Your age-signal integration probably compiles, passes review, and does nothing.
Every ad SDK's child-directed flag has to be set before that SDK initialises. Set it after and the call succeeds, logs nothing, and has no effect. This tells you what is actually in your build.
Check a published app
Check your own build
A store listing cannot tell you which SDKs are compiled in, or whether the age-signal library is there at all. For that, run the scanner against your build:
npx agesignals app-release.apkWe never ask you to upload your binary. It stays on your machine — nothing to transfer, nothing to retain, and nothing for your security team to review.
Obfuscated build? Want a PDF? Running it in CI?
npx agesignals app-release.apk \
--mapping build/outputs/mapping/release/mapping.txt \
--pdf report.pdfThe mapping file is optional. Without it we can still tell you an SDK is missing; with it that answer is definitive rather than very likely, because renamed classes get searched too.
npx agesignals@latest app-release.apk --fail-on critical --quiet
Exits non-zero when a finding at or above the threshold is present, so a pipeline breaks the build
the day someone drops the age-signal call. Use @latest in CI — a pinned copy carries
old SDK remediation calls, and the report will say so.
What this can and cannot prove
Reliable
- The age-signals library is not in this build — a definitive negative.
- Which advertising, analytics and attribution SDKs are compiled in.
- Which permissions the manifest declares.
Not determinable from a binary
- Whether
checkAgeSignals()is ever actually called. - Whether each SDK's flag is set before that SDK initialises.
- Whether anything observably changes for a minor.
Those three need the app running. The scanner says so on every report — it can prove non-compliance, and it will never certify compliance. Any tool claiming otherwise is selling you a certificate rather than an answer.
Which rules apply
| Jurisdiction | Status | What it turns on |
|---|---|---|
| Brazil — ECA Digital | In force 17 Mar 2026 |
Reaches companies outside Brazil whose apps are likely to be accessed by Brazilian minors.
Prohibits mere self-declaration — and Play's TIER_A responses are self-declared. |
| Texas — SB 2420 | In force 4 Jun 2026 |
Took effect after the Fifth Circuit stayed an injunction. Safe harbour for relying on app-store age data. |
| EU — DSA Art. 28 | In force since 2024 |
Prohibits targeting minors with personalised advertising — a ban, not a duty to act on a signal. Binds "online platforms", not ordinary apps. |
| UK — Online Safety Act | In force 25 Jul 2025 |
Ofcom's accepted methods do not include app-store age signals, so one may not discharge the duty. Binds user-to-user, search and pornography services. |
| Utah | 7 May 2027 | Developer obligations postponed. Safe harbour for relying on app-store age data. |
| Louisiana | 2027 — date unsettled | Reported as both 6 May and 1 July 2027. Notably gives developers no safe harbour. |
Dates verified 3 August 2026 and they have moved repeatedly — check primary sources before relying on any of them. This is not legal advice.