You're tracking 15 different state laws, each with unique effective dates, scope definitions, and enforcement mechanisms. Your legal team needs weekly updates, while your product team needs to know which features to gate. Your compliance dashboard is a spreadsheet that's already outdated.
This template provides a structured way to monitor, assess, and communicate minors' privacy compliance obligations across jurisdictions. It's designed for compliance officers managing the 2026-2028 wave of state laws covering app marketplaces, social media platforms, and AI companion services.
Purpose of the Template
This compliance tracker helps you:
- Monitor effective dates and implementation deadlines across multiple state laws
- Identify applicable laws based on jurisdiction and service type
- Track common requirements like age verification, parental controls, and design restrictions across states
- Document your compliance posture for each jurisdiction
- Generate executive summaries for leadership and board reporting
The template focuses on three regulatory categories that emerged in 2026: app marketplace laws, social media platform requirements, and AI companion regulations.
Prerequisites
Before using this template, ensure you have:
- A clear determination of whether your organization operates an app marketplace, social media platform, AI companion service, or multiple service types
- Access to the full text of applicable state laws (the template references laws but doesn't replace legal review)
- A defined process for updating the tracker when new laws pass or existing laws are amended
- Assignment of a single owner responsible for maintaining the tracker and addressing compliance gaps
Establish a review cadence. Weekly updates work for organizations actively building compliance programs; monthly reviews suffice for those monitoring future obligations.
The Template
Create a spreadsheet or database with these columns:
Jurisdiction Tracking:
- State
- Law Name
- Service Type Covered (App Store Provider / Operating System Provider / Social Media Platform / AI Companion)
- Effective Date
- Implementation Deadline (if different from effective date)
- Current Legal Status (Enacted / Stayed / Under Appeal)
Applicability Assessment:
- Does This Law Apply to Our Service? (Yes / No / Under Review)
- Reason for Applicability Determination
- Date of Last Review
Requirement Categories:
- Age Verification/Attestation Required? (Yes / No / Conditional)
- Parental Consent Required? (Yes / No / Age Threshold)
- Parental Control Tools Required? (Yes / No / Specific Tools)
- Design Feature Restrictions? (List specific restrictions)
- Content Restrictions? (Yes / No / Specific Types)
- Disclosure Requirements? (Yes / No / Specific Language)
- Audit or Reporting Requirements? (Yes / No / Frequency)
Compliance Status:
- Current Status (Compliant / In Progress / Not Started / Not Applicable)
- Gap Description (if not compliant)
- Remediation Owner
- Target Completion Date
- Dependencies or Blockers
Notes:
- Key Differences from Other State Laws
- Cross-Jurisdictional Harmonization Opportunities
- Recent Legal Developments (e.g., "Fifth Circuit lifted stay on July 6, 2026")
For AI companion services specifically, add these rows:
- Human vs. AI Disclosure Required?
- Sexually Explicit Content Prevention Measures?
- Manipulative Engagement Technique Restrictions?
- Emotional Response/Dependence Prevention Required?
Customizing the Template
For App Marketplace Operators:
If you operate an app store, focus on the Texas, Utah, Louisiana, and Alabama model. These laws don't require you to collect age information at the operating system level but do impose parental consent requirements for app downloads. Emphasize the consent mechanism and any app rating or classification obligations.
If you provide an operating system, track California's approach and Colorado's Age Attestation on Computing Devices (effective July 1, 2028). Note that Colorado gives you until January 1, 2029, to request age information from users who completed account setup before the law's effective date. Flag this extended deadline separately.
For Social Media Platforms:
Your tracker will likely have the most entries. Note that Ohio's Parental Notification by Social Media Operators Act is now in effect after the Sixth Circuit lifted the stay in 2026. Track whether each state law requires parental consent for account creation, ongoing age estimation based on platform use, restrictions on targeted advertising to teens, or limitations on "addictive" features like infinite scroll.
Some states bar these features outright for teen users; others gate them behind user or parental consent. This distinction matters for your product roadmap.
For AI Companion Services:
If you operate an AI service designed for companionship, you're facing a new wave of state requirements enacted in 2026. Washington, Oregon, Idaho, Nebraska, Iowa, Georgia, Connecticut, Colorado, and Hawaii all passed laws this year. Track which states require disclosures that the service is "artificially generated and not human" and which states mandate prevention of sexually explicit content or suggestive dialogue.
For parental control tools, note the age threshold: Idaho, Nebraska, and Iowa require tools for parents of users under 13, with discretionary tools for older minors. Georgia, Connecticut, and Colorado require tools for all minors under 18.
For Multi-Service Organizations:
If you operate multiple service types, maintain separate tabs or views for each service. Some requirements overlap (age verification appears across all three categories), but the implementation differs significantly. Your app marketplace team shouldn't be tracking social media feed design requirements, and vice versa.
Validation Steps
Run these checks quarterly:
Legal Status Verification:
- Search for new court decisions affecting laws currently marked "Under Appeal" or "Stayed"
- Check state legislative websites for amendments to existing laws
- Update the "Current Legal Status" column and add notes with the decision date
Applicability Reassessment:
- If you've launched new features or entered new markets, review the "Does This Law Apply to Our Service?" determination
- Document any changes in your service model that affect applicability
- Update the "Date of Last Review" field
Gap Analysis:
- For any row marked "In Progress" for more than 90 days, escalate to the remediation owner
- For laws with effective dates within six months, confirm all rows show "Compliant" or have documented remediation plans
- Generate a summary report showing compliance percentage by jurisdiction
Cross-Reference Check:
- Compare your tracker against recent legal analyses or guidance from industry associations
- If you're using a Consent Management Platform or age verification vendor, confirm their solution addresses the specific requirements in your tracker
- Review any third-party audit reports (South Carolina's HB 3431, effective February 5, 2026, requires annual independent audits) against your documented controls
Set a calendar reminder for July 1, 2028 (Colorado's operating system provider requirements) and January 1, 2029 (Colorado's extended deadline for existing accounts). These are the furthest-out deadlines in the current legislative wave, but new laws will continue to pass.
When federal legislation moves forward, create a new section in your tracker. The Senate Commerce, Science, and Transportation Committee is holding hearings on minors' privacy bills, but significant differences remain between House and Senate approaches. If federal law passes, you'll need to assess preemption effects on your state-by-state compliance program.
This template won't eliminate the complexity of multi-jurisdiction compliance, but it will give you a structured way to track where you stand and what comes next.
