Age Verification and Minors Online After Free Speech Coalition v. Paxton: What States Can Require of Websites and Apps

Dreamwidth is a small blogging and journaling site, the kind of place that does not sort anyone's timeline with an algorithm. When Tennessee passed a law requiring social media companies to verify the age of anyone opening an account and to get a parent's consent for minors, Dreamwidth's co-owner told a federal court that the company could not comply without sweeping changes it lacked the resources to make. Dreamwidth then did the only thing it could afford. As the dissenting judge recounted in NetChoice, LLC v. Skrmetti, No. 25-5660 (6th Cir. Aug. 28, 2026), Dreamwidth and Nextdoor both opted to prohibit minors from creating accounts rather than build the infrastructure.

Now suppose you run a blog. Say you are a retired machinist in Duluth who writes about restoring old lathes, and four thousand people read you, and some of them leave comments. A reader emails to ask whether you have heard about these new laws, and whether you are now supposed to check IDs. It is a better question than it sounds. The honest answer requires reading about nine different statutes, three Supreme Court opinions, and a circuit split still being drawn, and then looking at what your comment form actually does.

This article is the long version of that answer.

The short answer

• A blog with an ordinary comment section is, in most states, outside these laws. The social media statutes turn on features such as accounts, profiles, connection lists, and algorithmic feeds, and several expressly carve out comments on news or publisher content. Dreamwidth shows where the line begins to bite: once a site offers accounts, profiles, and mutual connections, small size alone does not necessarily save it.
• Age checks for pornography sites are settled. Free Speech Coalition, Inc. v. Paxton, 606 U.S. 461 (2025) upheld Texas's law under intermediate scrutiny. If more than the statutory fraction of your site is sexual material harmful to minors, plan on verifying age.
• Age checks for general social media are not settled. The circuits have split on the level of scrutiny, on reasoning, and on outcome. Florida's law survives in the Eleventh Circuit as content neutral. Ohio's survived a fractured Sixth Circuit panel, though that court has stayed its mandate while NetChoice seeks certiorari. District courts in Arkansas, Louisiana, Virginia, and Nebraska have enjoined comparable laws under strict scrutiny. Justice Kavanaugh has written that Mississippi's version is likely unconstitutional, while voting not to block it.
• States have been winning more often on procedure than on the merits. Since Moody v. NetChoice, LLC, 603 U.S. 707 (2024), a facial challenger must map the law's full range of applications. Trade associations keep failing to do that, and injunctions keep getting vacated. An injunction you were relying on may be gone by the time you read this.
• An injunction usually protects the plaintiff's members, not you. Several of these orders run only to NetChoice members. A small operator that is not a member may be fully exposed in a state where the headline says the law was "blocked."
• Verification creates its own legal risk. A government ID, a face scan, and a verified birthdate are all sensitive data. Biometric statutes such as Illinois's, the amended COPPA Rule, and many state privacy laws attach to what you collect. Verifying also gives you knowledge, and knowledge is what triggers COPPA for a general audience site.
• Section 230 protects less than it used to in this area, and how much depends on where you are sued. Filtering mandates are preempted in the Fifth Circuit. Age checks and data rules are not. Design-defect claims are splitting state and federal courts, and a Los Angeles jury has returned a verdict against Meta and YouTube on that theory.

Five kinds of law wearing one name

"Age verification law" gets used for statutes that have almost nothing in common except the word "age." The first analytical step is to separate them, because they have different coverage tests, different constitutional footing, and different compliance burdens.

Federal children's privacy law sits under all five. The Children's Online Privacy Protection Act, 15 U.S.C. §§ 6501 to 6506, does not require anyone to verify age. It imposes duties on operators of services directed to children under 13 and on operators with actual knowledge that they are collecting personal information from such a child. MC Law's overview of that statute is Children's Privacy Under COPPA and the Age-Appropriate Design Codes.

How the law got here: seventy years of trying to keep adults out of the blast radius

The doctrine rests on a single awkward fact. The same material can be protected for an adult and unprotected for a child, and there is no way to stop one from receiving it without touching the other.

Butler (1957). Michigan made it a crime to sell anyone a book tending to corrupt the morals of youth. A bookseller sold one to a police officer. Butler v. Michigan, 352 U.S. 380 (1957), struck the statute, because a state may not reduce adult readers to what is fit for children. Justice Frankfurter's line, that this was "to burn the house to roast the pig," has been quoted in this field ever since.

Ginsberg (1968). Ginsberg v. New York, 390 U.S. 629 (1968), went the other way on a narrower statute. The owner of a Long Island luncheonette sold "girlie" magazines to a 16-year-old boy. The Court held that a state may adjust the definition of obscenity to what is obscene from a minor's perspective, and it upheld the conviction under deferential review. After Miller v. California, 413 U.S. 15 (1973), set the modern adult test, the "variable obscenity" idea became the three-part test adjusted for minors that nearly every current statute copies: prurient appeal to minors, patent offensiveness for minors, and no serious value for minors.

Sable and Playboy. Sable Communications of California, Inc. v. FCC, 492 U.S. 115 (1989), struck a flat ban on indecent dial-a-porn. United States v. Playboy Entertainment Group, Inc., 529 U.S. 803 (2000), struck a rule confining sexually oriented cable channels to late-night hours, because blocking at the household level was a less restrictive alternative.

Reno (1997). Reno v. American Civil Liberties Union, 521 U.S. 844 (1997), was the first internet case. The Communications Decency Act made it a crime to send "indecent" or "patently offensive" material where a minor could receive it, with an affirmative defense for those who demanded a credit card or adult access code. The Court applied strict scrutiny and struck it down, largely because the defense was fictional for most speakers and "indecent" reached far past pornography.

Ashcroft II (2004). Congress tried again with the Child Online Protection Act, 47 U.S.C. § 231, limited to commercial speech harmful to minors and again with an age-verification affirmative defense. In Ashcroft v. American Civil Liberties Union, 542 U.S. 656 (2004), the Court affirmed a preliminary injunction because the government had not shown that filtering software at home was less effective.

