Deciding Whether Your Website or App Must Verify Age: A Practical Guide

The email arrives on a Tuesday. Your largest investor forwarded a news story about a state law and added one line: "Are we covered?" Your engineer says the fix is a birthdate field. Your privacy counsel says a birthdate field may be worse than nothing. Your vendor's salesperson says their face scan solves everything and is not biometric. The founder wants to know whether you can just block the state.

Each of them is partly right. Whether you must verify age is a sequence of smaller questions, and the order matters, because an early answer can make the later ones disappear. A feature change can take you out of a statute. An injunction may or may not cover you. A verification vendor can create more legal exposure than the law you hired it to satisfy. This guide runs the sequence. For the doctrine behind it, including how courts have split since Free Speech Coalition v. Paxton, read the companion article, Age Verification and Minors Online After Free Speech Coalition v. Paxton: What States Can Require of Websites and Apps.

The short answer

• Start with your features, not your size. Most social media statutes turn on accounts, profiles, connections, feeds, or engagement design. Revenue thresholds are the exception. A two-person site can be covered, and a large publisher with comments may not be.
• Adult content has a hard rule. If more than the statutory share of your site is sexual material harmful to minors, verification is required in most states that have passed such a law, and Free Speech Coalition, Inc. v. Paxton, 606 U.S. 461 (2025) means a First Amendment defense is unlikely.
• "Blocked" does not mean blocked for you. Read the injunction. Many protect only the plaintiff's members. Several have been vacated or stayed on appeal.
• You usually have four choices, and verifying is often the last one to consider. You can change the feature, exclude minors, stop serving the state, or verify. Each has a cost and each creates its own record.
• A birthdate field is not nothing. Self-declaration does not satisfy any statute that demands verification, and regulators increasingly disfavor it. It may still give you actual knowledge of a child's age, which is what triggers COPPA.
• Collect the least data you can, for the shortest time, through the fewest systems. Your appeal queue and customer support tools are where verification data tends to leak. Biometric and retention rules apply no matter which state's age law you were trying to satisfy.
• Keep the decision memo. If an attorney general calls, your best evidence is a dated record showing what you looked at, what you decided, and why.

Step 1: Map what the product actually does

Who: product lead and counsel. When: before anything else, usually a few days.

Do not start from the marketing description. Regulators and courts read these statutes against function, so write down the function. For each site or app, answer these in writing:

1. Can users create accounts? What does the account include?
2. Can users post content others can see? Is it comments on your content, or posts in their own right?
3. Do users have public or semi-public profiles?
4. Can users connect, follow, or friend one another?
5. Is any feed selected or ordered using information about the user or their device?
6. Do you use infinite scroll, push notifications, displayed like or reaction counts, autoplay, or live-streaming?
7. Can users message each other? Is that all they can do?
8. What share of content is sexually explicit, by any measure you can defend?
9. Do you know, or could a regulator show, that minors use the product? What do your analytics, ad-targeting settings, support tickets, and marketing say?
10. Are you distributed through Apple's or Google's app store?
11. Where are your users? What share come from each state? How do you know?
12. Are you a member of NetChoice or the Computer & Communications Industry Association?

Question 9 deserves a warning. NetChoice, LLC v. Yost, 180 F.4th 268 (6th Cir. 2026), reproduces Ohio's optional list of factors for deciding whether a site "targets" or is reasonably anticipated to be accessed by children: subject matter, language, design elements, visual content, animated characters, music, age of models, child celebrities, advertisements, empirical evidence of audience, and evidence of intended audience. A pitch deck claiming to reach "Gen Alpha" is evidence.

Technical teams should take a look at third-party scripts as well. Age-relevant knowledge often lives in an ad platform's audience settings, not in your database. Auditing Your Website Tracking Stack: A Practical Guide explains how to inventory those tags.

Step 2: Run the five coverage tests

Test A: Are you an adult-content site?

Texas's statute, the model for most others, covers a commercial entity that knowingly and intentionally publishes or distributes material on a website, "more than one-third of which is sexual material harmful to minors." Under the statute as described in Free Speech Coalition, such material must appeal to prurient interest with respect to minors, be patently offensive with respect to minors, and lack serious literary, artistic, political, or scientific value for minors. The Court said it "cannot conceivably" reach a PG-13 or R-rated movie.

Three practical points follow.

The statute does not say one-third of what. Items, pages, bytes, minutes, or views could each produce a different number. Neither the statute's text as quoted nor the Court's opinion resolves it. Choose a method, write down why, measure it on a schedule, and consider more than one metric. If you are close under any plausible measure, treat yourself as covered.

