How to use this checklist

Give one person ownership of the whole list and a named owner for each phase. Work the phases in order, since Phase 4 may eliminate most of what follows. Write the date and initials beside each completed task, attach the evidence, and file the marked-up copy with your applicability memo. If a task does not apply, write why: "N/A, no accounts" is useful proof of diligence, while a blank box proves nothing.

This area changes faster than a printed page. Treat every status note below as a prompt to check the docket, and repeat Phase 3 on a calendar. For the reasoning, read Age Verification and Minors Online After Free Speech Coalition v. Paxton: What States Can Require of Websites and Apps. For the decision sequence in prose, read Deciding Whether Your Website or App Must Verify Age: A Practical Guide. Fillable forms are in the Minors Online Toolkit: Applicability Matrices, Age Assurance Vendor Terms, and Parental Consent Flows.

The checklist states general legal information and isn't advice on your particular service.

Phase 1: Inventory the product

Owner: product lead. Timing: first week.

  • List every domain, subdomain, and app, with an owner for each. Coverage attaches to a "website," "service," or "platform," and a separate domain can change the answer under the content-share test in Free Speech Coalition, Inc. v. Paxton, 606 U.S. 461 (2025).
  • Record which account features exist. Accounts, public or semi-public profiles, connection lists, posting, and messaging are the elements in Ohio Rev. Code § 1349.09(A)(1), as set out in NetChoice, LLC v. Yost, 180 F.4th 268 (6th Cir. 2026), and similar statutes. Note: Ohio requires all four listed functions together. Tennessee's definition, by contrast, needs only an account and communication through posts.
  • Record how every feed is ranked, with the engineer who confirmed it. Addictive-feed coverage depends on selection using information associated with the user or device, N.Y. Gen. Bus. Law § 1500 and Cal. Health & Safety Code § 27000.5.
  • Flag each listed engagement feature. Infinite scrolling, push notifications, displayed interaction metrics, auto-play, and live-streaming are the triggers in Fla. Stat. § 501.1736(1)(e), described in Computer & Communications Industry Ass'n v. Attorney General of Florida, No. 25-11881 (11th Cir. Oct. 14, 2026).
  • Pull time-on-service data for known or estimated under-16 users. Florida's test asks whether 10 percent or more of daily users under 16 spend an average of two hours or more on days they use the service. Id. Note: If you do not know ages, document how you estimated. A regulator will ask.
  • Measure sexually explicit content share, by more than one metric. Texas's trigger is material "more than one-third of which" is sexual material harmful to minors. Tex. Civ. Prac. & Rem. Code § 129B.002(a). Note: The statute does not specify one-third of what. Compare items, runtime, and traffic, and record the method.
  • Collect the evidence about your audience. Marketing plans, personas, age-graded art, influencer deals, ad-platform audience settings, and app store ratings all bear on the "targets" and "reasonably anticipated" factors in Ohio's Act and on the COPPA "directed to children" factors at 16 C.F.R. Part 312.
  • Map users by state, and say how you know. Billing address, IP, device settings, and declared location can disagree.
  • Identify third-party tags and SDKs that receive any age-related signal. See Auditing Your Website Tracking Stack: A Practical Guide.

Red flag: Sales or investor materials describe teens or children as a growth audience while the privacy policy says the service is not intended for them. That gap is the first exhibit in an attorney general's complaint.

Phase 2: Run coverage for each law family

Owner: counsel. Timing: second week.

