Understanding Texas’ Youth Privacy Framework: TASAA, SCOPE & the Texas Data Privacy and Security Act

Update: July 9, 2026

Texas has established one of the nation’s most comprehensive frameworks governing how digital services interact with children and teens. Together, the Texas App Store Accountability Act (TASAA), the SCOPE Act (HB 18), and the Texas Data Privacy and Security Act (TDPSA) create layered responsibilities for app stores, app developers, and organizations that collect or process children’s personal information.

The legal landscape continues to evolve. TASAA is currently enforceable while ongoing constitutional challenges proceed through the courts, and portions of the SCOPE Act remain subject to litigation. Organizations should be prepared to comply with the requirements currently in effect while continuing to monitor future legal developments.

Below, we explain how these three laws work together, what responsibilities belong to app stores versus developers, and why app store parental consent does not replace the in-app consent obligations required under laws such as COPPA and GDPR.

1) Texas App Store Accountability Act (TASAA): Consent at the Point of Access (App Stores), Compliance in-App (Developers)

The Texas App Store Accountability Act (TASAA) establishes a shared compliance framework between app stores and app developers designed to help protect minors online. Although the law continues to face constitutional challenges, Texas is currently permitted to enforce TASAA while the litigation proceeds.

The law divides responsibility between app stores, which manage age verification and download-level parental consent, and developers, which remain responsible for implementing age-appropriate experiences and complying with applicable privacy laws within their apps.

What Developers Need to Know

Developers must:

• Assign age ratings for the app and each in-app purchase.
• Provide the reasons supporting those age ratings.
• Notify app stores before making significant changes to privacy policies, terms of service, monetization, or functionality.
• Consume the app store’s age category and consent signals.
• Apply appropriate age-based experiences and continue meeting applicable privacy obligations.

App stores must:

• Verify users into age categories.
• Obtain parental consent before a minor downloads an app, purchases an app, or makes an in-app purchase.
• Present parents with required disclosures about the app.
• Pass age category and consent information to developers.

Key Takeaway: The app store’s parental consent covers the download or purchase event. It does not replace any parental consent developers may still need to obtain under COPPA, GDPR, or other applicable laws for account creation, personal information collection, messaging, profiling, or other ongoing in-app activities.

2) Securing Children Online through Parental Empowerment (SCOPE) Act: Big Ambitions, Partial Injunction

The SCOPE Act (HB 18) targets minors’ social experiences (age registration, content filtering, ads limits, parental tools and consent). A federal court has blocked key provisions (e.g., content filtering and broad age-verification mandates). The case is on appeal, so requirements may change.

Low-regret prep while litigation continues:

• Continue age capture/registration in account flows (and log immutable age status/changes).

• Keep parental-consent workflows ready for higher-risk features (posting, messaging, data sharing).

• Maintain a feature flag/toggle approach so stricter controls can be re-enabled quickly if the injunction narrows.

3) Texas Data Privacy and Security Act (TDPSA): General Texas Privacy Duties (Live Now)

The Texas Data Privacy and Security Act applies to most companies doing business in Texas (with SBA “small business” carve-outs). It grants Texans rights to access, correct, delete, portability, and to opt out of sales, targeted ads, and certain profiling. It requires privacy notices, data minimization, security, and Data Protection Assessments (DPAs) for targeted ads, sales, profiling with risk, and sensitive data (which includes children’s data).

Enforcement: Texas AG only, with a 30-day cure period.

Note: If you comply with COPPA’s verifiable parental consent online, TDPSA treats that as satisfying parental-consent requirements for children’s data.

What This Means in Practice

Developer & Product Checklist 

Account & Age Handling

• Capture date of birth/age at account creation; prevent casual age downgrades/upgrades; log changes.
  
  
• When the store indicates a user is a minor, respect that signal everywhere in-app.

Parental Consent & Controls

• Integrate in-app parental-consent workflows for data collection, accounts, messaging, and social features (COPPA/GDPR alignment).
  
  
• Honor parental revocation and reflect status across data flows and features.
  
  
• Maintain audit-ready logs (timestamp, method, parent identity verification evidence).

Data Practices (TDPSA)

• Publish/update a Texas-compliant privacy notice (categories, purposes, sensitive data, opt-out methods).
  
  
• Implement opt-outs for sale, targeted ads, and profiling with significant effects.
  
  
• Run DPAs for targeted ads, sales, profiling presenting risks, and sensitive data (incl. children).
  
  
• Minimize collection; secure data; document retention/deletion and DSAR handling (45 days + one 45-day extension; appeals).

App Store Interfaces (TASAA Prep)

• Provide age ratings for the app and each in-app purchase, plus the content/elements that drove those ratings.
  
  
• Implement a “significant change” notification pipeline to app stores (privacy policy, monetization, functionality changes).
  
  
• Consume and enforce the store’s age/consent signal (e.g., gate features, require in-app VPC where needed).

Operational Resilience

• Design compliance as config flags so you can adapt quickly to SCOPE court changes or new state rules.
  
  
• Avoid over-collection: verify just enough, keep signals, encrypt at rest/in transit, and delete verification data when no longer needed.

How PRIVO Bridges the Gaps

• Smart Age Gate™, Age Aware™ Signal , Age Verification – Privacy-preserving age-assurance that aligns with TASAA’s “commercially reasonable” standard and interoperates with app-store signals.

• PRIVO iD Platform – End-to-end parental consent (download-level and in-app), revocations, and audit logs that satisfy COPPA/GDPR and support SCOPE Act and TDPSA documentation.

• Kids Privacy Assured Program – Ongoing alignment with privacy regulations protecting children.

Closing Thought

Texas is connecting the dots between platform-level access control (TASAA), social engagement safeguards (SCOPE), and baseline privacy rights (TDPSA). The smartest path is an interoperable compliance stack that separates download consent (app store) from in-app consent and data duties (developer) — all backed by strong privacy engineering and clear parental engagement.

PRIVO helps you do exactly that — in Texas and beyond.

🔗 Contact us to learn how PRIVO’s Age Aware™ Solutions can help your organization comply with the Texas laws and other emerging regulations requiring age verification and consent.

Status Disclaimer: This post is for general information and reflects our understanding as of July 2026. SCOPE and TASAA litigations are ongoing and may change obligations; consult counsel for specific advice.

#AgeVerification #TASAA #AgeAssurance #ChildPrivacy #ParentalConsent #PRIVO