Other states' fractions and definitions differ. The Court listed at least 21 other states with materially similar laws, and more have followed. Check each one you serve. Don't assume Texas's language is everyone's.

Partial gating is an open question. The parties in Free Speech Coalition disputed whether a covered site can gate only its harmful material or must gate everything, and the Court declined to decide. A site that is covered should plan for the stricter answer unless local counsel says otherwise.

Test B: Are you a "social media platform"?

Definitions vary enough that you need a per-state analysis. Here are the ones that have been construed in appellate opinions.

The statutes' reach is often broader than the name suggests. Dreamwidth, a journaling site with no algorithmic sorting, is on NetChoice's list of covered members in Mississippi and Georgia. On the other hand, NetChoice v. Attorney General of Georgia, No. 25-12436 (11th Cir. Oct. 15, 2026), records that Georgia excludes a service that does not permit minors and uses commercially reasonable age assurance to deter them, which is a built-in reward for exclusion.

Comment sections. If your only interactive feature is comments on your own articles, read the news and publisher carve-outs carefully. Ohio's exception is limited to an "established and widely recognized media outlet," and it was one of the features that led two judges to call the Act content based. So a future amendment may remove it. A small blog is usually safe for a simpler reason: it lacks a profile and connection list.

Test C: Do you run an addictive feed?

California's SB 976 and New York's SAFE for Kids Act regulate a feed of user-generated media selected using information about the user or device. N.Y. Gen. Bus. Law § 1500 excepts, among others, recommendations based on non-persistent information, on privacy or accessibility settings, or on media the user expressly requested or subscribed to, and it covers platforms where such a feed is a "significant part" of the service. The Attorney General's July 2026 materials describe a 20 percent time-on-feed benchmark. California's coverage, discussed in NetChoice, LLC v. Bonta, 152 F.4th 1002 (9th Cir. 2025), includes any service that provides an addictive feed as a significant part of its service, whether or not it calls itself social media.

Your engineer can answer this faster than your lawyer can. Pull the ranking code. If a chronological feed from followed accounts is a realistic product, you may have an exit.

Test D: Are you "likely to be accessed by children"?

California's Age-Appropriate Design Code applies to businesses, in the sense used by California's consumer privacy statute, whose services are likely to be accessed by children under 18 based on enumerated indicators. Parts are enjoined. Key portions survive after NetChoice, LLC v. Bonta, 170 F.4th 744 (9th Cir. 2026), including the age estimation clause, which offers the alternative of treating all users as children. Maryland's Kids Code remains in litigation. If you meet the state's privacy-law business thresholds, run this test. For that coverage analysis, see State Consumer Privacy Laws: The CCPA, the CPRA, and the Multi-State Patchwork.

Test E: Are you an app?

If you distribute through an app store, Texas's SB 2420 reaches you as a developer. See Step 9.

The overlay: COPPA

COPPA applies regardless of the state tests if your service is directed to children under 13, or you have actual knowledge you are collecting from one. Run this analysis under the COPPA Rule, 16 C.F.R. Part 312, and treat 15 U.S.C. § 6502 as a separate workstream. The COPPA Children's Privacy Compliance Checklist: A Practical Checklist is a good companion.

Step 3: Find out whether the law applies to you today

Who: counsel. When: right after Step 2, then on a recurring schedule. This is a volatile field. A law you could ignore last month may be enforceable now.

Ask four questions of each law that reaches you.

Is it in effect? Check the effective date. New York's act takes effect January 25, 2027, and California's SB 976 age assurance duty begins January 1, 2027. Utah's app store duties were pushed to May 6, 2027, and Louisiana's to July 1, 2027.

Is it enjoined, and who does the order protect? This is the question most operators get wrong. Look at the decretal paragraph. In NetChoice v. Griffin, No. 5:25-cv-05140 (W.D. Ark. Dec. 15, 2025), the order runs against enforcing Act 901 "against NetChoice's members." NetChoice, LLC v. Fitch, No. 1:24-cv-00170 (S.D. Miss. June 18, 2025), named eight covered members. Since Trump v. CASA, Inc., 606 U.S. 831 (2025), expect narrower relief still.

