(0) check if iOS is 26+. Otherwise, proceed without any test (because we cannot do them)
Yep, agree. In fact, we specifically need to check for iOS 26.2.
in (1), which import to use AppStore.ageRatingCode ?
You just need to import storekit to access that. However, as noted below, I'm considering a different option.
in (2), if UIKit and not SwiftUI, need the in parameter
Indeed you do. Annoyingly, you also need the in parameter if you're putting your code in some class (e.g. some kind of age manager class), and it's not clear to me what you need to pass in (assuming you have a SwiftUI app).
where should parental control be tested ? In step (5) ?
I honestly don't know at this point – I haven't gotten to that point yet, but as noted below, I'm looking for ways to avoid that side of things.
where to deal with change in user's age or repudiation (as required by law if I read properly)
My assumption is that if you check the age on every launch, then this should take care of itself. But I could be wrong.
what happens if the requests in await do not respond ? Is there some type of timeout, to avoid user being locked in waiting ?
I'm not sure – I'm assuming they should return quite quickly and may not even require network connectivity if the information is cashed on device (the WWDC video talks about device caching of the age info).
In my testing, I've found that the API calls return very quickly (< 1 second), but that may simply be because it's in a test environment.
In any case, my intention is to default to giving the user full access to the app, and I'll only override that if the methods (called in an async task) suggest the user is not allowed access. However, I do not know if this is appropriate and I am open to other suggestions.
Relatedly, what should we do if the methods throw an error? Should we assume the user is a child and restrict access? My current plan is to treat the two API calls differently:
If isEligibleForAgeFeatures throws, I will assume that the user is not eligible and therefore has full access.
If requestAgeRange throws, I will assume the user is a child and restrict access.
My logic is that if I cannot determine eligibility, then I should err on the side of the user not being eligible, since the vast majority of users (for the foreseeable future and around the world) will not be eligible. However, if the user is eligible for age features, then we should err on the side of caution, and assume child until proven otherwise.
Having thought about all this for another day, my new plan is to drop the App Store age rating check (for now), and use age 18 for the age gate parameter.
My primary reason for this is because I don't have much time to properly investigate the PermissionKit stuff and the significant changes stuff before the end of the year (and this stuff seems rather more complicated). So, my first priority is to make sure that the app is blocked for all under-18s (who are subject to the law) until I have a clearer understanding of those issues.
However, I would be very keen to hear how other people are handling that stuff.