For twenty years, anyone who read those cases thought they knew the rule: burdening adult access to speech protected for adults is content-based regulation, strict scrutiny applies, and filters are the less restrictive alternative that kills the statute. The Fifth Circuit panel in the Texas case and the Supreme Court majority both thought otherwise, for different reasons.

Free Speech Coalition v. Paxton, read closely

Texas's H.B. 1181 applies to a commercial entity that knowingly and intentionally publishes material on a website "more than one-third of which is sexual material harmful to minors." It requires "reasonable age verification methods," which in practice means government-issued ID or a commercially reasonable method using public or private transactional data, and it may be performed by the site or a third party. The attorney general may seek an injunction, up to $10,000 per day of noncompliance, and up to $250,000 more if minors access covered material because of the violation. The Fifth Circuit had applied rational basis review, the most forgiving standard in constitutional law. The district court had applied strict scrutiny. The Supreme Court, 6 to 3, in an opinion by Justice Thomas, rejected both.

The move that decides the case

The opinion's central step is compact. States have long had the power to prevent minors from accessing speech obscene from their perspective. That power, the Court reasons, "necessarily includes the power to require proof of age." From there comes the sentence every later brief quotes: no person, "adult or child," has "a First Amendment right to access speech that is obscene to minors without first submitting proof of age."

Notice what that does. The Court does not say adults lack a right to view the material. It says the opposite. Adults have that right, and submitting to verification burdens it. But because "adults have no First Amendment right to avoid age verification," the burden is treated as an incidental effect of regulating unprotected activity. Speech obscene to minors is, in the Court's careful phrase, "unprotected to the extent the State seeks only to verify age." The Court then borrows the draft-card framework from United States v. O'Brien, 391 U.S. 367 (1968): the law directly regulates accessing the material without verifying, which is unprotected, and only incidentally burdens ultimately accessing it, which is protected.

Why not strict scrutiny, and why not rational basis

The Court gives a surprisingly candid reason for avoiding strict scrutiny. Strict scrutiny, in its telling, works only if it is nearly always fatal, and applying it would call every in-person age check into question, including the liquor store's and the adult bookstore's. Since nobody thinks those are unconstitutional, the standard must be lower. Rational basis fails from the other side because age verification does burden adults, and intermediate scrutiny, which the Court describes as "deferential but not toothless," is needed to catch manipulation. Texas had conceded at argument that it could not require an affidavit from a visitor's biological parent as proof of age. That concession is the Court's example of what intermediate scrutiny exists to stop, and litigators should keep it in mind: there is an outer limit on how onerous the method can be.

What the Court did with Reno and Ashcroft

Here the opinion does its most aggressive work. Reno and Ashcroft II were, the Court says, cases about bans. The statutes made posting a crime and offered age verification only as an affirmative defense, so a prosecutor could charge a fully compliant site and force it to "risk the perils of trial." H.B. 1181 instead makes the lack of verification an element the state must plead and prove. That is a real drafting lesson, and it turns a formal difference into a constitutional one. The Court adds that those decisions addressed the internet of dial-up and static photos. They remain precedent, but they do not speak to a world in which, as the Court recites, 95 percent of American teens have a smartphone.

Footnote 12 is the sentence to tattoo on your hand if you litigate outside pornography. The Court concedes that "for fully protected speech, 'the distinction between bans and burdens makes no difference to the level of scrutiny.'" The distinction matters only "when the First Amendment partially protects speech." In other words, the whole ban-versus-burden framework depends on the speech being in that odd partial category.

Tailoring: what passes

Under intermediate scrutiny, the Court held H.B. 1181 "readily" satisfied. The interest in shielding children is important, even compelling. The state did not have to adopt the least restrictive means, so filtering software and opt-in blocking at the internet service provider were beside the point. There is no freestanding underinclusiveness problem in missing search engines or social media. And privacy fears did not move the Court, in part because users submit information only to the site or its vendor, and "[b]oth those entities have every incentive to assure users of their privacy."

What the opinion leaves open

• Whole-site gating. Footnote 7 notes a dispute over whether a covered site must gate all of its content or only the harmful portion, and declines to resolve it, holding only that the plaintiffs had not shown the bad applications were substantially disproportionate under United States v. Hansen, 599 U.S. 762 (2023).
• Which minor? The same footnote leaves unresolved whether material must be obscene to all minors or to any minor, though the Court doubts it matters much and says the statute cannot reach a PG-13 or R-rated film.
• Biometrics. Footnote 14 records a disagreement over whether Texas's law allows face scans, and does not resolve it.
• The method. The Court approved ID and transactional data. It did not hold that every method a legislature might choose is acceptable.

The dissent, and why it matters to practitioners

Justice Kagan, joined by Justices Sotomayor and Jackson, called the majority's opinion "to be frank, confused." Her argument is that a law defining speech by content and telling adults they must incur a cost to view it is a direct, content-based regulation. "The First Amendment prevents making speech hard, as well as banning it outright." She would have sent the case back under strict scrutiny, adding that the law might well survive. She also makes the privacy point more bluntly than anyone: "The operator might sell the information; the operator might be hacked or subpoenaed."

A dissent is not law, but challengers now use it to frame what the majority did not reach, and the Eleventh Circuit quotes it with approval for the definition of a content-based law. The majority and the dissent also agree on one thing the rest of this article depends on: for fully protected speech, a burden is as serious as a ban.

Moody's second life

Moody is remembered for saying that platforms' curation of third-party speech is expressive. Its more immediately useful holding is about procedure. NetChoice "chose to litigate these cases as facial challenges, and that decision comes at a cost." A facial challenger in a First Amendment case must show that a substantial number of applications are unconstitutional judged against the law's plainly legitimate sweep, and a court must first ask what activities, by what actors, the law regulates, then weigh the bad applications against the good.

