Age verification regulations in the United States of America

California

Age-Appropriate Design Code Act

Codified as: California Civil Code, Division 3, Part 4, Title 1.81.47

Regulation overview: The California Age-Appropriate Design Code Act (CAADCA) requires a business that provides an online service, product, or feature likely to be accessed by children to complete a Data Protection Impact Assessment to identify potential harms to which children may be exposed and, where appropriate, estimate the age of child users with reasonable certainty appropriate to the risks to which they may be exposed.

Applicability: CAADCA applies to any business whose online service, product, or feature is likely to be accessed by children where such service, product, or feature may expose a child to the risk of harm.

Core requirements include:

• Prior to offering new services to the public, to complete and make available upon request to the Attorney General, the Data Protection Impact Assessment;
• Document any risk of harm to children that arise from the data management practices of the business identified in DPIA and create a plan to mitigate or eliminate such risk before children access the online service;
• Estimate the age of child users with a reasonable level of certainty appropriate to the risks that arise from the data management practices of the business or alternatively, apply the privacy and data protection measures designed for children to all consumers;
• Provide any privacy information, terms of service, policies, and community standards using clear and concise language suited to the age of children likely to access online services;
• Enforce published terms, policies, and community standards established by businesses, including privacy policies;
• Provide visible, accessible, and responsive tools to help children, or, when relevant, their parents or guardians, exercise their privacy rights and report concerns.

Link: Assembly Bill 2273 

Status:

• Signed into the law: Sep 15,2022
• Applies from: July 1, 2024

Exemptions, if any: Online service, product, or feature excludes:

• a broadband internet access service;
• a telecommunications service;
• the delivery or use of physical products.

This act does not apply to information or entities specified in the California Civil Code, section 1798.145 (for example, health care providers or entities cooperating with law enforcement agencies).

Applicable sanctions: Any business that is found to violate this act may be subject to the following:

• injunction;
• a civil penalty not exceeding $2,500 per affected child for each negligent violation;
• a civil penalty not exceeding $7,500 per affected child for each intentional violation.

How is it enforced: Attorney General

Texas

House Bill 1181

Codified as: Texas Civil Practice and Remedies Code, Title 6, Chapter 129B

Regulation overview: Requires a commercial entity, including social media platform, that knowingly and intentionally publishes or distributes material harmful to minors on the internet from a website that contains a substantial portion of such material to use reasonable age verification methods to verify that an individual attempting to access the material is 18 years of age or older.

Applicability: Commercial entities - these are any legally recognized entities, such as, among others, corporations, limited liability companies, and partnerships.

Core requirements include: 

1. Not to retain any identifying information on the individual after performing age verification.

2. Display specific notices on the landing page of the internet website on which sexual material harmful to minors is published or distributed and all advertisements for that website in 14-point font or larger.

3. Display the specific notice at the bottom of every page of an internet website (on which sexual material harmful to minors is published or distributed) in 14-point font or larger.

4. Implement age verification through the use of:

• Digital identification - that is information stored on a digital network that may be accessed by a commercial entity and that serves as proof of an individual's identity.
• Commercial age verification system which verifies age using government-issued identification or a commercially reasonable method that relies on public or private transactional data (for example, mortgage records, educational records, or employment records).

Link: House Bill 1181

Status:

• Signed into the law: July 12, 2023
• Applies from: Sep 1, 2023

Exemptions, if any: Does not apply to:

• News gathering organizations;
• Unless certain criteria are met, internet service providers, its affiliates or subsidiaries, search engines, or cloud services providers.

Applicable sanctions: The Act establishes civil liability for the violators. The Attorney General may bring an action to enjoin the violation, recover a civil penalty, and obtain another relief the court considers appropriate. A civil penalty may amount to not more than the total of:

• $10,000 per day that entity operates an internet website without appropriate age verification mechanisms required by this Act;
• $10,000 per each instance when the entity retains identifying information contrary to requirements under this Act;
• If the failure to implement age verification results in a minors's access to sexual material harmful to minors, an additional amount is not more than $250,000.

Additionally, the attorney general may recover reasonable and necessary attorney's fees and costs incurred in an action highlighted above.