Has the order survived appeal? Several have not. NetChoice v. Fitch, No. 25A97 (U.S. Aug. 14, 2025), left Mississippi's law enforceable while the appeal continued. Computer & Communications Industry Ass'n v. Attorney General of Florida, No. 25-11881 (11th Cir. Oct. 14, 2026), reversed as to Florida. A published order in Students Engaged in Advancing Texas v. Paxton, No. 25-51073 (5th Cir. June 4, 2026), stayed the app store injunction. Check whether a mandate has issued and whether rehearing is pending. In the Ohio case, for example, the Sixth Circuit denied rehearing en banc and then stayed its mandate pending a certiorari petition, so the district court's injunction has not yet been displaced.

Could you be sued anyway? If the law allows private suits, an injunction against an attorney general may not stop a parent from filing. Enforcement exposure for past conduct may also return if an injunction is later reversed. Ask counsel about that before you turn compliance off.

Keep the answers in a dated log. The applicability matrix in the Minors Online Toolkit: Applicability Matrices, Age Assurance Vendor Terms, and Parental Consent Flows has a format.

Step 4: Choose among four responses

Don't treat verification as the default. Decide among these options state by state or nationally, and write down the reasoning.

On cost, trust the real numbers in the record. Nextdoor's declaration in NetChoice, LLC v. Skrmetti, No. 25-5660 (6th Cir. Aug. 28, 2026), said processing identity documents for every new Tennessee user would greatly surpass its average revenue per user. That is why the math for a free, ad-supported service is usually brutal, and why both Nextdoor and Dreamwidth chose exclusion. Get vendor quotes, and calculate the check cost against your own revenue per user, including the cost of those who abandon the flow.

On exclusion, a line in your terms of service is weak evidence. California's proposed SB 976 rules are reported to treat general contractual age restrictions as unreasonable. Combine the term with a neutral age screen, a process for acting on reports of underage users, and a record of actually closing such accounts. Terms that bind minors raise their own problems, covered in Website Terms of Service and Online Contract Formation: Clickwrap, Browsewrap, and Enforceable Arbitration. Note also that Tennessee's act voids waivers of its protections regardless of contract or choice-of-law terms.

The geoblock decision

Blocking is attractive and leaky. The way it works: your edge network maps the requesting IP address to a location using a commercial database and denies service to those in the listed state. IP geolocation is reasonably good at state level but fails for VPNs, proxies, mobile carrier gateways, and some corporate networks.

What the law says about that leakage is still forming. In Aylo Freesites Ltd v. Utah Division of Consumer Protection, No. 2:26-cv-00340 (D. Utah Sept. 24, 2026), the plaintiff had blocked Utah IP addresses from its adult content. Utah then amended its law to cover anyone "actually located" there regardless of VPN use. The court enjoined that clause under the dormant Commerce Clause, finding that the text demanded geolocation perfection. It is a single preliminary ruling from one district. But the record is a useful manual: Utah's expert proposed detecting VPN use with a commercial service, estimating location from non-IP signals such as time zone and language settings, then asking the remaining users to share device location, verify age, or turn off the VPN. That is roughly what a state will call reasonable, and it could become the expected practice if a legislature rewrites the clause with a reasonableness standard.

Practical rules for a block:

• Block at the network edge and at account creation, and log the configuration and date.
• Tell users plainly, without suggesting a VPN. Instructions on evading your own block will be Exhibit A.
• Honor account location data you already have. If a user's billing address is in the blocked state, an IP check does not cure your knowledge.
• Revisit the block when an injunction issues or dissolves.
• Remember that a block does not erase past conduct or reach accounts created earlier. Decide what happens to existing users.

If you stop serving a state, also reconsider your ad campaigns, shipping, and customer contacts there. Those are the contacts that make a case for jurisdiction, as in State v. Meta Platforms, Inc., 2025 VT 51.

Step 5: If you verify, pick the method

Who: product, security, counsel. When: before you sign with a vendor. Every state's text limits your choice, and no single method fits every state.

How to choose. A tiered design usually works best: start with the least intrusive method likely to be accepted, then escalate only when needed. A typical flow is an age signal or estimate first, with document verification only for those near the line or those who fail. Under the FTC's Enforcement Policy Statement Promoting the Adoption of Age-Verification Technology, you should take reasonable steps to determine the method is likely to give reasonably accurate results. NIST publishes comparative results in its age estimation evaluation, which you can ask a vendor to map its model to.

Accuracy questions for the vendor:

• What is the error at your threshold age, not on average? Ask for 13, 16, and 18 separately.
• How does it vary by skin tone, gender, and age band? NIST reports demographic effects, and your state may care about unfair outcomes.
• What is your buffer? What happens at 17.5?
• What share of users fall to manual review?
• How do you detect spoofing, such as photos and injected video?

