An age verification bill is a state or federal law that requires a website or online platform to confirm a user’s age before letting them in, either to keep minors away from sexually explicit content or to gate access to social media. At least 25 states have enacted some version of these requirements, and in June 2025 the U.S. Supreme Court upheld Texas’s law for sexually explicit websites in Free Speech Coalition, Inc. v. Paxton, giving the state approach real legal footing.1Supreme Court of the United States. Free Speech Coalition Inc v Paxton The picture is still uneven, though. Federal courts have permanently blocked similar laws in other states on First Amendment grounds, and federal bills that could create a single national framework remain stuck in Congress.
What These Laws Cover
State age verification laws fall into two groups. The first targets websites that host sexually explicit material. The most common trigger is a “one-third rule”: if more than one-third of a site’s content qualifies as sexual material harmful to minors, the site has to verify that every visitor is at least 18.2Texas State Legislature. Texas Code HB 1181 – Publication of Material Harmful to Minors At least 18 states use this threshold, including Texas, Florida, Louisiana, Virginia, and Arizona. “Harmful to minors” in these statutes tracks the older obscenity framework: material appealing to a prurient interest, depicting sexual conduct in a way patently offensive to minors, and lacking serious literary, artistic, political, or scientific value for minors.
The second group targets social media. These laws focus on platforms built around user-generated content, public profiles, and algorithmic feeds. Some apply only to large companies. Arkansas’s Social Media Safety Act, for example, covers only platforms with more than $100 million in annual revenue. Social media statutes often build tiered obligations by age: one set of rules for children under 13, aligning with the existing federal COPPA framework; another for teens under 16; and a third for all minors under 18. Requirements range from parental consent for younger users to default privacy protections and limits on algorithmic recommendations for minors.
How Age Gets Verified
None of these laws let a platform rely on a self-attested checkbox. The methods vary, but most statutes accept some mix of the following.
- Government-issued identification. A user uploads a driver’s license, passport, or state ID, and either the platform or a third-party service reads the birthdate.
- Third-party verification services. The platform hands the user off to an independent verifier, which confirms age and returns only a pass or fail.
- Digital identity credentials. Some statutes specifically authorize digital IDs or verifiable credentials, which can confirm age without disclosing name or address.
- Facial age estimation. Software approximates age from a live image. Several states allow this, but accuracy is a real weakness: human age estimation averages six to eight years of error, and algorithmic systems struggle most with teenagers, the exact group these laws are trying to identify.
- Commercially reasonable methods. A catch-all found in many statutes, covering approaches like cross-referencing credit, mortgage, or employment records.
Social media laws add a second layer where parental consent is required. The platform must verify not just the minor’s age but that the person consenting is actually the parent or guardian. The FTC’s approved parental-verification methods under COPPA include signed consent forms, credit card transactions, video conferences, and government ID checks.3FTC. COPPA Age Verification Policy Statement
What Covered Platforms Must Do Beyond the ID Check
Verification is only part of the compliance load. Platforms also carry a cluster of operational obligations.
- Delete verification data promptly. Most laws require platforms to destroy identifying information as soon as the verification is complete. The FTC takes the same position on COPPA-related verification: keep data only as long as needed, then delete it.3FTC. COPPA Age Verification Policy Statement
- Maintain reasonable security for whatever verification data they handle, however briefly. When a third-party verifier is used, the platform still has to take reasonable steps to confirm that vendor will keep the data confidential and delete it.3FTC. COPPA Age Verification Policy Statement
- Restrict advertising aimed at minors. Several states prohibit collecting minors’ data for personalized ads. Maryland’s Kids Code bans the collection of children’s data for personalized content and requires high default privacy settings for users under 16. Mississippi and Florida impose similar limits on targeted advertising for users under 18.
- Publish clear notices explaining what verification data is collected, how it’s used, and when it’s destroyed.
- Offer alternatives to standard ID. Most teenagers between 15 and 19 lack a driver’s license, and roughly 11 percent of adults don’t have a current government-issued photo ID, so some statutes require a second verification path for users who cannot submit standard identification.
The tension in these obligations is real. Laws demand rigorous verification while also demanding minimal data collection and fast destruction. Doing both well is expensive, which is one reason many statutes apply only to platforms above a revenue threshold.