  • Adult-content laws. List every state you serve that has one, and compare fraction, definition, and permitted methods. The Supreme Court counted at least 21 others besides Texas in Free Speech Coalition, and the list has grown.
  • Social media account laws. Apply each definition and exemption separately. Start with Florida, Georgia (NetChoice v. Attorney General of Georgia, No. 25-12436 (11th Cir. Oct. 15, 2026)), Ohio, Tennessee (NetChoice, LLC v. Skrmetti, No. 25-5660 (6th Cir. Aug. 28, 2026)), Texas, Mississippi, Virginia, Nebraska, Louisiana, Arkansas, and Utah. Note: Georgia excludes a service that bars minors and uses commercially reasonable age assurance. Consider whether that describes you.
  • Check small-entity outs in the text. Texas's H.B. 18 exempts small businesses, as noted in Computer & Communications Industry Ass'n v. Paxton, 184 F.4th 420 (5th Cir. 2026). Arkansas's Act 689 exempted platforms generating under $100 million, but that Act is enjoined. Most others have no such floor.
  • Check publisher outs narrowly. Ohio's exception is for comments incidental to content of an "established and widely recognized media outlet." Georgia's includes permitting comments on a digital news website. Do not extend these by analogy.
  • Addictive-feed laws. Test the feed against each exception in § 1500 and against California's, read with NetChoice, LLC v. Bonta, 152 F.4th 1002 (9th Cir. 2025). Ask whether a feed is a "significant part" of the service.
  • Design codes. Test "likely to be accessed by children" under Cal. Civ. Code § 1798.99.30 and Maryland's Kids Code. Confirm your status as a covered "business" under California's privacy statute. See State Consumer Privacy Laws: The CCPA, the CPRA, and the Multi-State Patchwork.
  • App store acts. If you distribute an app, note obligations under Tex. Bus. & Com. Code ch. 121 and the Utah, Louisiana, Alabama, and California laws. See Phase 10.
  • COPPA. Decide whether you are directed to children, mixed audience, or general audience, and whether you have actual knowledge. 15 U.S.C. § 6501 and § 6502.
  • Sign a dated applicability memo. One page per law family is enough. List facts relied on, so you know when to revisit.

Red flag: Your analysis says "we're not social media" because of what you call the product. Statutes define by function. Dreamwidth, a journaling site, is among NetChoice's covered members in several cases.

Phase 3: Check status as to you, and keep checking

Owner: counsel. Timing: after Phase 2, then at least monthly, and on any news alert.

  • Read the decretal language of every injunction, not the press coverage. Note who is protected. NetChoice v. Griffin, No. 5:25-cv-05140 (W.D. Ark. Dec. 15, 2025), for example, protects NetChoice's members.
  • Determine your membership status in NetChoice or the Computer & Communications Industry Association, and whether later-joined members are protected. Note: Universal injunctions are disfavored after Trump v. CASA, Inc., 606 U.S. 831 (2025).
  • Check for appeal, stay, vacatur, mandate, and rehearing. Florida's injunction was reversed and vacated. Georgia's was vacated. Ohio's judgment was reversed, but the Sixth Circuit stayed its mandate pending a certiorari petition, so the district court's injunction has not yet been displaced. Mississippi's was stayed, and NetChoice v. Fitch, No. 25A97 (U.S. Aug. 14, 2025), left the stay in place. Texas's app store injunction was stayed by Students Engaged in Advancing Texas v. Paxton, No. 25-51073 (5th Cir. June 4, 2026).
  • Log which provisions remain enforceable. Injunctions are often partial. In California's SB 976, the like-count default is enjoined and the private-mode default isn't. In NetChoice v. Hilgers, No. 4:26-CV-3149 (D. Neb. June 27, 2026), age verification and consent are enjoined and parental viewing tools are not.
  • Calendar upcoming dates. California SB 976 age assurance and AB 1043, January 1, 2027 (Alabama's app store act is reported to take effect the same day). New York SAFE for Kids, January 25, 2027 (§ 1502 notes the date). Utah app store duties, May 6, 2027. Louisiana app store act, July 1, 2027.
  • Watch pending appeals. Fourth Circuit No. 26-1252 (Virginia), Tenth Circuit No. 24-4100 (Utah), Eighth Circuit Nos. 25-1889 (Arkansas Act 689) and 26-2478 (Nebraska), the Fifth Circuit's Mississippi, Louisiana (No. 26-30016), and SB 2420 appeals, and certiorari petitions, including NetChoice's in the Ohio case (due December 3, 2026).
  • Check whether final California SB 976 regulations have been adopted. Proposed rules were released in May 2026. See the state's SB 976 page.
  • Identify private rights of action that an injunction against an official would not stop. Free Speech Coalition v. Anderson, 119 F.4th 732 (10th Cir. 2024), shows how a privately enforced law can resist pre-enforcement review.