Fairness and access. Some adults lack ID, some have faces that models misjudge, and some will walk away rather than show a document. You need a path for them. The record in NetChoice, LLC v. Griffin, No. 5:23-cv-05105 (W.D. Ark. Mar. 31, 2025), and in the Free Speech Coalition dissent shows what challengers say about those lost users. If you are the one verifying, the same facts show up as lost revenue.

Step 6: Build the data handling before the flow

Who: security lead and counsel. When: in parallel with Step 5. Treat this as the part that will decide whether you end up in a lawsuit.

Draw the data flow on one page. For each of these, identify the system, owner, retention, and who has access: ID image, selfie or video, derived template, extracted birthdate, age result, verification token, consent record, appeal ticket, vendor logs, and analytics events.

Then apply these rules.

Keep the result, not the input. You usually need only "over 18: yes" and a date. Delete everything else, and verify deletion. Tennessee's act bars companies and third parties from retaining personally identifying information used to verify age or parental consent. New York's Attorney General describes rules requiring deletion or de-identification immediately after use. Texas's law penalizes retention separately.

Separate identity from activity. Use a vendor that returns a token with no link back to what the user is doing. This matters most for adult content, where the privacy harm of linking an identity to viewing is the point of the Free Speech Coalition dissent.

Close the side doors. Appeal queues, support tickets, screen recordings, session-replay tools, error logs, and analytics events are where IDs end up. The Discord incident disclosed in 2025 involved government ID photos held by a third-party support vendor reviewing age appeals. Don't let an agent ask users to email a license.

Don't reuse. The FTC's conditions, like New York's rule, prohibit using verification data for anything else. Do not feed it to ad targeting, fraud models, or product analytics. This includes a tempting one: using verified age to improve your inference model.

Run the biometric analysis. If any face or voice processing is involved:

• Determine what the vendor actually computes and stores. Zellmer v. Meta Platforms, Inc., 104 F.4th 1117 (9th Cir. 2024), helps a design where data cannot identify a person, but it is a federal reading of Illinois law and not the last word.
• Get a written release in Illinois-style form anyway. Under Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186, a bare statutory violation is enough to sue.
• Give notice and get consent for Texas under Tex. Bus. & Com. Code § 503.001.
• Publish a retention schedule.
• Remember that a minor's consent may not be effective, and that the COPPA Rule treats facial templates as personal information.

Our Biometric Privacy Toolkit: Retention Policies, Consent Forms, and Vendor Terms has forms you can adapt, and Defending or Bringing a Biometric Privacy Claim: A Practical Guide covers what follows if a claim arrives.

Plan for the breach. ID documents are the worst kind of data to lose. They typically trigger notification statutes, and they invite the class action described in Defending or Bringing a Data Breach Class Action: A Practical Guide. Decide now who calls whom, using Responding to a Data Breach: The First Seventy-Two Hours.

Sample language: age check notice

Why we are asking. [State] law requires us to confirm your age before you can [create an account / view this content]. You can confirm your age by [method 1] or [method 2].

What happens to your information. [Vendor] processes [your photo / your ID] for this check only. We receive only a result: if you are at least [18], yes or no. [Vendor] deletes your [photo / ID] [within X minutes] after the result, or [within X days] if you ask for a manual review. We do not use this information for advertising or for any other purpose.

If the result is wrong. You can [try another method] or [request review] here.

Make each statement literally true. If a human reviewer could see the ID, say so. An inaccurate retention statement is a deception claim under 15 U.S.C. § 45, and Estate of Bride v. Yolo Technologies, Inc., 112 F.4th 1168 (9th Cir. 2024), shows that broken safety promises can escape Section 230 even when design claims do not.

Sample language: privacy policy section

Age checks. Where the law requires it, we use [Vendor] to determine a user's age or age range. We collect [categories] for this purpose only. We share them only with [Vendor], which has agreed in writing to protect them, to use them for no other purpose, and to delete them promptly after the check. We keep [the result and date] for [period] so we can show that we complied and avoid asking again. [If you are under 13, see our Children's Privacy Notice.]

Sample language: biometric consent

[Vendor] will analyze a photo or short video of your face to estimate your age. This may involve measurements of your face. [Vendor] does not use it to identify you. It will be deleted [timeframe]. By selecting "I agree," you give written consent to this collection and use. If you do not agree, you can use [alternative method].

For the wider record-keeping discipline, see Data Minimization and Avoiding the Over-Retention of Personal Information. Vendor clauses are in the toolkit.