Penalties and Who Can Sue
Penalties are civil, not criminal, but they compound. Texas’s law authorizes fines of up to $10,000 for each day a website operates without proper age verification.1Supreme Court of the United States. Free Speech Coalition Inc v Paxton Arizona’s law imposes the same $10,000-per-day penalty and adds a separate $10,000 penalty for each instance a platform retains identifying information it was supposed to delete.4Arizona Legislature. Arizona Code 18-701 – Internet Pornography Age Verification
The steepest penalties are reserved for cases where a minor actually accesses harmful material because the platform failed to verify. Both Texas and Arizona authorize an additional penalty of up to $250,000 in that situation.4Arizona Legislature. Arizona Code 18-701 – Internet Pornography Age Verification Enforcement generally falls to the state attorney general.
Several states also give parents or guardians the right to sue non-compliant platforms directly. Texas, Louisiana, Virginia, Utah, Arkansas, Mississippi, and Montana all allow private civil lawsuits against websites that fail to verify age. Arizona’s statute is framed around this private enforcement mechanism, with parents as the plaintiffs.4Arizona Legislature. Arizona Code 18-701 – Internet Pornography Age Verification
What the Courts Have Said
The most consequential ruling came in June 2025, when the Supreme Court decided Free Speech Coalition, Inc. v. Paxton and upheld Texas HB 1181. The adult entertainment industry had argued the law violated the First Amendment by forcing adults to identify themselves to access legal content. The Court disagreed, holding that age verification for sexually explicit content triggers intermediate scrutiny rather than strict scrutiny. Under that standard, Texas only had to show the law advances an important interest without burdening substantially more speech than necessary, and the Court found protecting minors from sexually explicit material easily qualified.1Supreme Court of the United States. Free Speech Coalition Inc v Paxton
That ruling covers only laws targeting sexually explicit content aimed at minors. It does not resolve the constitutionality of social media age verification, which sweeps in far more protected speech. In Moody v. NetChoice (2024), the Supreme Court recognized that platforms’ editorial choices about what content to display receive First Amendment protection, a framework that matters here because social media laws regulate how platforms operate for every user, not just access to a narrow content category.5Supreme Court of the United States. Moody v NetChoice LLC
Federal courts have permanently blocked social media age verification laws in at least three states. Arkansas’s Social Media Safety Act was struck down in March 2025. Ohio’s Social Media Parental Notification Act fell the following month. Louisiana’s law was permanently enjoined in December 2025. Florida’s and Mississippi’s laws, by contrast, were allowed to take effect while appeals continue. The result is a patchwork where enforcement depends heavily on which federal circuit a state sits in.
The Privacy Problem
Even supporters acknowledge that verification creates real data risks. To prove your age you hand over sensitive information: a government ID, a facial scan, or enough financial data to cross-reference your identity. That information has to be processed somewhere, and wherever it lives becomes a target. A centralized store of IDs linked to visits to adult content is an obvious identity theft and blackmail risk, and critics argue no security regime can eliminate it entirely.
Courts weighing First Amendment challenges have picked up on the same concern. Requiring users to identify themselves before accessing legal content chills speech even when the verification is quick and the data is supposedly deleted, because the mere linkage of identity to content consumption changes behavior.
Federal Bills Still Pending
Congress could reshape this area with a national law, but hasn’t yet. Two bills are the main vehicles.
The Kids Online Safety Act (KOSA), reintroduced as S.1748 in the 119th Congress, would require covered platforms used or likely to be used by children under 17, including social media, video games, messaging apps, and video streaming, to exercise “reasonable care” in designing features that increase minors’ online activity. It would prohibit market research on children under 13, require parental consent for research involving teens under 17, give parents access to their children’s privacy settings, and let users opt out of personalized algorithmic recommendations. Enforcement would run through the FTC and state attorneys general.6Congress.gov. S 1748 Kids Online Safety Act 119th Congress As of mid-2026, KOSA has been introduced but not enacted.
The Children and Teens’ Online Privacy Protection Act, known as COPPA 2.0, has moved further. It passed the Senate unanimously but still needs House passage and a presidential signature.7United States Senate. Senator Markey Celebrates Unanimous Senate Passage of COPPA 2.0 If enacted, it would extend COPPA-style privacy protections to teenagers, not just children under 13.
Preemption is the open question. Whether a federal law would override conflicting state requirements or run alongside them will decide whether the current patchwork consolidates or persists. The White House has recommended that Congress not preempt state enforcement of generally applicable child protection laws, which suggests state-level variation would survive federal action.
Where Things Stand
Nine states saw age verification laws for adult content take effect in 2025, including Florida, Tennessee, Georgia, Arizona, and Ohio. Laws in at least three states have been permanently blocked. Social media requirements have fared worse in court than adult-content requirements, and the Supreme Court’s Paxton decision settled the standard for pornography-specific laws while leaving broader social media rules unresolved. For platforms operating nationally, compliance now varies by state, by content type, and by which court most recently ruled.