Utah delays App Store Accountability Act obligations, removes deceptive‑practice rule

Utah’s app store law is still alive. But it is not the same law people were arguing about a few months ago. The state pushed the biggest compliance duties back to May 6, 2027, removed government enforcement through deceptive-trade-practice law, and kept the part that probably scares platforms most anyway — private lawsuits. That combination is why this story matters. Utah did not retreat. It changed the pressure point. (mondaq.com) ### What law are we talking about? The App Store Accountability Act is Utah’s attempt to make app stores do age checks and get verified parental consent before minors download apps, accept terms, or make in-app purchases. The basic idea is that the app store — not just the app developer — should sit at the fr(mondaq.com)onally had. (deseret.com) ### What changed this year? H.B. 498, signed on March 18, 2026, rewrote key parts of the 2025 law. The big operational provisions now take effect on May 6, 2027, not this year. The amendment also expanded the law’s reach in a few places — including preinstalled apps, some older accounts, and apps that later change to add ads or other monetization hooks. So yes, Utah delayed the hard part, but it also tried to close some obvious loopholes. (legiscan.com) ### Why does dropping AG enforcement matter? Because Utah removed one of the cleanest ways the state could have enforced the law. Earlier versions let violations be treated as deceptive trade practices, which would have brought the Utah Attorney General into the picture. The amended law cuts that path out. What remains is a private right of action — basically, harmed minors or their parents suing on the(legiscan.com)rom a state-policing model into a liability model. (mondaq.com) ### Why would companies still care then? Because private-right-of-action laws can be brutal. A regulator might move slowly or negotiate. Private plaintiffs do not have to. Utah lawmakers were pretty open about that logic. The point was not necessarily to send state prosecutors after Apple or Google. It was to(mondaq.com)t because the attorney general stepped back. (deseret.com) ### What happened to the lawsuit? The Computer & Communications Industry Association — whose members include Apple, Google, Amazon, and Meta — sued Utah in February. Then, on April 21, 2026, it agreed to dismiss that challenge after Utah confirmed the revised law does not authorize gove(deseret.com)makers rewired the statute. (jdsupra.com) ### What is the VPN angle? Utah also added language aimed at people who mask location or identity to get around age checks — including use of a VPN in some circumstances. The point is to stop easy evasions if a user tries to appear older or outside the law’s reach. That is notable because it shows Utah is thinking beyond the app store’s form and into the bypass routes. (jdsupra.com) how those cases get pleaded and tested. (mondaq.com) ### So what is Utah really doing here? Basically, Utah is stress-testing a new model for child-safety law online. Put the compliance burden on platform gatekeepers. Delay the launch date so the systems can actually be built. Remove the state-enforcement hook that invited one kind of constitutional fight. Keep the private lawsuit risk that may still force behavior change. Other states are watching, and companies are too. (deseret.com) ### Bottom line? Utah did not kill its app store law. It made it slower, narrower in one enforcement sense, and arguably sharper in another. The real deadline is now May 6, 2027 — and the real question is whether private-litigation pressure can do what direct state enforcement no longer will. (mondaq.com)