If you run a website, an app or an online store in the United States, age checks are no longer something only adult sites worry about. More and more visitors now meet a screen that asks for an ID, a selfie or a birth date before they can continue. Behind those screens is a fast-growing set of age verification laws, meaning rules that require a business to confirm a user is old enough before showing certain content or features.
The shift started with adult content. Texas HB 1181 requires sites with a large share of sexually explicit material to verify that visitors are 18 or older. In June 2025, the U.S. Supreme Court upheld that law. Since then, states have extended the idea to social media, app stores and even operating systems.
This guide explains which rules exist as of 2026, who they cover and what a practical compliance plan looks like. It is general information, not legal advice, so confirm your obligations with a qualified attorney.
Key Takeaways
- 27 states now enforce age verification laws for adult content, and no court has blocked the core verification duty in any of them.
- The Supreme Court upheld Texas HB 1181 on June 27, 2025, which made these laws much harder to challenge.
- New laws target social media, app stores and device makers, so the rules now reach far beyond adult sites.
- Good compliance collects as little data as possible and deletes it quickly after the check.
- Deadlines keep arriving, including New York on January 25, 2027 and California on January 1, 2027.
What Age Verification Means for Online Businesses
In a store, a cashier checks an ID. Online, software has to do that job. Two terms matter here.
Age verification confirms a user’s age with evidence, for example a government ID or a bank record. Age assurance is the broader umbrella. It also includes age estimation, where software guesses an age range from a face scan or from account signals without confirming identity.
Why should a business owner care? Every extra step at sign-up costs some visitors, while a weak check can trigger fines. The goal is a process that stops minors reliably and stays quick for adults, which is part of building digital trust with your customers.
Overview of US Age Verification Regulations
There is no single federal age verification law in the US. Instead, you deal with a patchwork of state laws plus one important federal privacy rule. The state laws fall into three groups.
Adult Content Laws
Louisiana was first. Its law took effect in January 2023 and applies when more than one third (33.3%) of a site’s material is “harmful to minors”, a legal term for sexual content considered unsuitable for children. Most later laws copied that threshold. According to a state-by-state tracker by Recording Law, 27 states enforced such laws as of August 2026. Recent additions include Ohio (September 30, 2025), Iowa (July 1, 2026) and Missouri (August 28, 2026).
Courts have not blocked the core verification duty of any of these laws. In September 2026, a federal court did pause a newer Utah provision aimed at visitors who hide their location with a VPN, a tool that masks where a user connects from.
Social Media Laws
A second wave targets social platforms used by teenagers. Florida HB 3 bans accounts for children under 14 and requires parental consent for 14- and 15-year-olds. Indiana HB 1408 requires verifiable parental consent, meaning proof that a real parent agreed, before users under 16 open accounts on very large platforms with at least $1 billion in annual revenue. Minnesota’s new law, which takes effect in July 2027, also requires parental consent for users under 16 and bans features such as infinite scroll and autoplay on their accounts. If your marketing relies on younger audiences, factor these rules into how you follow broader social media trends.
App Store and Device Laws
The newest laws move age checks to the device. Utah, Texas, Louisiana and California have passed such laws. California’s Digital Age Assurance Act (AB 1043) starts on January 1, 2027. It requires operating systems to ask for a birth date at account setup and send an “age signal” (one of four age brackets) to apps that request it. Illinois HB 5511, signed on July 31, 2026, follows a similar model from 2028 and allows civil penalties of $50,000 per violation.
The Federal COPPA Rule
COPPA, the Children’s Online Privacy Protection Act, limits how websites collect data from children under 13. The Federal Trade Commission (FTC) amended the COPPA Rule, and full compliance has been required since April 22, 2026. Any business with a young audience needs to review its consent and data practices against it.
If you operate beyond the US, the picture widens further. Our guides on data localization laws and broader data privacy trends cover related obligations.
Supreme Court Decisions That Shape Compliance
Two Supreme Court actions changed the legal ground under these laws.
First, in Free Speech Coalition, Inc. v. Paxton, decided on June 27, 2025, the Court upheld Texas HB 1181 by a 6-3 vote. It applied intermediate scrutiny, a middle level of review that asks whether a law serves an important government interest without burdening more speech than necessary. The Court found that verifying age for sexually explicit material meets that test and places only an incidental burden on adults.
