Start here: does any of this apply to you at all?
If your app is genuinely 18+-gated with real, tested age assurance already in place for users in all four states -- not just an app-store age rating, but an actual verification step -- your priority here is low. Re-check quarterly anyway: this area of law has moved fast, and a fifth state could join the list without much warning. If your app has, or could plausibly have, users under 18 in any of these four states, or you genuinely don't know, keep reading -- go state by state below, since the answer (and the urgency) is different for each one.
Texas: if you have any Texas users, this is not a future question
Age-assurance enforcement under Texas's SB 2420 resumed for new Apple Accounts on June 4, 2026, after a Fifth Circuit stay kept a lower-court injunction from blocking it. If your app has any Texas users -- new or existing -- this is a live requirement today, not a deadline to plan around. The action item is concrete: implement Apple's Declared Age Range API and/or Google's Play Age Signals API (our companion API guide covers both in implementation detail). If you can genuinely geofence Texas out, that's a lower-priority path for Texas specifically -- but confirm the geofencing is actually tested, not assumed from an app-store target-market setting you configured once and never verified.
Utah: not urgent today, but build before the deadline, not at it
If you have Utah users, the compliance date is May 6, 2027. That's real runway, but Utah's enforcement shape is worth understanding now rather than later: an amendment removed the Utah Attorney General's enforcement authority, so there's no regulator sweep to watch for. What remains is a private right of action -- an injured minor or their parent can sue directly, recovering the greater of actual damages or a statutory $1,000 per violation, plus litigation costs. "AG enforcement removed" doesn't mean toothless; it means the compliance work still needs to be real by the deadline, just without a government inspector as the trigger. Recommended target: integration built and tested at least 60 days before May 6, 2027, not started at it.
Louisiana: deadline July 1, 2027, with its own mechanics -- don't reuse Texas/Utah logic blindly
If you have Louisiana users, the deadline is July 1, 2027 (HB 977 reenacted the original law with a one-year delay). Two things make Louisiana's compliance path different from Texas's or Utah's, and worth checking specifically rather than assuming your other-state work covers it: you may rely on the age/consent signal the app store provides unless you have actual knowledge your own internal data says otherwise, and a family-account exception lets paid-subscription apps with an adult primary accountholder use that adult's age for safety defaults instead of separately verifying every subaccount. Enforcement runs through the Louisiana Attorney General only -- Louisiana is the one state of these four without a private right of action.
California: a different statute shape, and a date test tied to your app's own update history
If you have California users, check two things, not one: does AB 1043 apply to you at all (it's operative January 1, 2027, with a grace period to July 1, 2027 for devices/accounts set up before the operative date), and was your app last updated on or after January 1, 2026 -- that update date determines which grace-period bucket you land in for users whose devices received your app before the operative date. AB 1043 is also a structurally different law from the Texas/Utah/Louisiana family: it's a data-privacy-style statute requiring Apple and Google to build an age-signal-sharing mechanism, not a deceptive-trade-practices statute layered onto app-store operation. Don't assume your TX/UT/LA compliance work automatically satisfies it -- the developer-facing mechanic (request a signal, act on it) is similar, but the legal basis and California AG enforcement channel are not the same thing.
A working checklist, one row per state
Texas: confirm TX users (or real, tested geofencing) · integrate the Declared Age Range and/or Play Age Signals API · wire the Significant Change API for at least one real release trigger · test App Store Server Notification handling for consent withdrawal · update your privacy policy naming Texas specifically.
Utah: confirm UT users · same API integration as Texas (build once, applies to both) · update your privacy policy to name Utah and note private-right-of-action enforcement · target integration complete and tested 60+ days before May 6, 2027.
Louisiana: confirm LA users · confirm your platform-signal reliance logic matches how you actually use the API response · check whether the family-account exception applies to your account model · update your privacy policy to name Louisiana.
California: confirm CA users · confirm your app's last-update date against the January 1, 2026 threshold · implement the age-signal request obligation (may reuse your other API work, but verify -- don't assume 1:1 coverage) · update your privacy policy to name California and AB 1043 specifically.
Ongoing, all states: re-check the dates above every 60–90 days against a primary source (see our companion state-by-state guide for the method) · keep your privacy policy's "last updated" line and changelog current · never route any age signal to ads, marketing, analytics, or profiling -- Google enforces this specific restriction with app suspension.
What this checklist is not
This is a prioritization and documentation tool, not a certification. Completing every item above doesn't guarantee compliance for your specific app -- your user base, data flows, and corporate structure all affect the real answer, and no generic guide can know those for you. Use it to organize the work and build a paper trail; have counsel licensed in your operating states review the result before you rely on it.