Red flag: Compliance work was shut down after a favorable headline, with no one assigned to monitor the appeal. Laws in this field have gone from enjoined to enforceable in weeks.

Phase 4: Make the response decision

Owner: executive sponsor, with counsel. Timing: before any build.

  • Price a redesign first. Removing a public profile, a follow graph, or a personal-data feed may end coverage under a function-based law.
  • Price exclusion. Nextdoor and Dreamwidth barred minors in Tennessee rather than build consent tools, as recorded in the Skrmetti dissent. Note: Terms alone are weak. Pair them with a neutral screen and a working process to close underage accounts.
  • Price a state block. Record traffic, revenue, and existing accounts in the state.
  • Price verification. Use actual vendor quotes, your abandonment estimate, and your revenue per user.
  • Record the decision by state, with the reasons and the date. A board or executive note is adequate.
  • If blocking, follow a block procedure. Block at network edge and at signup. Use a consistent notice. Don't advise VPN use. Stop state-targeted ads. Note: Aylo Freesites Ltd v. Utah Division of Consumer Protection, No. 2:26-cv-00340 (D. Utah Sept. 24, 2026), enjoined Utah's "actually located" clause. The opinion's record describes methods a state will call reasonable, including VPN detection and non-IP signals. New York's § 1507 turns on physical location.
  • Decide on any challenge. If litigation is an option, seek advice early. See Phase 12.

Red flag: Verification was chosen because a vendor pitched it, and no one asked whether a feature change would have removed the obligation.

Phase 5: Select the method

Owner: security lead, product, counsel. Timing: before signing a vendor.

  • Match methods to state text. Texas's H.B. 1181 names government-issued ID and transactional data. The Court did not resolve whether face scans qualify (n.14 of Free Speech Coalition).
  • Offer an alternative to government ID where required. N.Y. Gen. Bus. Law § 1501 requires the regulations to provide at least one method not solely reliant on government ID or preserving anonymity as to the operator. Read 13 NYCRR Part 700 on the Attorney General's rule page.
  • Do not treat self-declaration as verification. The FTC describes concerns about it, and California's proposed rules are reported to disfavor it.
  • Get accuracy evidence at your threshold ages. Ask for error at 13, 16, and 18, by demographic group, tied where possible to NIST's age estimation evaluation.
  • Confirm liveness and spoof detection, and how each handles an adult's photo.
  • Define the fallback path. Decide what happens to users near a threshold, who are misjudged, or who lack ID.
  • Test the flow with adults on old phones and slow connections. Failure rates become evidence of burden.
  • Keep testing records. New York's Attorney General describes annual testing and retention of results for at least 10 years. Confirm against the rule text.
  • Run a privacy assessment before launch. A form is in the toolkit. Keep in mind that a required impact report was enjoined as to content risk in NetChoice, LLC v. Bonta, 113 F.4th 1101 (9th Cir. 2024). That ruling did not address voluntary or data-focused assessments, or those required by consumer privacy statutes.

Phase 6: Lock down the data

Owner: security lead. Timing: build phase, before launch.