Second, the Court declined to block Mississippi’s social media age verification law in August 2025 and Texas’s App Store Accountability Act (SB 2420) in July 2026, while both challenges continue.
Do not read these decisions as a blanket approval. Paxton concerned adult content only. Critics argue that mandatory checks strip adults of anonymity, and for general social media, where most content is harmless, several challenges under the First Amendment, the constitutional protection for free speech, remain in court. Results differ by state: in March 2026, the Ninth Circuit let California enforce the age estimation part of its Age-Appropriate Design Code while other parts stay blocked.
The practical lesson: “wait for a court to strike it down” is no longer a safe plan. A flexible compliance setup matters more than predicting each lawsuit.
Practical Steps for Complying With Age Verification Laws
These steps work for most small and mid-sized businesses and fit into a wider risk management framework if you already have one.
- Map your exposure. List your products, content types and features, and check which states your users come from.
- Check the thresholds. Adult content laws usually apply above the one-third mark. Social media laws often apply only above revenue or user thresholds.
- Choose a method per risk level. High-risk content needs strong verification. Lower-risk features may accept age estimation or an age signal.
- Review vendor contracts. Specify where data goes, how long it stays and who is liable after a breach.
- Document everything. Keep records of your method, test results and decisions. New York’s final rules, for example, require operators to keep age assurance test results and certifications for 10 years.
- Schedule reviews. Put effective dates in a calendar and review your setup at least twice a year with legal counsel. If you track many rules at once, regtech solutions (software that automates compliance tasks) can help monitor deadlines and keep audit records.
Penalties explain why this matters. Texas HB 1181 allows civil penalties of up to $10,000 per day, plus up to $250,000 if a minor accesses the material.
Technology and Verification Methods
Once you know what the law requires, the next question is how to check age in practice. Texas HB 1181 does not prescribe one system. It accepts government-issued or digital ID and commercially reasonable methods based on transactional data, such as a bank or mortgage record.
Common Verification Methods
- Document checks: the user uploads a driver’s license or passport, and software checks that it is genuine.
- Selfie matching: the user takes a selfie, and software compares it with the ID photo. Our article on biometric authentication explains how face matching works.
- Facial age estimation: software estimates an age range from a face scan without storing identity data.
- Transactional data: a check against credit card, bank or other records that already hold a verified age.
- Device and app store signals: the operating system or app store tells your app which age bracket a user falls into.
Choosing the Right Method
Each method trades accuracy against friction and privacy. Document checks are accurate but slow; age estimation is fast but less precise near the cutoff. Reusable digital identities, such as mobile driver’s licenses and the approaches described in our guide to decentralized identity, can confirm “over 18” without revealing a name.
Fake IDs and AI-generated faces can fool weak systems, as our article on deepfake fraud shows. Ask vendors how they detect spoofing, meaning attempts to trick the check with fake documents or faces.
Navigating Data Privacy and Security Concerns
Age checks create sensitive data: ID scans, selfies and birth dates. The safest data is data you never keep.
Best Practices for Protecting User Information
- Collect the minimum: confirm “over 18” or an age bracket rather than storing full identity documents.
- Delete promptly: Texas HB 1181 prohibits retaining identifying information from the check. The FTC’s COPPA policy statement of February 25, 2026 likewise expects operators to keep only the data needed for the check and delete it promptly.
- Limit the purpose: never reuse verification data for marketing or profiling.
- Secure the pipeline: encrypt data in transit and apply access controls, as outlined in our guide to zero trust cybersecurity.
Managing Data Retention and Breach Risks
If your vendor is breached, the problem becomes yours. Every US state has a breach notification law, so plan your response in advance. A clear data governance strategy and a written privacy compliance framework make retention rules and incident steps easy to follow. Keep an eye on current cybersecurity trends too, since attackers target identity data specifically.
State-Specific Rules and Emerging Trends
Laws keep coming, and their effective dates stack up over the next two years. The dates below were confirmed as of October 2026.
- California AB 1043: operating system age signals start January 1, 2027. Only the Attorney General can enforce, with penalties of up to $7,500 per affected child for intentional violations.