Trade associations usually sue before a law takes effect, on behalf of members who would rather not be deposed, with little record about the many sites they do not represent. That is exactly the posture Moody punishes. The result has been a series of reversals that have nothing to do with whether the statute is wise or even constitutional:

• NetChoice, L.L.C. v. Fitch, 134 F.4th 799 (5th Cir. 2025), vacated Mississippi's first injunction for want of a proper Moody analysis, and NetChoice, L.L.C. v. Paxton, 121 F.4th 494 (5th Cir. 2024), sent the Texas content-moderation case back to develop a record.
• NetChoice, LLC v. Bonta, 170 F.4th 744 (9th Cir. 2026), vacated most of a second injunction against California's design code, observing that NetChoice "is presumably aware of the expectations for a facial challenge."
• NetChoice v. Attorney General of Georgia, No. 25-12436 (11th Cir. Oct. 15, 2026), vacated the injunction against SB 351 without reaching the merits. The panel accepted that the law might overwhelmingly reach protected speech, but said an impressionistic judgment does not satisfy Moody, and that NetChoice had not even listed its own covered members.

The Eleventh Circuit's rationale deserves a closer look because it invents a useful taxonomy. Some platforms are conventional, hosting mostly protected speech. Some are hybrid, such as a platform that allows pornography. And some are rogue, the court's hypothetical "Incitement.com" and "TrueThreats.com." Each draws a different level of scrutiny under the same statute. A challenger must account for all of them. "We've learned the facial-challenge lesson the hard way," the court wrote, recalling that its own prior decision was vacated in Moody.

The practical consequence for anyone relying on one of these cases is simple. Vacatur on Moody grounds is not a ruling that the law is valid, and the Eleventh Circuit says so. It means the law can be enforced while an as-applied case gets built, and an as-applied case is something a single operator can bring. For the mechanics of seeking relief, see Preliminary Injunctions and Temporary Restraining Orders: Emergency Relief in Federal Court.

The social media split: same problem, four answers

Everyone agrees the state may protect children from harm. Brown v. Entertainment Merchants Association, the violent video game case, supplies the opposing rule: the state has no "free-floating power to restrict the ideas to which children may be exposed," and Brown, 564 U.S. 786 (2011), expressed doubt that punishing third parties for conveying protected speech to children, in case their parents disapprove, is a proper way of aiding parental authority. Packingham v. North Carolina, 582 U.S. 98 (2017), adds that social media is one of the main places Americans exercise speech rights at all. Applying these cases, courts have reached four different destinations.

Answer one: content based, strict scrutiny, and the state loses

This was the dominant answer through 2025. In NetChoice v. Fitch, No. 25A97 (U.S. Aug. 14, 2025), the Court declined to vacate the Fifth Circuit's stay of Mississippi's injunction, with no explanation. Justice Kavanaugh concurred alone, on the ground that NetChoice had not shown the equities favored it, and went out of his way to add that "under this Court's case law as it currently stands, the Mississippi law is likely unconstitutional." He cited Moody and Brown and marked Free Speech Coalition with only a "cf." That one signal is not a holding, but every challenger quotes it.

The district court decisions in this line include NetChoice, LLC v. Griffin, No. 5:23-cv-05105 (W.D. Ark. Mar. 31, 2025), which permanently enjoined Arkansas's Act 689 and observed that the state "takes a hatchet" where the Constitution demands a scalpel; NetChoice, LLC v. Fitch, No. 1:24-cv-00170 (S.D. Miss. June 18, 2025), now stayed; NetChoice v. Carr, No. 1:25-cv-02422 (N.D. Ga. June 26, 2025), now vacated; NetChoice v. Murrill, 812 F. Supp. 3d 594 (M.D. La. 2025), a final judgment against Louisiana's Act 456 as applied to ten named NetChoice members, reasoning that the Act's age-verification and consent duties fail even intermediate scrutiny; NetChoice v. Jones, 822 F. Supp. 3d 656 (E.D. Va. 2026), enjoining Virginia's one-hour default limit for users under 16, on appeal as No. 26-1252 in the Fourth Circuit; and NetChoice v. Hilgers, No. 4:26-CV-3149 (D. Neb. June 27, 2026), on appeal as No. 26-2478 in the Eighth Circuit.

Hilgers is the most instructive of these. Judge Gerrard enjoined Nebraska's age-verification and parental-consent requirements but left in place a provision letting parents view a minor's posts and messages. He reasoned that those provisions allow but do not mandate monitoring, and so they do not impose governmental authority subject only to a parental veto. Regulating by giving parents a tool, rather than by giving the state a gate, may be the most defensible design in the field.

Answer two: strict scrutiny, and the state wins

NetChoice, LLC v. Yost, 180 F.4th 268 (6th Cir. 2026), is three opinions in search of a holding. Ohio's Act covers operators that let users interact socially, build profiles, list connections, and post content, if the service targets or is reasonably anticipated to be accessed by unemancipated children under 16. Operators must get verifiable parental consent for a contract with such a child.

• Judge Clay's lead opinion finds the Act content based, because the coverage factors include subject matter, visual content, music, and child celebrities, and because the exemption for comments on established news outlets favors news. He then upholds it under strict scrutiny, relying on a compelling interest in children's welfare and on evidence stronger than California had in Brown. Few courts have ever gone that way.
• Judge Batchelder, concurring in the judgment, skips the merits. NetChoice failed its Moody burden. She adds that she doubts strict scrutiny applies at all.
• Judge Ritz, dissenting, agrees it is content based and says it fails strict scrutiny. One-time consent, he says, does not supervise anything.

Two judges agree NetChoice cannot assert the rights of minor users, which is its own circuit conflict, because the Fifth Circuit in Fitch allowed both associational and third-party standing. What the case stands for beyond its judgment is debatable. Count votes carefully before citing it for the proposition that a parental consent law survives strict scrutiny, since only one judge said that.

Answer three: content neutral, intermediate scrutiny, and the state wins

Computer & Communications Industry Ass'n v. Attorney General of Florida, No. 25-11881 (11th Cir. Oct. 14, 2026), is the most significant post-Paxton appellate decision and the clearest statement of the state's position. Florida's HB3 reaches a platform only if users can upload or view content, at least 10 percent of daily users under 16 spend an average of two hours a day there, it uses algorithms to select content, and it has one of five named features: infinite scrolling, push notifications, displayed reaction metrics, auto-play, or live-streaming. Under-14s cannot hold accounts. Fourteen- and fifteen-year-olds need parental consent. The only exception in the coverage definition concerns services whose exclusive function is email or direct messaging.

