The amended law preserves its core requirements: app stores must verify user age, obtain parental consent for minors, and notify stores of significant app changes. HB 498 delayed the effective date from May 6, 2026 to May 6, 2027, expanded coverage to pre-installed apps, and narrowed the definition of changes triggering re-consent. Critically, it replaced government enforcement with a private right of action limited to injured minors and their parents. The shift means the CCIA no longer has standing to challenge the law in federal court, since the agency defendant—the source of the constitutional injury—no longer exists.
Attorneys tracking state consumer protection litigation should note this legislative maneuver. Utah's approach—redesigning enforcement rather than weakening substantive requirements—offers a template for shielding regulations from industry constitutional challenges. Other states are already developing similar minor-protection laws. Tech companies betting on federal court victories may find those victories hollow if legislatures simply restructure enforcement mechanisms. The practical effect: stronger privacy and safety rules for minors, enforced through private litigation rather than government action.