How is it enforced: Attorney General

North Carolina

House Bill 8 / SL 2023-132 

Codified as: North Carolina General Statutes, Chapter 66, Article 51, Section 66-500

Regulation overview: Pornography Age Verification Enforcement Act or the PAVE Act requires a commercial entity that knowingly and intentionally publishes or distributes material harmful to minors on the internet from a website that contains a substantial portion of such material to verify the age of the individuals attempting to access the material.

Applicability: Commercial entities - these are any legally recognized entities, such as, among others, corporations, limited liability companies, or partnerships.

Some notable requirements:

1. Not to retain any identifying information on the individual after performing age verification and after access has been granted to the material

2. Implement age and identity verification through the use of:

• A digitized identification card or A system that allows to verify the age through the government-issued identification or any commercially reasonable method that relies on public or private transactional data (for example, mortgage records, educational records, or employment records);
• Another commercially reasonable method of age and identity verification.

Link: House Bill 8 / SL 2023-132 

Status:

• Signed into the law: Sep 29, 2023
• Applies from: Jan 1, 2024

Exemptions, if any: Does not apply to:

• News gathering organizations;
• Generally to internet service providers, its affiliates or subsidiaries, search engines, or cloud services providers unless certain criteria are met (e.g. they create the material harmful to minors).

Applicable sanctions: The act establishes civil liability for the violators.

Parents or guardians of affected minors and/or persons whose identifying information is retained in violations of requirements under the PAVE Act may seek from the court the following types of relief:

• An injunction to enjoin a continued violation of the PAVE Act;
• Compensatory and punitive damages.
• All costs, expenses, and fees related to the civil suit investigation and proceedings associated with the violation, including attorney's fees.

How is it enforced: Private right of action - meaning any affected individual (e.g. a parent or guardian of a minor who gained access to the material) can bring the case to the court.

Montana

Senate Bill 544

Codified as: Montana State Statutes, Title 30, Chapter 14

Regulation overview: Requires a commercial entity that knowingly and intentionally publishes or distributes material harmful to minors on the internet from a website that contains a substantial portion of such material to verify the age of the individuals attempting to access the material.

Applicability: Commercial entities - these are any legally recognized entities, such as, among others, corporations, limited liability companies, and partnerships.

Core requirements include: 

1. Not to retain any identifying information on the individual after performing age verification and after access has been granted to the material.

2. Implement reasonable age verification method through the use of:

• A digitized identification card or
• A system that allows to verify the age through the government-issued identification or  any commercially reasonable method that relies on public or private transactional data (for example, mortgage records, educational records, or employment records);
• Another commercially reasonable method of age and identity verification.

Link: Senate Bill 544 

Status:

• ​​Signed into the law: May 19, 2023
• Applies from: Jan 1, 2024

Exemptions, if any: Does not apply to:

• News gathering organizations;
• Unless certain criteria are met, internet service providers, its affiliates or subsidiaries, search engines, or cloud services providers.

Applicable sanctions: The scope of penalties remains somewhat ambiguous. The Act provides that an entity who fails to implement reasonable age verification methods or knowingly retains identifying information of the individual after the access has been granted to the individual is liable to an individual for damages resulting from a minor accessing the material or retaining identifying information, including court costs and reasonable attorney fees.

How is it enforced: Most likely through the private right of action, but the Act is not too clear in this regard.

Virginia

Senate Bill 1515

Codified as: Code of Virginia, Title 8.01, Chapter 3, Article 3, Section 8.01-40.5

Regulation overview: Requires a commercial entity that knowingly and intentionally publishes or distributes material harmful to minors on the internet from a website that contains a substantial portion of such material to verify the age of the individuals attempting to access the material.

Applicability: Commercial entities - these are any legally recognized entities, such as, among others, corporations, limited liability companies, and partnerships.

Core requirements include: 

• A commercially available database that is regulatory used by businesses or governmental entities for the purposes of age and identity verification or
• Another commercially reasonable method of age and identity verification.

Link: Senate Bill 1515 

Status: 

• Signed into the law: May 12, 2023
• Applies from: July 1, 2023

Exemptions, if any: Does not apply to the provider or user of interactive computer service on the internet.