Judge Newsom's analysis runs in three steps. First, the First Amendment applies, because blocking a platform from having a user burdens its curation under Moody. Second, the law is content neutral: it regulates function, "Truth Social is just as likely as Instagram to be affected," and neither a platform nor a user can avoid it by changing what is said. The court borrowed that last test from TikTok Inc. v. Garland, 604 U.S. 56 (2025). Third, HB3 passes intermediate scrutiny because it is age-delimited, limits account creation rather than access, reaches only heavily used platforms, and works as a conditional ban a platform can escape by dropping the features.

The court then goes straight at the Paxton question. CCIA argued that Paxton concerned speech unprotected for minors, while HB3 restricts protected speech. The answer: "Free Speech Coalition didn't purport to establish a constitutional outer limit," and nothing in its reasoning prevents an age-verification requirement that limits minors' access to some protected speech, so long as it is content neutral. The panel also disposes of McCullen v. Coakley, 573 U.S. 464 (2014), which can be read to demand something like a least-restrictive-means showing, by saying Paxton is more recent and more on point.

One may fairly ask whether that reads footnote 12 too lightly. Paxton said the ban-burden distinction is immaterial for fully protected speech, and its doctrinal route ran through the partially protected category, not through content neutrality. The Eleventh Circuit's route is different: it does not need the Paxton incidental-burden theory, because it reaches intermediate scrutiny by finding neutrality under TikTok instead. It uses Paxton for tailoring and for the general normality of age checks. Whether that is a fair extension or an evasion is the question the Supreme Court will most likely have to answer. A Harvard Law Review Note, Content Neutrality for Kids: Intermediate Scrutiny for Social Media Age-Verification Laws, 139 Harv. L. Rev. 942 (2026), argued before these decisions that states could reach intermediate scrutiny by regulating platform features and avoiding content-based exemptions, which is close to the road Florida took.

Judge Newsom's separate concurrence flags another fuse. West Virginia v. B.P.J., 146 S. Ct. 2356 (2026), an equal protection case about school sports, said that as-applied challenges are not entertained under intermediate scrutiny or rational basis review. If that carried over to the First Amendment, the as-applied route that Moody points everyone toward would close for any content-neutral law. Newsom doubts the Court meant that, but he thought it worth saying aloud.

Answer four: it is commerce

Students Engaged in Advancing Texas v. Paxton, No. 25-51073 (5th Cir. June 4, 2026), a published order staying universal preliminary injunctions against the Texas App Store Accountability Act, offers a fourth route. The panel held Texas likely to succeed because, at most, the Act regulates speech proposing a commercial transaction, reviewed under Central Hudson Gas & Electric Corp. v. Public Service Commission, 447 U.S. 557 (1980). App listings propose transactions "regardless of whether any monetary payment is made," since the price of a free app is user data. The same theme runs through account-creation cases. Ohio defended its Act as regulating contracts with minors, and Judge Clay saw nothing less than compelling in that interest. Judge Newsom called account creation "a commercial act." Judge Gerrard in Nebraska, faced with the same argument, treated account creation as expressive activity and applied strict scrutiny.

The real hinge: exemptions

Read side by side, these opinions reveal something that does not appear in any syllabus. What sorts the content-neutral laws from the content-based ones is mostly the drafting of the exemptions.

An irony is built in. The exemptions that make a statute easier to live with for small publishers are the ones that make it easier to strike. Legislators who want their law to survive now have reason to remove carve-outs for news comments and career sites, which pushes coverage toward the sort of operator this article opened with. Florida solved the problem differently, with a usage threshold and a feature test that a small blog will never meet, and that is why a function-based definition is probably the model to watch.

Other doors that closed or opened

Who can sue. NetChoice's associational standing is widely accepted, including by the Eleventh Circuit twice, but the Ninth Circuit held in NetChoice, LLC v. Bonta, 152 F.4th 1002 (9th Cir. 2025), that an as-applied challenge to personalized-feed rules needs individual platforms, since each algorithm differs. The Eleventh Circuit distinguished that decision. Indirect plaintiffs are in worse shape: in Computer & Communications Industry Ass'n v. Paxton, 184 F.4th 420 (5th Cir. 2026), students, a man who posts about mental health, and an advertising firm lacked standing to challenge H.B. 18's filtering and advertising provisions, since the statute regulated platforms and not them.

Who is bound. After Trump v. CASA, Inc., 606 U.S. 831 (2025), universal injunctions are suspect, and the Fifth Circuit relied on CASA in the SB 2420 stay. Judge Ritz, though dissenting in Ohio, would also have narrowed relief to NetChoice and its members and users.

Whether a federal forum remains. Florida sued Snap in state court under HB3. In Attorney General of Florida v. Snap Inc., No. 25-12814 (11th Cir. Oct. 14, 2026), an unpublished per curiam opinion, the Eleventh Circuit held that the district court lacked subject matter jurisdiction over Snap's removal, and in the companion case it held that the enforcement action did not trigger abstention under Younger v. Harris, 401 U.S. 37 (1971) because the federal suit had already passed the embryonic stage. Those two together mean a defendant's choice of timing matters enormously.

Whether compliance costs count. In Skrmetti, the Sixth Circuit held that unrecoverable compliance costs and chilled speech are the right kinds of irreparable harm and vacated a denial of a preliminary injunction against Tennessee's law. Judge Clay dissented, finding the declarations too vague, and pointing out that Nextdoor and Dreamwidth's choice to exclude minors contradicted their claims of crushing cost. Anyone preparing such a declaration should read his dissent first.

