie, a credit card with a refundable temporary charge, or through third-party services, including Verifymy.io. Verifymy.io relies on an email-based method of age estimation, scanning a user’s past activity across sites and apps from that address. “If we are unable to estimate your age using your email address, you may be able to use alternative available methods such as ID scan or facial age estimation.” explains Verifymy.io.
For developers, it’s more than a user-facing prompt it’s a compliance overhaul: The ASAAs require them to receive and process “age category” data and parental consent status from app stores, assign legally defined age ratings (<13, 13-15, 16-17, 18+), and restrict access to features or purchases accordingly. They must also notify app stores of “significant changes” to terms, privacy policies, monetization, or content, triggering renewed parental consent for minors. In Texas, developers are compelled to delete personal data obtained for verification once it has served its compliance purpose, and any such transmission using industry-standard encryption.
In line with this, Google has announced the beta of the Play Age Signals API. This lets developers receive limited and privacy-preserving age signals without having to directly collect sensitive identifiers. The API also integrates with the Play Billing Library to automatically detect a user’s state and age category, allowing the app to dynamically adjust payment flows or access to content. According to an engineering breakdown provided by Sigosoft, the API itself doesn’t require any complex server-side integrations: apps just update to the latest billing library, test with U.S. state profiles, and conditionally display options based on the returned signals.
The privacy implications are significant. While government ID and facial scans raise concerns about biometric data storage and possible breaches, methods like Verifymy.io’s email-based estimation offer a less invasive alternative-they are reliant on a user’s digital footprint being rich enough to analyze, however. Facial age estimation algorithms, increasingly used in retail and online platforms, can return a mean absolute errors as low as 2–3 years under ideal conditions but often degrade with poor lighting, non-frontal angles, or underrepresented demographics in training datasets. This opens up a risk of false positives, where adults are incorrectly classified as minors-a backlash similar to that when YouTube implemented similar checks at the beginning of this year.
For users in those states, the changes won’t be avoidable. The laws require “commercially reasonable” verification methods, but leave the definition open, giving platforms latitude to choose approaches that balance compliance with user experience. Texas, for example, requires minors’ accounts to be tied to a parent or guardian account which has been verified, and parental consent is required for each download or purchase blanket approvals are not allowed. Utah adds a private right of action, allowing parents or minors to sue for violations, while Louisiana eliminates safe harbor protections for developers who rely exclusively on app store-provided data.
But from an engineering standpoint, the challenge is in integrating these legal requirements into systems that are scalable and low-friction. Google’s approach would suggest a strategy aimed at minimizing disruption to end-users – through modular verification options, API-driven developer support, and gradual regional rollout – but meeting the letter of the law. Yet the broader trend is clear: as more states consider similar bills, and as international regulators push for stronger child-protection measures, age verification is becoming a default layer in digital distribution.
For developers and privacy advocates alike, the new checks in the Play Store represent both a compliance necessity and a test case for whether age-gating can be achieved without compromising user trust. The technical tools are here; the question is whether their deployment will feel like a safety net or a locked gate.
