The Supreme Court Let Texas's App Store Law Run. The Developer Half Is Yours.

The Supreme Court’s answer to the tech industry’s emergency request was one line. On July 6 the Court denied the Computer & Communications Industry Association’s application to vacate a stay in its fight with Texas, after Justice Alito referred it to the full Court [1]. It denied a parallel application from a student group, Students Engaged in Advancing Texas, the same day [2]. Neither docket notes a dissent [1, 2].

So the reasoning that matters now is the Fifth Circuit’s, in a stay order from June. And while the age checks land on app stores, a whole subchapter of the law is addressed to the people who make apps.

How Texas’s app store law got here

Texas Senate Bill 2420, the App Store Accountability Act, was signed on May 27, 2025, and took effect January 1, 2026 [4]. CCIA says U.S. District Judge Robert Pitman blocked it on December 23, 2025, finding it likely violated the First Amendment [5].

On June 4, 2026, a Fifth Circuit panel of Judges Smith, Haynes and Oldham stayed those injunctions pending appeal [3]. Judge Haynes concurred only in the sentence granting the stay [3]. CCIA and the student plaintiffs went to the Supreme Court on June 10 [1, 2]. Texas answered CCIA on June 22, and the Court denied both applications on July 6 [1, 2]. The order says nothing about the merits [1]. CCIA’s Matt Schruers said the group looks forward “to an expedited hearing before the Fifth Circuit Court of Appeals in early August” [5].

What the Fifth Circuit said

The stay order is not a final ruling, but it reads like a preview of one. Five points:

Commercial speech. The panel said the district court likely erred by applying strict scrutiny [3]. App listings “propose commercial transactions, regardless of whether any monetary payment is made,” and for free apps the payment “is access to user data and private information” [3]. That puts the law under the intermediate test from Central Hudson, where Texas needs only a “reasonable fit” [3]. A footnote goes further and suggests SB 2420 “may not regulate speech at all” [3].

Fit. Age verification, parental consent and content ratings likely advance Texas’s interest in “protecting children’s data, safety, and privacy in a digital world,” the panel said, citing last year’s Free Speech Coalition v. Paxton [3]. Biometric Update also tied this result to that 2025 age-verification case [6].

Exceptions. The carve-outs for emergency-services apps and standardized-test nonprofits apply only to parental consent and are likely content-neutral; the testing one could be severed anyway [3].

Vagueness. Here’s where developers come in. The district court had found the law gave no meaningful guidance on age ratings and on terms like “new opportunities to make a purchase” and “material[] changes” [3]. The panel disagreed, pointing to the developer safe harbor for “widely adopted industry standards” and saying courts routinely interpret “material change” [3].

Scope. The panel called the universal injunctions likely improper after Trump v. CASA and said any relief should cover only the student plaintiffs and identified CCIA members [3]. It also called the burden on app stores and developers “minimal” [3].

What developers have to do under SB 2420

App stores carry the verification load. When a Texas user creates an account, the store must use “a commercially reasonable method of verification” to sort the person into one of four buckets: child (under 13), younger teenager (13 to 15), older teenager (16 to 17) or adult [4]. Minors’ accounts must be tied to a verified parent, and the parent has to consent to each download, purchase and in-app purchase; blanket consent is a violation [4]. The store then has to give developers each user’s age category and consent status [4].

Subchapter C covers any developer that makes an app available to Texas users through an app store [4]. Its duties:

• Rate everything. Assign an age rating, using the four categories, to every app and every in-app purchase, and give each store the specific content behind the rating [4].
• Give notice before significant changes. Tell every store that carries your app before you make a significant change to your terms of service or privacy policy [4]. A change counts if it alters what data you collect or share, affects the rating, adds new monetization features such as purchase or ad opportunities, or “materially changes the functionality or user experience” [4].
• Check the store’s data. Build a system that uses the store’s data to verify each user’s age category and, for minors, whether a parent consented [4].
• Use it narrowly, then delete it. Store-provided data can be used only to enforce age restrictions, comply with the law and set up safety features and defaults, and it has to be deleted after verification [4].

Violations include enforcing a contract against a minor who agreed to it without consent, knowingly misrepresenting a rating, and sharing the store-provided data [4]. Each counts as a deceptive trade practice under Texas’s DTPA [4]. There are two safe harbors: one for ratings set consistently and in good faith with widely adopted industry standards, and one for good-faith reliance on the store’s age and consent data [4].

What it means if you ship an app in Texas

My opinions, labeled as such.

The change-notice provision is the one that will show up in sprint planning. A parent’s consent covers the app as it was when they approved it. When a developer reports a significant change, the store must notify the parent and get fresh consent for continued use [4]. Put that next to the trigger list. A new subscription tier is a new way to pay. A redesign could “materially” change the user experience. If you ship weekly, every release is now a question your product lead and your lawyer have to answer together, and the wrong answer in one direction means stranded teen users waiting on a parent’s tap.

The Fifth Circuit read “material change” as one that could influence whether a parent lets a minor keep using the app [3]. That’s a sensible test, and I’d use it as your internal rule. It’s also a panel’s reading in a stay order, not a holding, and not the statute’s text.

Per-purchase ratings are the second cost. A game with a few hundred in-app items needs a rating for each [4]. The safe harbor assumes a “widely adopted industry standard” exists, and the law doesn’t say which one [4]. Large studios already map to existing rating systems. A three-person team selling digital goods has to pick one and apply it “consistently” [4].

The deletion rule pulls the other way from what your analytics stack wants. Age category data from the store is for gating and safety settings, and it goes away after verification [4]. Pipe it into a segment, an ad audience or a data warehouse table and you’ve arguably shared or misused it [4]. I’d audit where that field lands before anything else.

On legibility, I’m split. The statute is more specific than most kids’ safety laws I’ve read: four named age bands, a defined trigger list, safe harbors [4]. But compliance cost doesn’t scale with company size. The obligations are the same whether you have one app or a hundred, and small teams can’t pay someone to argue about “materially.”

What I’m watching

• The Fifth Circuit hearing. CCIA expects it in early August [5]. The stay panel’s commercial-speech framing is the issue to watch; a merits panel that applies strict scrutiny instead would change everything above.
• Who is actually covered by any relief. The stay order says that even a win for the plaintiffs should produce a narrow injunction, not a universal one [3]. If that holds, a developer outside those groups stays bound regardless of how the appeal ends.
• The rating standard. Nothing in the record says which “widely adopted industry standards” qualify [3, 4]. I’d like to see the first DTPA action before guessing.