Design codes and addictive feeds

California's Age-Appropriate Design Code has now been through the Ninth Circuit twice. In NetChoice, LLC v. Bonta, 113 F.4th 1101 (9th Cir. 2024), the court affirmed an injunction against the requirement that businesses write data protection impact assessments opining on whether their services could harm children and mitigate those risks, because that compelled speech about content. The 2026 decision then addressed what was left:

• The coverage definition survived a facial attack on the record presented.
• The requirement to "[e]stimate the age of child users with a reasonable level of certainty appropriate to the risks" or else apply child-level protections to everyone also survived. The court was not persuaded that this requirement necessarily burdens expression at all, because a business can skip estimation entirely by defaulting everyone to protective settings. It read Paxton as saying nothing about estimation where age is not a precondition to access.
• The data-use provisions and the dark patterns restriction were enjoined for vagueness. "Material detriment" and "best interests of children" cannot be applied prospectively, across every child, with any fair notice. As one illustration the panel asks what happens with sleep loss, distraction, or hurt feelings.

That last point should give every drafter pause. A family-law standard made for one child on one record does not scale to a product used by millions, and the panel said so.

California's SB 976 bars "addictive feeds," meaning feeds of user-generated media selected using information associated with the user, for minors without parental consent. The Ninth Circuit's 2025 decision left most of it standing and reversed only as to the provision hiding like counts by default, which it found content based and not the least restrictive option. It upheld the private-mode default. It held the age-assurance challenge unripe, since the obligation begins January 1, 2027, and the regulations did not exist. The California Department of Justice released proposed regulations on May 14, 2026, available on its SB 976 page, so that ripeness obstacle is disappearing. On expressive algorithms, the court, quoting a footnote in Moody, drew a line the rest of the country is now using: an algorithm carrying human editorial direction is likely expressive, while one that responds "solely to how users act online," merely giving them what they appear to want, "probably is not."

New York's SAFE for Kids Act, N.Y. Gen. Bus. Law §§ 1500 to 1508, takes effect January 25, 2027, following the Attorney General's final rules, released July 28, 2026, at 13 NYCRR Part 700. Section 1501 forbids addictive feeds to a user unless the operator has used commercially reasonable and technically feasible methods to determine the user is not a minor or has verifiable parental consent, and the statute demands at least one method that either does not rely solely on government ID or lets the user stay anonymous to the operator. Section 1502 bans overnight notifications without consent. Civil penalties reach $5,000 per violation, and no private right appears. The Attorney General describes rules requiring deletion or de-identification immediately after use and annual testing of methods. New York's design, regulating a feature and leaving the rest of the platform open, is built to look like the Florida and California models and not like an account ban, and § 1504 forbids degrading service for a user denied the feed.

Maryland's Kids Code is the subject of a NetChoice challenge that survived the state's motion to dismiss in NetChoice v. Brown, No. 1:25-cv-00322 (D. Md. Nov. 24, 2025), and that case is in discovery. Colorado's attempt to require warnings to minors about health effects was preliminarily enjoined as compelled speech in NetChoice v. Weiser, No. 1:25-cv-02538 (D. Colo. Nov. 6, 2025). Arkansas's Act 901, which bars designs a platform should know cause addiction and creates a parent's damages action, was preliminarily enjoined as to NetChoice's members in NetChoice v. Griffin, No. 5:25-cv-05140 (W.D. Ark. Dec. 15, 2025).

App stores and operating systems: moving the gate

The newest idea shifts the check from each website to a single choke point in the phone. Texas's SB 2420, codified at Tex. Bus. & Com. Code ch. 121, requires app stores to verify a user's age category using commercially reasonable methods, tie minors to parent accounts, get parental consent to downloads and purchases, and pass age category and consent status to developers. Developers assign age ratings, notify stores of significant changes, and use the data only for permitted purposes. A developer is protected on ratings if it uses widely adopted industry standards consistently and in good faith.

The district court enjoined the Act under strict scrutiny in December 2025. The Fifth Circuit stayed the injunction, as described above, the Supreme Court declined in July 2026 to disturb the stay, and public trackers report that the merits appeal was argued the following month. Meanwhile:

• Utah amended its act in 2026, delaying key duties to May 6, 2027, removing Attorney General enforcement, and leaving private suits by parents of a harmed child for the greater of actual damages or $1,000 per violation, plus costs. The trade association withdrew its challenge after the amendments. Enforcement solely through private action, as explained below, is not a detail.
• Louisiana repealed and reenacted its act through HB 977, moving the effective date to July 1, 2027.
• Alabama enacted HB 161 in February 2026, reported to take effect January 1, 2027.
• California's AB 1043, the Digital Age Assurance Act, effective January 1, 2027, requires operating system providers to collect an age signal at account setup and send it to apps, and it is enforced only by the Attorney General, with penalties up to $2,500 per affected child for negligent violations and $7,500 for intentional ones.
• Congress has the App Store Accountability Act, S. 1586, and its House counterpart, H.R. 3149, alongside the Kids Online Safety Act and COPPA 2.0. The House Energy and Commerce Committee reported H.R. 3149 in March 2026, the Senate passed a version of COPPA 2.0 (S. 836) in March 2026, and the House passed a broader package, the KIDS Act (H.R. 7757), on June 29, 2026, according to public reports and the House Clerk's roll call. None is law. A federal statute with preemptive force would rewrite this whole article.

For app developers, the system-level effect is that you may receive an age signal you did not ask for. That has consequences, as the COPPA discussion below shows. The older baseline in Legal Issues for Mobile Applications: Privacy still applies underneath.

What age assurance technology actually does

Age assurance is the umbrella term for three different operations, a taxonomy that both the FTC and New York's rules now use: verification (checking a credential), estimation (a statistical guess from a physical trait), and inference (a statistical guess from behavior or account data).

A few points worth understanding at the level of mechanism.

Estimation has margins. The National Institute of Standards and Technology evaluates these models in its Face Analysis Technology Evaluation for age estimation and reports mean absolute error, the average gap between estimated and actual age. Results vary with the algorithm, dataset, age, and demographic group. A model that is excellent on average can still be useless for telling 17 from 18 without a buffer. So real deployments use a challenge threshold: if the estimate is well above the line, pass; if near it, fall back to a document. The fallback is where the sensitive data returns.