Step 7: Run parental consent as two systems

Under-13 consent and teen consent are separate legal regimes that look similar on a screen.

Under 13 (COPPA). You must give direct notice and obtain verifiable parental consent before collecting personal information, unless an exception applies. The Rule's listed methods include a signed form, payment card with transaction notice, staffed call or video, government ID checked with prompt deletion, knowledge-based questions, ID matched to a face with prompt deletion, and, for operators that do not disclose data, email-plus or text-plus. Separate consent is required for third-party disclosure unless it is integral to the service. Operators need a written security program and a written retention policy, and those rules are not optional for small operators. They scale, but they apply.

Teens (state laws). The requirements differ by state and are sometimes specific.

• Ohio requires listing the site's content moderation features for the parent, giving a link to review them later, and confirming consent by written mail or telephone, among listed methods.
• Tennessee defines "parent" to include a guardian or person with custody or caregiving authority, lets consent be revoked, and requires supervision tools including options to view privacy settings, set daily time limits, and schedule breaks.
• New York's statute at § 1503 does not require special parental access to accounts. Section 1504 bars degrading a minor's service because the feed is denied, and § 1506 calls for instructions in at least the twelve most common languages in the state. The Attorney General's description of the rules adds that the minor must initiate the request and agree to the parent being notified, and that the parent must pass age assurance.
• Nebraska's consent requirement is enjoined, but its provision letting parents view posts and messages may be enforced under NetChoice v. Hilgers, No. 4:26-CV-3149 (D. Neb. June 27, 2026).

Proving parenthood is the hard part. A verified adult is not necessarily this child's parent. Statutes rarely say how to confirm the relationship. Sensible steps:

• Require the parent to pass age assurance.
• Have the parent attest to the relationship under a clear statement.
• Send the confirmation to a contact not controlled by the child.
• Give a simple way to revoke.
• Plan for custody disputes: two parents who disagree, a parent subject to a court order, a foster placement.

Abused and LGBTQ minors are the population challengers most often raise, and your escalation path should account for a minor who says the parent is the danger. Have support staff route those matters to a trained reviewer.

Consent UX. Avoid anything that pushes a child to lie or a parent to click through. COPPA's rule on neutral age collection says it must not default to a set age or encourage falsification. If a user fails a birthdate check, don't let them try again immediately with a new date.

Sample language: parental notice for a teen

[Teen's display name] wants to use [feature] on [Service]. [State] law requires your consent.

What it does: [plain description of feed, messaging, or account]. What we collect from your teen: [categories]. Who sees it: [recipients]. Controls available to you: [list, with link]. To agree, confirm you are this teen's parent or legal guardian and complete [method]. You may withdraw consent any time at [link], and we will [stop the feature / close the account] within [period].

Consent flows for COPPA and teen laws should share evidence, not screens. Keep a record of who consented, by what method, when, to which version of the notice. A fuller flow is in the toolkit.

Step 8: Decide what a minor's account actually does

Once you know, or must assume, that a user is a minor, several requirements turn on.

Georgia's ad rule is a clean illustration. The Eleventh Circuit held it is not preempted by Section 230, since the platform can comply by not using minors' data, without touching content. A rule that regulates your own conduct will rarely find shelter in 47 U.S.C. § 230.

Mandated filtering is different. In Computer & Communications Industry Ass'n v. Paxton, 184 F.4th 420 (5th Cir. 2026), Texas's content-monitoring duty was held preempted. You still may choose to moderate voluntarily, under § 230(c)(2), but make sure your terms and public safety statements match what you actually do. The Platform Liability Toolkit: Terms of Service, Notice Procedures, and Litigation Defenses has language.

Design liability. Separately from any statute, a design choice may become a tort claim. Lemmon v. Snap, Inc., 995 F.3d 1085 (9th Cir. 2021), and Commonwealth v. Meta Platforms, Inc., No. SJC-13747 (Mass. Apr. 10, 2026), both rest on the premise that the duty runs from the operator's own design. So review minors' features before launch, record the safety reasoning, and be careful with internal documents. An employee message saying a feature "hooks teens" will be read to a jury. Don't overuse privilege, though. A business decision does not become privileged because a lawyer was on the email.

Vague standards. The Ninth Circuit enjoined California's "best interests of children" and "material detriment" tests as vague, but the Kids Codes in other states may use similar language. Even an unenforceable statute shows how a regulator or plaintiff thinks. Consider using the terms as design prompts in your review even where you do not treat them as binding, and see Dark Patterns, Auto-Renewal, and the FTC Click-to-Cancel Rule on manipulative flows.