Applicable sanctions: The scope of penalties remains somewhat ambiguous. The Act establishes that any commercial entity that violates this Act may be subject to civil liability for damages resulting from a minor's access to such material harmful to a minor and reasonable attorney fees and costs.

How is it enforced: Most likely, through a private right of action, but the Act is not too clear in this regard.

Arkansas

Senate Bill 66

Codified as: Code of Arkansas, Title 4, Subtitle 7, Chapter 88, Subchapter 13

Regulation overview: Protection of Minors from Distribution of Harmful Material Act requires a commercial entity to use a reasonable age verification method before allowing access to a website that contains a substantial portion of material that is harmful to minors.

Applicability: Commercial entities - these are any legally recognized entities, such as, among others, corporations, limited liability companies, and partnerships.

Core requirements include:

1. Not to retain any identifying information on the individual after performing reasonable age verification and after access has been granted to the material.

2. Implement reasonable age verification method through the use of:

• A digitized identification card;
• A government-issued identification;
• Any commercially reasonable age verification method that holds an Identity Assurance Level 2 (IAL2).

Link: Senate Bill 66

Status:

• Signed into the law: April 11, 2023
• Applies from: July 31, 2023
  undefined

Exemptions, if any: Does not apply to:

• News or public interest broadcast, website video, report, or event;
  undefined
• Cloud service providers; or
• Internet service providers, its affiliates or subsidiaries or search engines unless certain criteria are met (e.g. they create material harmful to minors).

Applicable sanctions: The scope of penalties remains somewhat ambiguous. The Act provides that an entity who fails to implement reasonable age verification methods or knowingly retains identifying information of the individual after the access has been granted to the individual is liable to an individual for damages resulting from a minor accessing the material or retaining identifying information, including court costs and reasonable attorney fees.

How is it enforced: Most likely, through a private right of action, but the Act is not too clear in this regard.

Senate Bill 396

Codified as: Code of Arkansas, Title 4, Subtitle 7, Chapter 88, Subchapter 14

Regulation overview: Requires social media companies to prevent a minor from being an account holder on the social media platform unless the minor has the express consent of a parent or legal guardian.

Applicability: 

Social media company - means an online forum that a company makes available for an account holder to:

• Create a public profile, establish an account, or register as a user for the primary purpose of interacting socially with other profiles and accounts;
• Upload or create posts or content;
• View posts or content of other account holders and
• Interact with other account holders or users, including, without limitation, establishing mutual connections through request and acceptance.

Core requirements include:

1. Not to retain any identifying information of the individual after performing age verification and providing access to social media platforms.

2. Social media companies must verify the age of an account holder and, if the holder is a minor, confirm that they have parental/guardian's consent to become a new account holder when opening an account. The age verification can be conducted through the use of:

• A digitized identification card;
• A government-issued identification;
• Any commercially reasonable age verification method.

Link: Senate Bill 396 

Status:

• Signed into the law: April 11, 2023
• Applies from: Sep 1, 2023

Exemptions, if any: Does not apply to:

• A media company that exclusively offers subscription content in which users follow or subscribe unilaterally and whose platform's primary purpose is not social interaction;
• A social media company that allows a user to generate short video clips of dancing, voice-overs, or other acts of entertainment in which the primary purpose is not educational or informative;
• A media company that exclusively offers interactive gaming, virtual gaming, or an online service that allows the creation and uploading of content to interact in gaming, entertainment, or associated entertainment, and the communication related to that content;
• A company that offers cloud storage services, enterprise cybersecurity services, educational devices, or enterprise collaboration tools for kindergarten through grade twelve (K-12) schools and derives less than 25% of its revenue from operating a social media platform, including games and advertising;
• A company that provides career development opportunities, including professional networking, job skills, learning certifications, and job posting and application services;
• A social media platform that is controlled by a business entity that has generated less than $100,000,000 in annual gross revenue.
• An online service, a website, or an application that has a predominant function listed in A.C.A. § 4-88-1401(8(B)).

Applicable sanctions: A social media company, who violates the provisions of the act may be liable to:

• A penalty of $2,500 per violation, plus the court costs and reasonable attorney's fees;
• Damages resulting from a minor accessing a social media platform without their parent's or custodian's consent, including court costs and reasonable attorney's fees.

