Apple mandates global ID for age verification
Apple will now require age verification via official ID across the UK, EU, Australia, and the US to comply with child-safety regulations. The mandate presents new privacy and scalability challenges for iOS developers, particularly those whose applications handle user authentication and data.
- The mandate is a direct response to comprehensive regulations like the EU's Digital Services Act (DSA) and the UK's Online Safety Act, which impose steep penalties for non-compliance, including fines up to 10% of global annual turnover. - For developers, Apple is rolling out a new `Declared Age Range API` to signal a user's age category (e.g., under 13, 13-17, 18+) without exposing their exact birth date, aiming to balance compliance with user privacy. - The rollout is phased, with enforcement beginning on February 24, 2026, in Australia, Brazil, and Singapore, where downloads of 18+ rated apps are now blocked without adult confirmation. Enforcement in the US will start with new accounts in Utah on May 6, 2026, and Louisiana on July 1, 2026. - The system introduces new developer responsibilities via APIs, such as the `Significant Update Action`, which requires obtaining parental consent for major app changes for users identified as minors in certain jurisdictions. - In specific markets like Brazil, the new rules have direct architectural implications; for instance, any app containing loot boxes is now automatically assigned an 18+ rating on the App Store. - This OS-level approach is a significant shift, positioning the device itself as the gatekeeper of age information, a move long requested by other major developers like Meta and Spotify to streamline compliance with a growing patchwork of state and national laws. - The EU is concurrently piloting a "white-label" age verification app and encouraging the use of anonymized "age tokens" from verified sources, with the goal of a standardized, privacy-preserving EU Digital Identity Wallet by the end of 2026. - This initiative is part of a broader industry trend responding to over 144 related bills introduced across 43 US states in 2023 alone, moving beyond the scope of the original Children's Online Privacy Protection Act (COPPA) to cover all minors under 18.