Step 9: Handle app store and device signals

If you ship an app, assume you will soon receive age data whether you want it or not.

What Texas requires of developers. From the Fifth Circuit's discussion of Tex. Bus. & Com. Code ch. 121: app stores verify age and obtain consent, developers assign age ratings and content descriptions, developers notify stores before significant changes to terms or privacy policies (such as adding new monetization features or materially changing functionality), and a developer is protected from liability for an incorrect rating if it uses widely adopted industry standards consistently and in good faith.

What to build.

1. Read the current developer documentation from each store. Apple and Google each provide interfaces that return an age range or signal. Treat that documentation as an engineering requirement and revisit it.
2. Handle every signal state: adult, each minor band, parental consent granted, refused, or revoked, and signal unavailable.
3. Limit use. Store only what you need. Texas and Utah limit how age data may be used. Don't send it to analytics or ad partners.
4. Encrypt and delete. Texas's act refers to data minimization and industry-standard encryption for app stores, and practitioner summaries report that developer-held signals are similarly limited.
5. Add a release-gate question to every product launch: "Does this change terms, privacy, purchases, or functionality in a way requiring store notice and a fresh consent?"
6. Decide what your app does on web. A store signal does not bind a browser session.

The COPPA knock-on. A signal saying a user is under 13 is hard to distinguish from actual knowledge. If you run a general audience app that has never thought about COPPA, plan for what happens the first day an "under 13" signal arrives. Options include a child-safe mode, a parental consent flow, or a refusal, and each must be built before the signal arrives.

Timing by state. Texas is in force under the stay. Utah's operational duties begin May 6, 2027, with private suits as the enforcement route. Louisiana's act takes effect July 1, 2027, enforced by its attorney general. Its original text lacked the developer safe harbor Texas and Utah offer, and the 2026 reenactment is reported to have added one, so read the current version. Alabama enacted a version in 2026, reported to take effect January 1, 2027. California's AB 1043 sends age signals from operating systems beginning January 1, 2027. Federal bills, including S. 1586, remain pending. Build to the strictest state you serve and switch the rest with configuration.

Step 10: The small operator's path

If you are a blog, forum, small community, or hobby project, here is the cheapest route to a defensible position.

1. Use comments without accounts, or with accounts but no public profiles or friend lists. Each feature you remove narrows coverage.
2. Turn off anything you don't need. A recent-posts list sorted by time raises fewer questions than a personalized feed. Push notifications and infinite scroll count in Florida's list, though the usage threshold will likely exclude you.
3. Don't use targeted ads on a site with a meaningful teen audience. Contextual ads avoid several problems at once.
4. Don't market to children, and check what your content, images, and audience data suggest.
5. Act on knowledge. When someone reveals they are under 13, remove the content and data and record that you did. For the general moderation process, see Social Media Law Basics.
6. Check your host. If your forum software or a hosted community service offers accounts and profiles, you may be the "operator" for those features. Ask what it does in these states.
7. Write a one-page memo. List the features, the laws you considered, and the reason each does not apply. Date it. Update it when you add a feature.
8. Consider who could help. Trade association membership might bring you under an injunction, as many are limited to members. Check the order's terms: membership acquired later may or may not be covered.

For a commercial site with adult material, the small-operator shortcut doesn't exist, because the fraction test has nothing to do with size. Your choices are to verify, block, or remove enough material to fall below the line, and a site should not expect any sympathy for a calculation that looks gamed.

Step 11: If someone comes after you, or you want to go after the law

Operators responding to an attorney general

• Issue a hold, then check the demand's scope against the statute. Ohio's Attorney General can subpoena on "reason to believe" and can recover investigation costs if there is noncompliance.
• Check cure rights. Ohio's 90-day cure applies only to an operator already in "substantial compliance," a term the lead opinion called undefined. Don't assume you qualify.
• Think hard before removing. In Attorney General of Florida v. Snap Inc., No. 25-12814 (11th Cir. Oct. 14, 2026), the Eleventh Circuit ordered remand because federal jurisdiction was lacking, rejecting a federal officer theory based on advertising work for federal agencies and rejecting diversity because the state agency was the real party. Removal bought delay, not a federal forum.
• Preserve defenses. Section 230 may apply to filtering theories. The First Amendment may apply as applied to you. Vagueness depends on your facts, and in Georgia the court refused to credit a vagueness theory the plaintiff never pleaded.