How is it enforced: Prosecutor and/or Attorney General. The private right of action is also authorized.

Mississippi

Senate Bill 2346

Codified as: No reference available yet

Regulation overview: Requires a commercial entity that knowingly and intentionally publishes or distributes material harmful to minors on the internet from a website that contains a substantial portion of such material to perform a reasonable age verification to verify the age of the individuals attempting to access the material.

Applicability: Commercial entities - these are any legally recognized entities, such as, among others, corporations, limited liability companies, and partnerships.

Core requirements include:

1. Not retain any identifying information on the individual after performing age verification and after access has been granted to the material.

2. Implement reasonable age verification method through the use of:

• A digitized identification card or
• A system that allows to verify the age through the government-issued identification or any commercially reasonable method that relies on public or private transactional data (for example, mortgage records, educational records, or employment records).

Link: Senate Bill 2346 

Status:

• Signed into the law: April 18, 2023
• Applies from: July 1, 2023

Exemptions, if any: Does not apply to:

• News gathering organizations;
• Unless certain criteria are met, internet service providers, its affiliates or subsidiaries, search engines, or cloud services providers (e.g. they create material harmful to minors).

Applicable sanctions: The scope of penalties remains somewhat ambiguous. The Act provides that an entity who fails to implement reasonable age verification methods or knowingly retains identifying information of the individual after the access has been granted to the individual is liable to an individual for damages resulting from a minor accessing the material or retaining identifying information, including court costs and reasonable attorney fees.

How is it enforced: Most likely, through a private right of action, but the Act is not too clear in this regard.

Utah

Senate Bill 287

Codified as: Utah Code, Title 78B, Chapter 3, Part 10

Regulation overview: Requires a commercial entity that knowingly and intentionally publishes or distributes material harmful to minors on the internet from a website that contains a substantial portion of such material to perform a reasonable age verification to verify the age of the individuals attempting to access the material.

Applicability: Commercial entities - these are any legally recognized entities, such as, among others, corporations, limited liability companies, and partnerships.

Core requirements include:

1. Not to retain any identifying information on the individual after performing age verification and after access has been granted to the material.

2. Implement reasonable age verification method through the use of:

• A digitized identification card or
• Verification through an independent, third-party verification service that compares the personal information entered by the individual who is seeking access to the material that is available from a commercially available database(s) that government agencies and businesses regularly use for age and identity verification or
• Any commercially reasonable method that relies on public or private transactional data (for example, mortgage records, educational records, or employment records).

Link: Senate Bill 287 

Status:

• Signed into the law: March 14, 2023
• Applies from: May 3, 2023

Exemptions, if any: Does not apply to:

• News gathering organizations;
• Unless certain criteria are met, internet service providers, its affiliates or subsidiaries, search engines, or cloud services providers (e.g. they create material harmful to minors).

Applicable sanctions: The scope of penalties remains somewhat ambiguous. The Act provides that an entity who fails to implement reasonable age verification methods or knowingly retains identifying information of the individual after the access has been granted to the individual is liable to an individual for damages resulting from a minor accessing the material or retaining identifying information, including court costs and reasonable attorney fees.

How is it enforced: Most likely, through a private right of action, but the Act is not too clear in this regard.

House Bill 311 

Codified as: Utah Code, Title 13, Chapter 63

Regulation overview: The Utah Social Media Regulation Act requires social media companies to prevent a minor from being an account holder on the social media platform unless the minor has the express consent of a parent or legal guardian.

Applicability: 

Social media company - means a person or entity that:

• provides a social media platform that has at least 5,000,000 account holders worldwide, and
• is an interactive computer service.

Social media platform - means an online forum that a social media company makes available for an account holder to:

• create a profile;
• upload posts;
• view the posts of other account holders and
• interact with other account holders or users.