  • Draw the data flow on one page. Include ID image, selfie, template, birthdate, result, token, consent record, appeal ticket, vendor log, and analytics events.
  • Keep result and date only. Tennessee bars retaining personally identifying information used to verify age or consent (Tenn. Code § 47-18-5703(c), as quoted in Skrmetti).
  • Set and test deletion. Confirm that deletion happens at the vendor, in backups as your policy says, and in the appeal path.
  • Ban reuse in writing. The FTC's enforcement policy statement of February 25, 2026, conditions its forbearance on using the data only for age verification.
  • Satisfy each condition of the FTC's statement. That includes written assurances from third parties, prompt deletion, privacy policy notice, reasonable security, reasonable steps on accuracy, and compliance with the Rule in every other respect. Note: The statement binds only the FTC's own discretion. It offers no protection against a state or a private plaintiff.
  • Remove IDs from support channels. No email attachments, no screenshots in tickets, restricted reviewer access, and short retention in the review tool.
  • Turn off session replay and analytics on verification pages. Otherwise you may capture what the vendor promises to delete.
  • Separate identity from activity, especially on adult content, so the verifier cannot see what the user does and the site doesn't hold the ID.
  • Obtain a written biometric release. Use it before any face or voice processing. Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186. Publish a retention schedule. See the Biometric Data Compliance Checklist: A Practical Checklist.
  • Do the Texas analysis. Tex. Bus. & Com. Code § 503.001 requires notice and consent for biometric capture for a commercial purpose.
  • Get the vendor's technical answer on identifiability. Zellmer v. Meta Platforms, Inc., 104 F.4th 1117 (9th Cir. 2024), turned on whether data could identify someone. Note: Don't rest on this alone. It is a federal court's reading of an Illinois statute, in a different setting.
  • Diligence the vendor. Use the Vendor Cybersecurity Diligence Checklist: A Practical Checklist.
  • Add ID data to the incident plan. See Responding to a Data Breach: The First Seventy-Two Hours and the Data Breach Litigation Readiness Checklist: A Practical Checklist.

Red flag: Nobody can tell you where an ID image goes when automatic verification fails. In the 2025 Discord incident, the exposed ID photos were reportedly those held by a third-party support vendor reviewing age appeals.

Phase 7: Parental consent

Owner: product and counsel. Timing: build phase.

  • Separate the under-13 COPPA flow from the teen state-law flow. The legal standard, notice, and consent content differ.
  • Select a listed COPPA method. 16 C.F.R. § 312.5(b)(2), which includes signed form, payment, staffed call or video, ID check, knowledge-based questions, ID with face match, and email-plus or text-plus where you do not disclose the data.
  • Get separate consent for third-party disclosure unless integral. § 312.5(a)(2).
  • Follow each state's specifics. Ohio has listed methods, presents moderation features to the parent, gives a link, and confirms by mail or telephone. Tennessee permits revocation and requires parent supervision options.
  • Apply New York's terms when effective. Read § 1503, § 1504, and § 1506 (no special parental access required, no degradation, language access) with the final rules.
  • Define "parent." Tennessee includes a guardian or person with custody or caregiving authority.
  • Verify the relationship as far as the method allows, and send confirmation to a channel the child doesn't control.
  • Provide simple revocation and state how quickly it takes effect.
  • Write an escalation rule for custody disputes, suspected abuse, and a minor who reports danger from a parent.
  • Store a consent record. Who, what method, when, which notice version, which feature.
  • Test the age prompt for neutrality. It must not default to an age or encourage falsification, § 312.2 (mixed audience definition).

Red flag: Consent is obtained by a checkbox on the teen's own device with the teen's email. No regulator will accept that as parental consent.

Phase 8: Review minors' features

Owner: product, trust and safety. Timing: before launch and for every major release.

Red flag: Internal documents discuss maximizing teen engagement or acknowledge known underage use, while the public safety page says something more comforting. The Massachusetts and New Mexico actions against Meta show how those two sets of statements get used together.

Phase 9: COPPA after the 2025 amendments

Owner: privacy counsel. Timing: ongoing; the Rule's compliance date for most provisions passed on April 22, 2026.