Operators challenging a law

• Bring an as-applied claim. Plead facts about your service. Moody and the Georgia decision show facial claims fail without a census of applications. Moody v. NetChoice, LLC, 603 U.S. 707 (2024), is the first case the state will cite. The judgment in NetChoice v. Murrill, 812 F. Supp. 3d 594 (M.D. La. 2025), shows the alternative working: it rests on an as-applied ruling for ten named members.
• File early. In the Florida case, Younger abstention did not apply because federal proceedings had moved past the embryonic stage when the state sued. Had the state moved first, you might have been confined to state court under Younger v. Harris, 401 U.S. 37 (1971).
• Write specific declarations. Say what compliance would cost, per user, by when, and what you will have to do. Judge Clay's dissent in Skrmetti calls general statements too vague and notes that choosing to exclude minors may undercut a compliance-cost claim. The majority accepted the kinds of harm but sent the case back to weigh them.
• Identify the right defendant. In Free Speech Coalition v. Anderson, 119 F.4th 732 (10th Cir. 2024), a privately enforced statute left no state official to sue.
• Target the exemptions. Courts have found content discrimination in carve-outs. Plead exactly how the law's coverage depends on subject matter, or explain why a function-based law still fails tailoring.
• Expect discovery about you. Louisiana pressed for deposition testimony about NetChoice's members and membership tiers, and lost its motion to compel in NetChoice v. Murrill, No. 3:25-cv-00231 (M.D. La. Sept. 16, 2025). Maryland's case produced its own protective-order fight in NetChoice v. Brown, No. 1:25-cv-00322 (D. Md. Sept. 23, 2026). For the injunction mechanics, use the Preliminary Injunction and TRO Application Checklist: A Practical Checklist and Fed. R. Civ. P. 65.

Parents, advocates, and state lawyers

The same material reads differently from the other side. State counsel drafting or defending a law should look at Florida's function-based definition and avoid topical exemptions if the aim is intermediate scrutiny. A state that uses a "reasonable methods" standard is less likely to lose over VPNs than one that writes "actually located." Parents whose children were harmed should frame claims around the operator's own design or representations, and should expect a fight over whether the claim is really about third-party content, where Doe v. Grindr Inc., 128 F.4th 1148 (9th Cir. 2025), and Patterson v. Meta Platforms, Inc., 2025 NY Slip Op 04385, show the limits. COPPA itself gives parents no private claim, although Jones v. Google LLC, 73 F.4th 636 (9th Cir. 2023), allows parallel state-law claims.

Common mistakes

• Treating a news headline as an injunction. "Judge blocks law" may mean members of a trade association only, and a stay may have followed.
• Relying on a birthdate field for verification. It doesn't meet a verification mandate. It does create knowledge.
• Assuming you are too small. Most of these laws lack a revenue floor. Arkansas's $100 million exemption was unusual, and the court counted it against the law.
• Assuming you are a publisher. The comment carve-outs are narrow and have become litigation targets.
• Keeping ID images "just in case." Several statutes ban it, and the data is a liability from the moment you store it.
• Forgetting the humans. Your automated flow deletes in seconds. Your support desk does not.
• Buying a method a state doesn't accept. Vendors sell nationally. Statutes are local.
• Believing "not biometric" because the vendor says so. Read the technical documentation and require an indemnity.
• Ignoring the app store signal. It can give you knowledge you never had.
• Blocking a state while still advertising there. That invites the argument that the block was for show.
• Sharing age data with ad tech. It violates the FTC's conditions and most of the state rules. The same tags raise separate exposure, as discussed in Reducing Video Privacy Protection Act Risk on a Website or App: A Practical Guide.
• Using one statement for every parent. The consent notice must describe the actual service, in the required languages where they apply.
• Skipping the memo. Good faith is easier to prove in the record than in testimony.

Worked examples

Panfellow, a recipe community

Suppose a Boise company we will call Panfellow runs a community where users create profiles, follow one another, post recipes, and browse a home feed personalized by past likes. It has 400,000 users, ad revenue, and no sexual content. Its analytics say 8 percent are probably under 18, though it has never asked.

Under Step 2, it is not an adult-content site, it is probably a covered platform in Tennessee, Ohio, and Georgia, and its home feed likely counts as an addictive feed. It might not meet Florida's two-hour test. On Step 3, it is not a NetChoice member. Georgia's injunction has been vacated. Ohio's appellate judgment favors the state, though the mandate is stayed pending a certiorari petition. Tennessee's law is in force.