- New York SAFE for Kids Act: final rules released on July 28, 2026 take effect January 25, 2027. They cover platforms with addictive feeds and require at least one age assurance option that does not need a government ID.
- Minnesota: parental consent for users under 16 and bans on addictive features from July 2027.
- Illinois HB 5511: device age signals from January 1, 2028, and operator duties from July 1, 2028.
The trend is clear: lawmakers increasingly push age checks to app stores and operating systems, which pass a simple age bracket to apps. That could mean less data for businesses to handle, but new duties to request and respect those signals. It fits the wider wave of technology regulation that businesses face in 2026.
Conclusion
Age verification is now an ongoing compliance task, not a one-time project. Map which laws apply to your content and users, pick a method that collects as little data from adults as possible, and document every decision. Review the setup regularly with legal counsel, because rulings and new laws will keep changing the picture. For a broader view of the legal and market forces affecting smaller companies, see our overview of small business trends.
Found this useful?
Make SmartKeys a preferred source on Google, and our articles will surface more often in your Top Stories, AI Overviews, and AI Mode.
Add as Preferred SourceFAQ
What is the purpose of age verification laws for online businesses?
The main purpose is to keep minors away from content and features lawmakers consider harmful, such as pornography or addictive social media design. Older sites relied on an “I am 18” button that anyone could click. The new laws make the business responsible for using a reasonable method to confirm age. For operators, the goal is to block underage users reliably while keeping the process quick and private for adults.
Does my business need age verification if we don’t host adult content?
Possibly, yes. Adult content laws apply only above a threshold, usually one third of a site’s material, but other rules reach further. Social media laws in states like Florida and Indiana cover platforms popular with teenagers. California’s age estimation rule and new device laws affect many apps. Sellers of alcohol, tobacco or vape products face their own checks, and COPPA covers sites aimed at children under 13.
What are the legal consequences of not complying with age verification regulations?
Consequences range from state fines to private lawsuits. Texas HB 1181 allows civil penalties of up to $10,000 per day, plus up to $250,000 if a minor accesses the material. Illinois HB 5511 allows $50,000 per violation, and California AB 1043 up to $7,500 per affected child for intentional violations. Several states also let individuals sue, and enforcement actions can damage customer trust.
How can I implement an effective age verification system?
Start by mapping the laws that apply to your content and the states your users come from. Then match the method to the risk: strong ID checks for adult content, lighter age estimation or device signals for lower-risk features. Pick a vendor that verifies age without storing documents, and write retention limits into the contract. Test the flow on mobile, document your choices and review them with counsel regularly.
What should I consider regarding user data privacy?
Treat verification data as highly sensitive and keep as little as possible. Confirm an age bracket instead of storing full ID scans or selfies. Delete data promptly after the check: Texas HB 1181 prohibits retaining identifying information, and the FTC expects prompt deletion under its 2026 COPPA policy statement. Never reuse the data for marketing, and make sure your vendor follows the same rules.
Are there any notable legal cases related to age verification?
Yes. The most important is Free Speech Coalition v. Paxton, where the Supreme Court upheld Texas HB 1181 by 6-3 on June 27, 2025. In August 2025, the Court let Mississippi’s social media law take effect during litigation, and in July 2026 it declined to block Texas’s app store law. In March 2026, the Ninth Circuit let California enforce its age estimation rule. Courts now accept age checks more readily than a few years ago.
How do state-specific regulations impact online businesses?
Because each state writes its own rules, a business serving users nationwide must meet several standards at once. Thresholds, covered ages, accepted methods and deadlines all differ. Many businesses apply the strictest relevant standard everywhere, while others detect the user’s state and adjust the flow. Either way, keep a calendar of effective dates, since New York, California, Minnesota and Illinois all have deadlines in 2027 or 2028.
Do age verification laws apply to businesses outside the US?
US state laws generally apply to any business whose site or app is available to users in that state, wherever the company is based. Similar rules exist abroad. The UK’s Online Safety Act has required highly effective age checks for pornography sites since July 2025. Australia set a minimum age of 16 for many social media accounts in December 2025, and the EU has issued guidance under the Digital Services Act.