Liveness detection matters. Without it, a child can hold up a photo of an adult. With it, you are processing video of a face.

Deletion is a promise that has to survive the appeal path. Automated flows can discard images in seconds. But when automation fails, a human reviews them, and that is usually a customer support system with long retention and many logins. In 2025, Discord disclosed that about 70,000 users may have had government ID photos exposed through a third-party customer service vendor handling age-related appeals. On Discord's account, the core verification flow was not the failure. The appeal queue was. The Court's confidence in Paxton that vendors have "every incentive" to protect users did not contemplate the support desk.

Geography is a guess. Every state statute depends on knowing where the user is, and IP geolocation is the usual tool. A VPN defeats it. Utah tried to solve this by amending its adult-content law to cover anyone "actually located" in the state, whatever disguise they use. In Aylo Freesites Ltd v. Utah Division of Consumer Protection, No. 2:26-cv-00340 (D. Utah Sept. 24, 2026), the court enjoined that amendment. Everyone agreed perfect geolocation is impossible. The court read the text as requiring a site to geolocate "with perfection" to avoid liability, and the plaintiff, about 86 percent of whose visitors were believed to be outside the United States, said the only safe course was to verify everyone everywhere. The court rejected the due process extraterritoriality theory, but found a likely dormant Commerce Clause violation, both because the clause would directly regulate wholly out-of-state conduct and under Pike balancing, despite the narrow space left after National Pork Producers Council v. Ross, 598 U.S. 356 (2023). Utah had argued for a reasonableness standard, and the plaintiff said that if the statute were written that way, it would not have sued. The court replied that "the statute says nothing about reasonableness in geolocation efforts." Contrast New York's § 1507, which treats conduct as wholly outside the state if the user is physically located elsewhere. Physical location language will be tested again.

Privacy and biometric consequences

Illinois. The Biometric Information Privacy Act requires written notice and a written release before collecting a biometric identifier, and it gives a private right of action without proof of actual harm under Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186. The statute covers a scan of face geometry. Whether age estimation produces one depends on the implementation. Zellmer v. Meta Platforms, Inc., 104 F.4th 1117 (9th Cir. 2024), held that face signatures that cannot identify a person are not biometric identifiers, which helps a design that returns only an age band and keeps nothing. No appellate court we found has applied that reasoning to age estimation specifically, and Illinois courts are not bound by it. Vendors will tell you their product is not biometric. Your contract should make them prove it and pay if they are wrong. See Biometric Privacy Litigation: BIPA, Rosenbach, Cothron, the 2024 Amendment, and the Laws Following Illinois.

Texas. Tex. Bus. & Com. Code § 503.001 requires notice and consent before capturing a biometric identifier for a commercial purpose, with enforcement by the attorney general. So the same state that may demand a check can penalize a careless way of doing it.

Retention bans. Many age-verification statutes forbid keeping what was collected. Tennessee's act, for example, bars both the company and third parties from retaining personally identifying information used to verify age or consent. Data Minimization and Avoiding the Over-Retention of Personal Information describes the general discipline. Under these laws, "we keep it for fraud review" can be a violation by itself.

State consumer privacy laws. These treat biometric data and children's data as sensitive, with their own consent rules. Their overlap with age assurance is covered in State Consumer Privacy Laws: The CCPA, the CPRA, and the Multi-State Patchwork.

COPPA after the 2025 amendments

The FTC's amended COPPA Rule, 16 C.F.R. Part 312, published at 90 Fed. Reg. 16918 (Apr. 22, 2025), took effect in June 2025, with a compliance date of April 22, 2026, for most provisions. The changes that matter here:

• Biometric identifiers are personal information, including facial templates, faceprints, voiceprints, and gait patterns.
• A mixed audience category is codified. A service directed to children, but not primarily, may screen for age first and treat only identified children as children. The age screen must be neutral: it cannot default to a set age or encourage falsification.
• The list of consent methods now includes text-plus (a text message with additional steps, for operators that do not disclose children's data), knowledge-based authentication, and ID matched to a face with deletion afterward.
• Separate consent is needed for disclosure to third parties unless integral to the service.
• A written security program and a written retention policy are required under §§ 312.8 and 312.10, and children's data may not be kept indefinitely.

COPPA liability includes FTC civil penalties, which the agency's published guidance puts at up to $53,088 per violation, and state attorneys general may sue under 15 U.S.C. § 6504. There is no private right of action, but Jones v. Google LLC, 73 F.4th 636 (9th Cir. 2023), holds that COPPA does not preempt state-law claims based on conduct that also violates its rule, since 15 U.S.C. § 6502(d) reaches only inconsistent state liability.

The knowledge paradox

Before state age laws, a general audience site had a comfortable position: it did not ask, so it did not know, so COPPA did not attach. A state mandate breaks that. If you run a check that returns "11," the FTC has told you in plain terms that you now have actual knowledge. And a state law aimed at teens may force you to learn about children.

There was a further puzzle. The check itself might collect personal information from a child before any parental consent, which is a COPPA violation in the abstract. The FTC addressed that in its Enforcement Policy Statement Promoting the Adoption of Age-Verification Technology of February 25, 2026. The agency will not bring a COPPA action against general audience and mixed audience operators that collect information solely to determine age without first getting consent, provided they use it for nothing else, get written assurances from third parties, delete it promptly, disclose it in the privacy policy, secure it, and take reasonable steps to ensure the method is reasonably accurate, and provided they comply with the Rule in every other respect. The statement creates no rights, lasts until the FTC finishes a further rulemaking or withdraws it, and does not bind a state attorney general or a private plaintiff. It also has nothing to say about Illinois.

Section 230 and the product-design route

47 U.S.C. § 230 was enacted as part of the same statute struck in Reno, a history the Paxton majority recounts in a footnote. It bars treating a provider as the publisher or speaker of third-party content and preempts inconsistent state liability. How it interacts with minors' laws can be captured in a sentence the Fifth Circuit has now used twice: "publishers do not filter audiences; they filter content."