On Step 4, the team considers its options. Teens are not important to its business, and the check would cost more than a free user earns. It chooses exclusion in those states plus a design change everywhere: the feed becomes follows-only for anyone not confirmed as an adult. It adds a neutral age screen, a report-and-close process, and a record of closures. It removes interest-based ads for anyone flagged as a minor. The memo is three pages. Total engineering time is modest compared with a verification rollout.

Risk remains. Tennessee's text says a company "shall verify the age of an individual who attempts to become an account holder," and an exclusion policy without a check may not satisfy that language. Panfellow's counsel flags this and recommends a low-friction estimation check for new Tennessee accounts, or a state block if the numbers justify it.

Lanternreach, an audio publisher

Suppose an Asheville publisher we will call Lanternreach sells romance audiobooks, some of them sexually explicit. Roughly 40 percent of titles by count are explicit, but those titles account for 15 percent of hours, and 60 percent of revenue. Texas law speaks of material "more than one-third of which" is harmful to minors.

The first question is whether explicit audiobooks meet the three-part minors test, and whether they lack serious literary value for minors. Serious romance fiction has a real argument, and the statute includes "describes," not only "depicts," so text and audio are in play. Lanternreach should not stake the business on that argument. By title count it is over the line. By hours it is under. By revenue it is well over.

Sensible counsel would treat it as covered in Texas and similar states, and would raise three options: age-gate explicit titles behind a purchase flow using payment and a verification token, spin the explicit catalog onto a separate domain so the main site falls well below any measure, or block the state. Splitting domains is legitimate if real, but the second domain now is plainly covered. The company chooses a separate site with third-party verification that returns only a token. It writes down how it measures content share and rechecks quarterly. It also reads its privacy policy again, because its customers would rather not have an ID linked to a purchase history.

Tidepool Forge, a small game studio

Suppose a Tacoma studio we will call Tidepool Forge ships a cozy multiplayer game for phones, with cartoon animals, chat, and in-app purchases. Its app store listing says ages 9 and up.

That rating and art style point at children, so COPPA is the first problem: the game is probably directed to children or at least mixed audience. The team builds a neutral age screen, limits chat to preset phrases for under-13s, stops collecting persistent identifiers for advertising from them, and adds email-plus or text-plus consent for the few features that need it. It then adds a written security program and retention policy, sized to a small studio, as the Rule allows.

Tennessee's definition excludes "interactive gaming" from content, and Georgia excludes services whose predominant function is gaming. But Texas's app store act reaches it as a developer, so it assigns ratings under a recognized standard and adds a release-gate question for new purchases. Monetization aimed at kids invites other trouble, for which see Video Game Law: Intellectual Property, Virtual Goods, User Content, and Player Protection.

A final word on sequence

Do the steps in order, keep the memo, and put a recurring check on the calendar. Print the Minors Online Compliance Checklist: A Practical Checklist for the team that will do the work. This guide is general information, and the right choice for a given product turns on facts it can't see. If you would like a second set of eyes on the applicability memo or a vendor contract, MC Law does that work.

Related Documents

Related Articles

• Age Verification and Minors Online After Free Speech Coalition v. Paxton: What States Can Require of Websites and Apps: the doctrine and the circuit split.
• Children's Privacy Under COPPA and the Age-Appropriate Design Codes: COPPA in depth.
• Section 230 and Platform Liability: What the Statute Actually Says and Where It Stops: what Section 230 can and cannot do for you.

Related Guides

• Defending or Bringing a Biometric Privacy Claim: A Practical Guide: if a face-scan claim arrives.
• Defending or Bringing a Data Breach Class Action: A Practical Guide: if verification data leaks.
• Auditing Your Website Tracking Stack: A Practical Guide: finding age knowledge in your tags.
• Reducing Video Privacy Protection Act Risk on a Website or App: A Practical Guide: another tag-driven exposure.

Related Checklists

• Minors Online Compliance Checklist: A Practical Checklist: this guide as task lists.
• COPPA Children's Privacy Compliance Checklist: A Practical Checklist: the under-13 workstream.
• Preliminary Injunction and TRO Application Checklist: A Practical Checklist: for a challenge to a state law.

Related Toolkits

• Minors Online Toolkit: Applicability Matrices, Age Assurance Vendor Terms, and Parental Consent Flows: the working papers.
• Biometric Privacy Toolkit: Retention Policies, Consent Forms, and Vendor Terms: forms for face-based methods.
• Platform Liability Toolkit: Terms of Service, Notice Procedures, and Litigation Defenses: terms and safety statements.