SB 167: Require certain application store-based parental controls

As Introduced

136th General Assembly Regular Session 2025-2026

S. B. No. 167

Senator Reynolds

To enact section 1349.07 of the Revised Code to 1
require certain application store-based parental 2
controls. 3

BE IT ENACTED BY THE GENERAL ASSEMBLY OF THE STATE OF OHIO:

Section 1. That section 1349.07 of the Revised Code be 4
enacted to read as follows: 5

Sec. 1349.07. (A) As used in this section: 6

(1) "Application store" means a publicly available web 7
site, software application, or online service that distributes a 8
third-party platform's software applications to a computer, 9
mobile device, or any other general purpose computing device. 10
(2)(a) "Broadband internet access service" means a mass- 11
market retail service by wire or radio that provides the 12
capability to transmit data to and receive data from all or 13
substantially all internet endpoints, including any capabilities 14
that are incidental to and enable the operation of the 15
communications service, but excluding dial-up internet access 16
service. 17
(b) "Broadband internet access service" includes any 18
service that the federal communications commission finds to be 19
providing a functional equivalent of the service described in 20

S. B. No. 167 As Introduced

division (A)(2)(a) of this section or that is used to evade the 21
protections set forth in this section. 22
(3) "Child" means an individual consumer known to be under 23
eighteen years of age. 24
(4)(a) "Covered application" means a software application, 25
web site, or other online service that is likely to be accessed 26
by children and that is intended to be run or directed by a user 27
on a computer, mobile device, or other general purpose computing 28
device. 29
(b) "Covered application" does not include any of the 30
following: 31
(i) A broadband internet access service; 32
(ii) A telecommunications service, as defined in 47 U.S.C. 33
153; 34
(iii) The delivery or use of a physical product 35
unconnected to the internet. 36
(5) "Covered entity" means a covered manufacturer or 37
developer of a covered application. 38
(6) "Covered manufacturer" means a manufacturer of a 39
device, an operating system for a device, or an application 40
store. 41
(7) "Developer" means any person, entity, or organization 42
that creates, owns, or controls an application and is 43
responsible for the design, development, maintenance, and 44
distribution of the application to users through an application 45
store. 46
(8)(a) "Device" means a device or portion of a device that 47

S. B. No. 167 As Introduced

is designed for and capable of communicating across a computer 48
network with other computers or devices for the purpose of 49
transmitting, receiving, or storing data, including a desktop 50
computer, laptop, cellular telephone, tablet, or other device 51
designed for and capable of communicating with or across a 52
computer network and that is used for such purpose. 53
(b) "Device" does not include any of the following: 54
(i) Cable, fiber, or wireless modems; 55
(ii) Home routers, whether standalone or combined with 56
cable, fiber, or a wireless modem; 57
(iii) Managed set-top boxes; 58
(iv) Any physical object that only supports communications 59
within a closed user group or private network available to a 60
limited set of users. 61
(9) "Likely to be accessed by children" means, in the 62
context of an application, that either or both of the following 63
apply: 64
(a) Competent and reliable evidence regarding audience 65
composition demonstrates that the application is routinely 66
accessed by children; 67
(b) Internal research findings determine that the 68
application is routinely accessed by children. 69
(10) "Parent" includes a legal guardian. 70
(11) "User" means an individual consumer. 71
(B) Beginning January 1, 2026, no developer shall 72
distribute an application to users in this state or design, 73
develop, or maintain an application distributed to users in this 74

S. B. No. 167 As Introduced

state without first determining whether the application is 75
likely to be accessed by children and, if so, providing notice 76
of that determination to each application store that distributes 77
the application to users in this state. 78
(C)(1) The covered manufacturer of a device sold in this 79
state on or after January 1, 2026, shall, upon the initial 80
activation of the device, take commercially reasonable and 81
technically feasible steps to determine or estimate the age of 82
the primary user of the device. 83
(2) The covered manufacturer of an operating system for a 84
device sold in this state before January 1, 2026, shall take 85
commercially reasonable and technically feasible steps to 86
determine or estimate the age of the primary user of the device 87
following the first update to the operating system that occurs 88
after January 1, 2027. 89
(D) On and after January 1, 2026, the covered manufacturer 90
of an application store with users in this state shall take 91
commercially reasonable and technically feasible steps to do all 92
of the following: 93
(1) Provide a mechanism for developers to provide notice 94
that an application is likely to be accessed by children; 95
(2) Obtain parental consent before permitting a user in 96
this state who the covered manufacturer knows or should know is 97
under sixteen years of age to download a covered application 98
from the application store; 99
(3) Provide developers of covered applications in the 100
application store with a signal regarding whether a parent has 101
provided consent when required under division (D)(2) of this 102
section; 103

