Guides · Last checked October 27, 2026

AB 1043 compliance checklist: what to document before January 1, 2027

Calling the API is one line. Showing that you complied is the rest. This checklist follows California Civil Code 1798.500-1798.505 section by section, with the record each item should leave behind.

1. Are you in scope?

• You're a "developer" if you own, maintain or control an application (1798.500(f)).
• An "application" runs on a computer, mobile device or other general purpose device that can access a covered app store (1798.500(c)).
• Stores that only distribute extensions, plug-ins or add-ons running inside a host app aren't "covered application stores" (1798.500(e)(2)).
• The title doesn't apply to broadband, telecommunications services, or the delivery or use of a physical product (1798.504(f)).

Record: a one-paragraph scope memo per app.

2. Request the signal at download and launch

1798.501(b)(1) requires a request "when the application is downloaded and launched." Record: which builds request the signal, at which launch point, and the minimum version that does it.

3. Use the four brackets

Under 13; 13 to under 16; 16 to under 18; 18 and over (1798.500(b)). Record: the age gates you request (for example 13, 16 and 18) and what each bracket changes in the app.

4. Treat the signal as actual knowledge, across platforms

A received signal means actual knowledge of the user's age range "across all platforms of the application and points of access" (1798.501(b)(2)(A)). Record: how a bracket received on one platform carries to the same account on web, desktop and other devices.

5. Decide when your own data overrides it

You may not willfully disregard "internal clear and convincing information" that a user's age differs, and if you have it, it becomes the primary indicator (1798.501(b)(2)(B), (b)(3)). Record: what information you treat as clear and convincing, and who decides.

6. Minimize and don't share

Request no more than the minimum, and don't share the signal with a third party for a purpose the title doesn't require (1798.501(b)(4)). Record: a data-minimization note, a list of SDKs reviewed, and a privacy-policy sentence describing how the signal is used.

7. Existing installs by July 1, 2027

If the app was last updated on or after January 1, 2026 and was downloaded before January 1, 2027, request a signal for that user before July 1, 2027 (1798.502(b)). Record: the release that adds the request for existing users and the date it shipped. More in AB 1043 existing installs: the July 1, 2027 deadline.

8. Handle the cases where no signal arrives

Declined, unavailable, verification required, older OS versions and web each need a decision and a default. Our developer guide lists what each platform returns.

9. Know the exposure

Civil penalties of up to $2,500 per affected child per negligent violation and $7,500 per intentional violation, recoverable only by the California Attorney General (1798.503(a)). There is no private right of action in the title.

10. Keep it current

Apple and Google are still changing these APIs; Expo warns of more frequent breaking changes in expo-age-range as a result. Record: a review date each quarter and the SDK versions you tested.

The protections in this title are in addition to other laws, including the California Age-Appropriate Design Code Act (1798.504(d)). This checklist isn't legal advice; have counsel review your file.

Written by AI agents for Age Signal Ready and checked against the sources below on October 27, 2026. General information, not legal advice. Spotted an error? Email hello@agesignalready.com.

Sources

• California Civil Code 1798.500-1798.505 (official text)
• Apple: Age assurance frameworks Q&A
• Android: Request age signals
• Expo: expo-age-range