Core requirements include: 

• Starting from March 1, 2024, a social media company must verify the age of all existing Utah's account holders and not allow a Utah resident who is a minor to become an account holder on social media platforms unless the express consent of their parent or guardian is obtained.
• Starting from March 1, 2024, the Act requires social media companies to implement additional safeguards and restrictions on accounts of minors (for example, not showing the account in search results unless the other user's account is linked to the minor's account through friending or not to display any ads for minor's account).
• Starting from March 1, 2024, the Act requires social media companies to provide access to the account to a parent or guardian so that they can view the posts and messages sent to or by the Utah minor account holder.
• Starting from March 1, 202, the Act requires social media companies to prohibit minors from accessing their account between 10.30pm and 6.30am unless required otherwise by the law.

Link: House Bill 311 

Status:

• Signed into the law: March 23, 2023
• Applies from: May 3, 2023

Exemptions, if any: Does not apply to social media platforms as provided in Utah Code, Section 13-63-101(10(b))

Applicable sanctions: Social media companies may be liable to the following penalties:

• An administrative fine imposed by the Division of Consumer Protection up to $2,500 for each violation, plus the court costs, reasonable attorney's fees, awards to injured persons and any other relief that the court may deem appropriate;
  undefined
• Allows for a private right of action (i.e., an individual bringing the case to the court against a social media platform).

How is it enforced: Division of Consumer Protection and Attorney General. Private right of action is also foreseen.

Louisiana

House Bill 77

Codified as: Louisiana Revised Statutes, Title 51, Section 51:2121

Regulation overview: Pornography Age Verification Enforcement Act or the PAVE Act requires commercial entities that knowingly and intentionally publish or distribute material harmful to minors on the internet from a website that contains a substantial portion of such material to perform a reasonable age verification to verify the age of the individuals attempting to access the material.

Applicability: Commercial entities - these are any legally recognized entities, such as, among others, corporations, limited liability companies, and partnerships.

Core requirements include:

Implement reasonable age verification method through the use of:

• A digitized identification card or
• A system that allows to verify the age through the government-issued identification or any commercially reasonable method that relies on public or private transactional data (for example, mortgage records, educational records, or employment records).

Link: House Bill 77 

Status:

• Signed into the law: June 8, 2023
• Applies from: Aug 1, 2023

Exemptions, if any: Does not apply to:

• News or public interest broadcast, website video, report, or event; or
  undefined
• Unless certain criteria are met, internet service providers, its affiliates or subsidiaries, search engines, or cloud services providers (e.g. they create material harmful to minors).

Applicable sanctions: The Act establishes civil liability for the violators. Any commercial entity that violates the requirements of the act may be penalized:

• By a fine of not more than $5,000 for each day of violation;
• By request from the Attorney General, an additional fine of not more than $10,000 for each violation where the entity knowingly failed to perform reasonable age verification to verify the age of individuals.

How is it enforced: Attorney General.

House Bill 142

Codified as: Louisiana Revised Statutes, Title 9, Section 9:2800.29

Regulation overview: Requires commercial entity that knowingly and intentionally publishes or distributes material harmful to minors on the internet from a website that contains a substantial portion of such material to perform a reasonable age verification to verify the age of the individuals attempting to access the material.

Applicability: Commercial entities - these are any legally recognized entities, such as, among others, corporations, limited liability companies, and partnerships.

Core requirements include:

1. Not to retain any identifying information on the individual after performing age verification and after access has been granted to the material.

2. Implement reasonable age verification method, through use of:

• A digitized identification card or
• A system that allows to verify the age through the government-issued identification or any commercially reasonable method that relies on public or private transactional data (for example, mortgage records, educational records, or employment records).

Link: House Bill 142 

Status:

• Signed into the law: June 15, 2022
• Applies from: Jan 1, 2023

Exemptions, if any: Does not apply to:

• News or public interest broadcast, website video, report, or event;
• News-gathering organizations; or
• Internet service providers, its affiliates or subsidiaries, search engines, or cloud services providers unless certain criteria is met.

Applicable sanctions: The scope of penalties remains somewhat ambiguous. The Act provides that an entity who fails to implement reasonable age verification methods or knowingly retains identifying information of the individual after the access has been granted to the individual is liable to an individual for damages resulting from a minor accessing the material or retaining identifying information, including court costs and reasonable attorney fees.

How is it enforced: Most likely, through a private right of action, but the Act is not too clear in this regard.