Age verification is not preempted. The Fifth Circuit so held in the Free Speech Coalition opinion below, 95 F.4th 263, on the theory that the duty applies regardless of whether third-party speech harms anyone.

Filtering mandates are. In CCIA v. Paxton, the same court held that H.B. 18's requirement to implement a strategy preventing known minors' exposure to content promoting suicide, self-harm, substance abuse, and the like is "squarely preempted." It applied the duty test from A.B. v. Salesforce, Inc., 123 F.4th 788 (5th Cir. 2024), asking whether the duty necessarily requires monitoring, altering, or removing third-party content. Texas's theory that a statutory duty differs from a tort failed, and the court noted that the contrary reading would let states re-encode preempted torts as statutes. It also conceded that this result may raise concern about Section 230 acting as a "get-out-of-jail free card."

Data and ad rules are not. The Eleventh Circuit in the Georgia case held that § 230 does not preempt a ban on using minors' personal information to target ads, because the provision "regulates how social-media platforms themselves act." A Utah court reached the same conclusion for autoplay, endless pagination, and notifications in NetChoice LLC v. Reyes, No. 2:23-cv-00911 (D. Utah July 22, 2024).

Design claims divide the courts. The foundation is Lemmon v. Snap, Inc., 995 F.3d 1085 (9th Cir. 2021). The parents of two of the three boys who died in a high-speed crash sued Snap, alleging that Snapchat's speed filter and reward system amounted to negligent design. Section 230 did not apply, because the duty to design a reasonably safe product is independent of any publishing role. But the limits were quickly drawn:

• Estate of Bride v. Yolo Technologies, Inc., 112 F.4th 1168 (9th Cir. 2024): an anonymous app's design claims were barred, while claims that it broke its promise to unmask abusers survived.
• Doe v. Grindr Inc., 128 F.4th 1148 (9th Cir. 2025): claims by an underage user that an app's design matched him with adults were barred.
• Anderson v. TikTok, Inc., 116 F.4th 180 (3d Cir. 2024): because Moody makes curation the platform's own expression, a claim based on the algorithm's recommendation of a deadly challenge video escapes § 230. The Fifth Circuit in CCIA v. Paxton called the premise of Anderson flawed.
• Patterson v. Meta Platforms, Inc., 2025 NY Slip Op 04385 (App. Div. 4th Dep't July 25, 2025): a divided court dismissed claims arising from the Buffalo shooting, refusing to let plaintiffs recast publishers as product designers.
• Commonwealth v. Meta Platforms, Inc., No. SJC-13747 (Mass. Apr. 10, 2026): the Massachusetts high court held § 230 did not bar a state claim that Instagram was designed to induce compulsive use by children, or that Meta misled the public about safety. The harm there came from Meta's own conduct, not from published content. The opinion also distinguishes claims that age-verification failures allowed particular harmful communications from claims that weak age checks exposed children to the design features themselves.

Trial results have started to follow. In March 2026, a Los Angeles jury found Meta and YouTube negligent in a bellwether case and awarded $6 million, including punitive damages, according to press accounts, and a New Mexico jury in the state Attorney General's case returned a civil penalty verdict against Meta reported at $375 million. Those verdicts are not final. They do show that age checks are becoming evidence in tort cases: the Massachusetts complaint treats defective age verification as part of the unfair practice. A company that has weak age checks and internal knowledge of underage use has given a plaintiff a theme. For the broader map of the statute, see Section 230 and Platform Liability: What the Statute Actually Says and Where It Stops, and for the tort background, Product Liability for Manufacturers, Distributors, and Sellers.

Who comes after you

Attorneys general. This is the default enforcer. Florida sought up to $50,000 per violation against Snap. Ohio's Act runs from $1,000 per day to $10,000 per day as noncompliance continues, with a cure period only for those already in substantial compliance. Tennessee allows up to $1,000 per violation and, remarkably, revocation of a business license. Texas has reached paid settlements with adult-site operators, including a reported $675,000 with the operator of one large site, and attorneys general in Texas, Florida, Indiana, and Ohio have sued or warned others. New York allows disgorgement and destruction of unlawfully obtained data. Attorneys general have found jurisdiction easy to establish, as in State v. Meta Platforms, Inc., 2025 VT 51, where Vermont's high court found specific jurisdiction over Meta. See also Personal Jurisdiction Over Online and Foreign Defendants: From Zippo to Ford Motor.

Private plaintiffs. Several laws use private suits, sometimes as the only means:

• Utah's adult-content law, in its original form, was enforced through private suits, and that is why a pre-enforcement challenge failed in Free Speech Coalition v. Anderson, 119 F.4th 732 (10th Cir. 2024): the state officials sued did not enforce the Act, so Ex parte Young did not apply.
• Utah's app store act now relies on private suits by parents.
• Texas's H.B. 18 lets parents seek declaratory or injunctive relief.
• Arkansas's Act 901 offers a parent's damages action, though it is enjoined for NetChoice's members.

Private enforcement is the most important structural trick in this field. If there is no state official to enjoin, there may be no one to sue before you are sued, and you are left defending the statute's validity piecemeal in hostile courts.

The FTC. The agency enforces COPPA and treats unfair or deceptive age-related claims under 15 U.S.C. § 45. If your privacy policy says you delete ID images within 24 hours and your support vendor keeps them for a year, the problem is older than any of these statutes. Privacy Policies, Notices, and Consent: Drafting Disclosures That Are True and Survive the FTC addresses that risk.

Where the main laws stand

Treat this table as a starting point for your own docket check. Positions in this area have changed within weeks.

Two worked examples

The lathe blog

Back in Duluth. Suppose our machinist's blog runs on standard software, allows comments with a name and email, has no follower graph, no feed, no ads targeted by personal data, and no sexual content. He has readers in every state.

