C.R.S. § 6-30-102: Requirements for operating system providers and developers.

(1) On and after July 1, 2028, an operating system provider that operates a covered application store or makes a covered application store available pre-installed on an operating system shall provide an accessible interface at account setup that requires an account holder to indicate the birth date, age, or age bracket of the user of that device for the purpose of providing an age signal to covered applications available in the operating system provider's covered application store. Operating system providers may minimize the use of personal data by allowing an account holder to select an age bracket for a user who is eighteen years old or older without providing a birth date or age.

(2) On and after July 1, 2028, an operating system provider or a covered application store shall:

(a) Provide developers with a reasonably consistent, real-time application programming interface to request and receive an age signal; and

(b) Send only the minimum amount of information necessary to comply with this article 30. An operating system provider or covered application store shall not share an age signal with a third party for a purpose not required by this article 30.

(3) (a) A covered application must use the application programming interface provided by the operating system provider or covered application store to:

(I) Request an age signal with respect to a particular user when the application is initially launched or when a user first creates an account on the covered application; and

(II) Request a user's age bracket data, as needed, to update the age information held by the application.

(b) (I) A covered application that receives an age signal is deemed to have knowledge of the age range of the user to whom the signal pertains across all platforms and points of access of the covered application.

(II) A developer shall not willfully disregard clear and convincing information that indicates that a user's age is different than the age-bracket data indicated by an age signal provided by an operating system provider or by a covered application store.

(III) If a developer has clear and convincing information that a user's age is different than the age indicated by an age signal received pursuant to this article 30, the developer shall use that information as the primary indicator of the user's age.

(IV) Except as provided in subsections (3)(b)(II) and (3)(b)(III) of this section, a developer shall treat an age signal received pursuant to this article 30 as the primary indicator of a user's age range.

(V) Nothing in this section requires a developer to acquire age-related data other than an age signal.

(c) A developer shall ensure that a covered application that receives an age signal pursuant to this article 30 uses the age signal only to comply with applicable law.

(d) A developer shall ensure that a covered application that receives an age signal pursuant to this article 30 does not:

(I) Request more information concerning the user from an operating system provider or a covered application store than the minimum amount of information necessary to comply with this article 30; or

(II) Communicate the age signal to a third party for a purpose not required by this article 30.

(e) Notwithstanding subsections (3)(a), (3)(b)(I), and (3)(b)(IV) of this section, a developer of a family account application may:

(I) Use the age of the primary account holder of a family account application as the age of a user for purposes of applying age-related safety defaults and access to features within the family account application; and

(II) Allow the primary account holder of a family account application to attest to the age of the users of subaccounts of the family account application.