  • Update "personal information" mapping to include biometric identifiers and government-issued identifiers. § 312.2.
  • Publish an online notice covering retention, recipients, and purposes. § 312.4.
  • Adopt a written information security program scaled to your size, with a designated coordinator and periodic risk assessments. § 312.8.
  • Adopt a written data retention policy and publish it. No indefinite retention. § 312.10.
  • Review third-party disclosures and obtain written assurances. § 312.8.
  • Decide how you respond when a check returns under 13. The FTC says such a result gives a general audience operator actual knowledge. See note 9 in the enforcement statement.
  • Set an intake rule for reports of under-13 users, including deletion and record of what you did.
  • Assess state-law exposure for the same conduct. Jones v. Google LLC, 73 F.4th 636 (9th Cir. 2023).
  • Consider a safe harbor program. 15 U.S.C. § 6503. See also the COPPA Children's Privacy Compliance Checklist: A Practical Checklist.

Phase 10: App store and device signals

Owner: mobile lead and counsel. Timing: Texas now; others as dates arrive.

  • Implement store age-signal interfaces according to each store's current developer documentation. The statutory duties rest on Tex. Bus. & Com. Code ch. 121.
  • Assign age ratings and content descriptions using widely adopted standards, consistently and in good faith. § 121.056(b), per the Fifth Circuit's order.
  • Add a significant-change gate to the release process. § 121.053 covers changes to terms or privacy policy, new monetization features, and material changes in functionality or user experience. Note: Utah's amended act reportedly narrows the definition of significant change. Compare the texts.
  • Handle every state of the signal, including refused, revoked, and absent.
  • Restrict use of age data to compliance and permitted safety purposes, and keep it out of ad and analytics systems.
  • Confirm safe harbor conditions for each state. Utah's and Texas's protections for good-faith reliance differ. Louisiana's original act lacked one and its 2026 reenactment should be checked.
  • Plan for California AB 1043's operating system signal, effective January 1, 2027, and how it interacts with COPPA knowledge.
  • Track federal bills. S. 1586 and H.R. 3149. A federal law could preempt some state requirements.

Red flag: The first time the team hears about age signals is when a store's update breaks the build, or when the first "under 13" value appears in a production log.

Phase 11: Public statements

Owner: counsel and marketing. Timing: before launch; review every six months.

Phase 12: Enforcement and litigation readiness

Owner: general counsel or outside counsel. Timing: before you need it.

  • Designate who receives subpoenas and attorney general letters. Ohio's Attorney General, for one, may subpoena on reason to believe a violation exists.
  • Write a legal hold template covering age-check logs, product decisions, and vendor records.
  • Know your cure rights. Ohio offers 90 days only if in "substantial compliance." Others differ.
  • Know the penalties. Texas: up to $10,000 per day and up to $250,000 where minors access covered material. Florida: up to $50,000 per violation. Ohio: tiered per day, up to $10,000. Tennessee: up to $1,000 per violation and possible license revocation. New York: up to $5,000 per violation, § 1508. COPPA: published figure of up to $53,088 per violation, with state actions under § 6504.
  • Assess jurisdiction honestly. State v. Meta Platforms, Inc., 2025 VT 51, found specific jurisdiction based on the company's engagement with the state.
  • Assess removal before filing. Attorney General of Florida v. Snap Inc., No. 25-12814 (11th Cir. Oct. 14, 2026), ordered remand of an HB3 enforcement action.
  • If you plan to challenge a law, plead as-applied and file early. Moody v. NetChoice, LLC, 603 U.S. 707 (2024). Younger v. Harris, 401 U.S. 37 (1971). Use the Preliminary Injunction and TRO Application Checklist: A Practical Checklist.
  • Prepare specific harm declarations. Cost per user, deadlines, and what will change. The Skrmetti dissent explains how vague ones fail.
  • Consider insurance. Ask your broker whether penalties, biometric claims, and regulatory defense are excluded.
  • Set a review date. Put the next Phase 3 check on a named person's calendar before filing this checklist.

Red flag: You are about to rely on Yost as proof a parental consent law is valid. Only one judge upheld the Ohio law on the merits, and neither of the other two panel members joined that reasoning. Read all three opinions first.

Related Documents

Related Articles

Related Guides

Related Checklists

Related Toolkits