• Adult-content laws: Out. Nothing close to the fraction.
• Florida: Out. There is no 10 percent, two-hour teen audience, no selection algorithm.
• Ohio: The Act requires all four features together: social interaction, a profile for signing in, a list of connections, and posting. A guest comment form lacks a profile and a connection list. He also likely falls outside the test for a service that "targets" or is "reasonably anticipated to be accessed by" children, though that is a factor analysis. The news-outlet exemption does not help him since he is not an established media outlet, but he does not need it.
• Tennessee: This is the one to read twice. A platform "[a]llows a person to create an account" and "[e]nables an account holder to communicate with other account holders and users through posts." If he adds registered accounts with public profile pages because his plugin offers it, he has moved in that direction.
• COPPA: A lathe blog is not directed to children, and without actual knowledge the Rule does not attach. If a commenter says "I am 11 and my grandpa has a lathe," he should remove the post and the associated data.

So the answer to his reader is no. But the answer depends on architecture, and a small software update could change it. Before adding member profiles and friend lists, he should check again. Comment moderation basics are in the Platform Content Moderation Checklist: A Practical Checklist.

The homework community

Suppose instead that a Spokane startup we will call Quillbright runs an app where high school students post questions and upvote answers, with profiles, follows, a personalized feed, push notifications, and $3 million in annual revenue.

• Florida: It meets the feature list. The 10 percent, two-hour test probably decides coverage, so it needs that metric before launch.
• New York and California: The personalized feed of user-generated media looks like an addictive feed, unless it is rebuilt around what a user has expressly subscribed to, which New York's definition excepts and California's list of exceptions should be checked against. A design change may be cheaper than verification.
• Ohio, Tennessee, Georgia: Likely covered, with possible educational carve-outs to analyze. Georgia exempts services used by or under the direction of an educational entity, which does not describe an app students download themselves.
• COPPA: A homework app aimed at teens might still be directed in part to under-13s. Marketing to middle schools would change that analysis.
• Texas: H.B. 18 exempts small businesses, so its size may matter there. SB 2420 still applies, and it will receive age category data it may use only for permitted purposes.
• Vendor risk: A startup using a third-party verifier inherits the vendor's breach exposure, and it needs a contract that reflects that.

The company's lawyer might sensibly tell it to do three things. First, cut the feed down to explicit follows for known minors nationwide, which takes it out of two of the laws. Second, use a single estimation vendor with a document fallback for states that remain. Third, review every assertion in the privacy policy. It is also not a NetChoice member, so any injunction limited to members does not cover it. Our companion Deciding Whether Your Website or App Must Verify Age: A Practical Guide walks through this sequence. Working papers are in the Minors Online Toolkit: Applicability Matrices, Age Assurance Vendor Terms, and Parental Consent Flows, and the Minors Online Compliance Checklist: A Practical Checklist is the version to keep on the desk.

What remains unsettled

1. Does Paxton apply beyond speech obscene to minors? Kavanaugh's "cf." and footnote 12 suggest limits. The Eleventh Circuit sees no limit if the law is content neutral.
2. What makes a minors' law content based? The answer currently depends on exemptions, and the courts are not consistent about whether a single one is fatal.
3. Is account creation commerce? Opinions in the Fifth, Sixth, and Eleventh Circuits have leaned that way. The answer changes the scrutiny.
4. Does B.P.J. eliminate as-applied challenges under intermediate scrutiny? If so, Moody and B.P.J. together would leave challengers with very little.
5. Can NetChoice assert minors' rights? The Fifth and Sixth Circuits disagree.
6. Are algorithmic feeds expressive? Moody left that partly open and the Ninth Circuit's distinction will be tested platform by platform.
7. What does § 230 do with design claims? Federal circuits and state high courts are moving in different directions.
8. Will Congress preempt? Bills are pending and their preemption language would matter more than almost anything above.
9. Does face estimation trigger biometric statutes? There is little authority directly on point.

With the Fifth, Sixth, and Eleventh Circuits, plus the Fourth, Eighth, and Tenth still to come, a petition for certiorari in at least one of these cases seems likely. NetChoice has already obtained an extension, to December 3, 2026, to petition in the Ohio case (No. 26A557). We found no grant in a social media age-verification case. The question of what a state can require of a general audience website has been answered only for pornography, and everything else in this article is what the country is doing in the meantime.

This article describes the law generally and cannot tell you what your site must do, which depends on your facts and the states you serve. If you are weighing a build-versus-block decision or have received an attorney general's letter, MC Law can help you read the statutes against your actual architecture. Primary sources for the cases above are searchable on UpLaw.

Related Documents

Related Articles

• Children's Privacy Under COPPA and the Age-Appropriate Design Codes: the COPPA baseline in more detail.
• Section 230 and Platform Liability: What the Statute Actually Says and Where It Stops: the statute that shapes the design-claim fight.
• Biometric Privacy Litigation: BIPA, Rosenbach, Cothron, the 2024 Amendment, and the Laws Following Illinois: what happens when face scans go wrong.
• State Consumer Privacy Laws: The CCPA, the CPRA, and the Multi-State Patchwork: sensitive-data consent rules.
• The Video Privacy Protection Act in the Age of Pixels: Who Is a Consumer and What Counts as Personally Identifiable: another privacy exposure for sites with video feeds.
• Data Breach Class Actions: Article III Standing, Negligence Claims, and Forensic Report Privilege: the litigation that follows if ID images leak.
• Personal Jurisdiction Over Online and Foreign Defendants: From Zippo to Ford Motor: why a state's reach extends to your server.

Related Guides

• Deciding Whether Your Website or App Must Verify Age: A Practical Guide: the decision sequence for operators.
• Data Minimization and Avoiding the Over-Retention of Personal Information: retention discipline for verification data.
• Legal Issues for Mobile Applications: Privacy: baseline app privacy duties.

Related Checklists

• Minors Online Compliance Checklist: A Practical Checklist: the desk version.
• Platform Content Moderation Checklist: A Practical Checklist: moderation process for user content.

Related Toolkits

• Minors Online Toolkit: Applicability Matrices, Age Assurance Vendor Terms, and Parental Consent Flows: templates and worksheets for this topic.
• Children's and Student Privacy Toolkit: COPPA, FERPA, and Age-Appropriate Design: working papers for COPPA and school contexts.