S. B. No. 167 As Introduced

(4) Provide a parent who consents to a child downloading 104
an application under division (D)(2) of this section with the 105
option to connect with the developer of the application for the 106
purpose of facilitating parental supervision tools. 107
108
109
110

(E) On and after January 1, 2026, a covered manufacturer shall take commercially reasonable and technically feasible steps to provide developers of covered applications with a digital signal via a real-time application programming interface regarding whether the covered manufacturer knows or estimates a user to be:

111
112
113
(1) Under thirteen years of age; 114
(2) At least thirteen years of age, and under sixteen 115
years of age; 116
(3) At least sixteen years of age, and under eighteen 117
years of age; 118
(4) At least eighteen years of age. 119
(F) On and after January 1, 2026, a developer of a covered 120
application shall, to the extent applicable and technically 121
feasible, provide readily available features for parents to 122
support a child's use of the covered application. Such features 123
shall, at minimum, do all of the following: 124
(1) Manage which accounts are affirmatively linked to the 125
child; 126
(2) Manage the delivery of age appropriate content; 127
(3) Limit the amount of time that the child spends daily 128
on the covered application. 129
(G)(1) This section shall not be construed to require a 130

S. B. No. 167 As Introduced

covered entity to access, collect, retain, re-identify, or link 131
information that the covered entity would not otherwise access, 132
collect, retain, re-identify, or link in the ordinary course of 133
business, except as absolutely necessary to comply with 134
divisions (C), (D), and (E) of this section. 135
(2) A covered entity is not required to implement new 136
account controls or safety settings if the covered entity's 137
existing account controls and safety settings are sufficient to 138
comply with this section. 139
(H)(1) Nothing in this section shall be construed to 140
modify, impair, or supersede the operation of any antitrust law, 141
including Chapter 1331. of the Revised Code and 15 U.S.C. 1, et 142
seq. 143
(2) An application store shall comply with this section in 144
a nondiscriminatory manner, including by: 145
(a) Imposing at least the same restrictions and 146
obligations on the application store's own applications and 147
application distribution as the application store does on third- 148
party applications or application distributors; 149
(b) Not using data collected from third parties, or 150
consent mechanisms deployed for third parties, in the course of 151
compliance with this section, for any of the following: 152
(i) To compete against those third parties; 153
(ii) To give the application store's services preference 154
relative to those of third parties; 155
(iii) To act in a manner adverse to competition. 156
(I)(1) The attorney general may bring a civil action 157
against a covered entity that the attorney general believes to 158

S. B. No. 167 As Introduced

have violated this section. Before initiating such an 159
enforcement action, the attorney general shall provide written 160
notice to the covered entity identifying and explaining the 161
basis for each alleged violation. 162
(2) Except as otherwise provided in division (I)(4) of 163
this section, the attorney general shall not commence an 164
enforcement action if the covered entity, within forty-five days 165
after notice of the alleged violations is sent, does both of the 166
following: 167
(a) Cures all violations described in the notice; 168
(b) Provides the attorney general with a written statement 169
indicating that the violations are cured and agreeing to refrain 170
from further violations of this section. 171
(3) If the covered entity does not timely respond or 172
continues to violate this section after receiving the notice, 173
the attorney general may initiate the enforcement action and 174
seek damages of up to two thousand five hundred dollars for each 175
violation. Except as otherwise provided in division (I)(4) of 176
this section, damages begin to accrue on the forty-sixth day 177
following the date the attorney general sends notice of the 178
violation. 179
(4) Division (I)(2) of this section does not apply if the 180
covered entity fails to timely cure all of the violations 181
described in the notice or commits a subsequent violation of the 182
same type after curing the initial violation under that 183
division. Notwithstanding division (I)(3) of this section, if a 184
covered entity commits a subsequent violation of the same type 185
after reporting that the initial violation is cured, the 186
attorney general may bring a civil action at any time after 187

S. B. No. 167 As Introduced

sending notice of the violation under division (I)(1) of this 188
section. Damages for the subsequent violation begin to accrue on 189
the date the violation occurs. 190
(5) It is an affirmative defense to a violation of 191
division (F) of this section if the covered entity acted in 192
reasonable reliance on a covered manufacturer's signals 193
regarding a user's age or parental consent. 194
(6) It is an affirmative defense to a violation of this 195
section if the covered entity took commercially reasonable and 196
technically feasible steps to comply. 197
(7) Nothing in this section shall be construed to provide 198
a private right of action. The attorney general has the 199
exclusive authority to enforce this section. 200