Minors Online Toolkit: Applicability Matrices, Age Assurance Vendor Terms, and Parental Consent Flows

How to use this toolkit

Copy what you need, replace the bracketed text, and strip out the drafting notes before anything leaves the building. The papers build on each other. Tool 1 and Tool 2 tell you which laws reach you. Tool 3 tells you which of them can be enforced against you. Tool 4 and Tool 5 record your choice. The remaining tools execute that choice.

These forms are starting points for a lawyer who knows the facts, and they are general information rather than advice on your service. Statutes in this field are amended often and injunctions come and go, so check the current text and docket before relying on any entry. The doctrine is explained in Age Verification and Minors Online After Free Speech Coalition v. Paxton: What States Can Require of Websites and Apps. The sequence is in Deciding Whether Your Website or App Must Verify Age: A Practical Guide. Assign the tasks with the Minors Online Compliance Checklist: A Practical Checklist.

Table of contents

1. Applicability matrix by law type
2. Feature-to-coverage worksheet
3. Injunction status log
4. Response decision matrix
5. Geoblock decision memo
6. Age assurance vendor diligence questionnaire
7. Age assurance vendor clause bank
8. Age assurance impact assessment
9. Parental consent flows and scripts
10. User-facing notices
11. Minors' feature review
12. App store signal table and release gate
13. Attorney general inquiry plan
14. As-applied declaration outline
15. Monitoring calendar

Tool 1: Applicability matrix by law type

Purpose: a single-page answer to "which laws reach this product and why." Owner: counsel, with product input. Timing: at the start, on every material feature change, and at least quarterly.

Fill one row per state and per law. Use "Y," "N," or "?" and cite the statutory words in the last column.

Drafting notes.

• Adult content. The operative structure comes from Free Speech Coalition, Inc. v. Paxton, 606 U.S. 461 (2025). The opinion's footnote 2 lists comparable statutes, which is a good starting list, though not current.
• Florida. The elements and the email or direct message exception are quoted in Computer & Communications Industry Ass'n v. Attorney General of Florida, No. 25-11881 (11th Cir. Oct. 14, 2026). Footnote 1 of that opinion collects the parallel state litigation.
• Georgia. All the exemptions are recited in NetChoice v. Attorney General of Georgia, No. 25-12436 (11th Cir. Oct. 15, 2026). Use that list as your row-by-row test.
• Ohio. Section (C)'s factors and sections (N) and (O)'s exclusions are reproduced in NetChoice, LLC v. Yost, 180 F.4th 268 (6th Cir. 2026).
• Tennessee. Definitions, retention ban, and parental tools are quoted in NetChoice, LLC v. Skrmetti, No. 25-5660 (6th Cir. Aug. 28, 2026).
• New York. Read § 1500 and § 1508 with the final rules at 13 NYCRR Part 700. Section 1508 opens with timing language about when the Attorney General may sue. Confirm how that interacts with the January 25, 2027, date.
• COPPA. See 15 U.S.C. § 6501 and § 6504. The rule's factors for "directed to children" are in 16 C.F.R. Part 312.

Tool 2: Feature-to-coverage worksheet

Purpose: show engineers which switch affects which law, so that a redesign gets priced honestly. Owner: product lead. Timing: before Tool 4.

Drafting notes. Florida's statute lets a platform stay out by dropping either the algorithm or the listed features, and the Eleventh Circuit relied on that when it called HB3 a conditional restriction. Redesign is a legitimate path and a stated part of the law's structure. Do not record any redesign as a tactic to evade the law. Record it as what it is: a product decision that changes the service's function. For California's addictive feed definition and its exceptions, see NetChoice, LLC v. Bonta, 152 F.4th 1002 (9th Cir. 2025).

Tool 3: Injunction status log

Purpose: prevent reliance on a stale or inapplicable order. Owner: counsel. Timing: monthly, and whenever a news alert fires.

Seed entries (confirm each before use).

Drafting notes. The "Who is protected" column is the point of this tool. Trump v. CASA, Inc., 606 U.S. 831 (2025), pushes relief toward named parties, and the Fifth Circuit's SB 2420 order applied it. When an order protects a trade association's "members," find out whether it reaches those identified in the record or anyone who joins. Add a column for private rights of action if your matrix shows any, because an order against an attorney general may not stop a private plaintiff. See Free Speech Coalition v. Anderson, 119 F.4th 732 (10th Cir. 2024).

Tool 4: Response decision matrix

Purpose: record why you chose among redesign, exclusion, block, and verification, by state. Owner: executive sponsor. Timing: after Tools 1 to 3.

Score each option 1 (poor) to 5 (good), and write one sentence for each score.

Decision: [option] for [state] because [reason]. Revisit on: [date or event]. Approved by: [name, date].

Drafting notes. The last row is easy to miss. Judge Clay's dissent in Skrmetti argued that a member's choice to bar minors undercuts its claim of compliance-cost harm, although the majority vacated the denial of relief. If you may later sue, have counsel look at this row before you commit. And note a tension in statutory exits: exemptions and thresholds that protect you are also what courts have looked to when finding a law content based, so an exit available now may be repealed by a legislature trying to save the statute.

Tool 5: Geoblock decision memo

Purpose: a contemporaneous record of a decision to stop serving a state or restrict content there. Owner: counsel, with the infrastructure lead. Timing: before the block goes live.

MEMORANDUM

To: [Executive sponsor] From: [Counsel] Date: [ ] Privileged and confidential [if accurate]

Decision requested: Restrict [service or content] for users in [state], effective [date].

Legal basis. [Statute] applies because [facts]. Status under Tool 3: [ ]. We are / are not protected by [order].

Options considered. Redesign: [why not]. Exclude minors: [why not]. Verify: [cost per user against revenue per user; drop-off estimate].

Exposure if we do nothing. [Penalty structure; private suits; past conduct.]

Business impact. [Monthly users; revenue; existing accounts; contracts.]

What the block will do. Layer: [edge network, signup, checkout]. Data source: [IP database and vendor; update frequency]. Treatment of existing accounts: [ ]. Known limits: VPNs, proxies, mobile gateways, roaming, and shared networks.

Additional signals, if any. [Billing address, shipping address, stated location, VPN detection. Signals we already hold will be used because ignoring them undermines the block.]

User notice. [Text, Tool 10.]

Marketing changes. [Stop state-targeted ads; review influencers and local promotions.]

Conditions for lifting. [Injunction issued and covers us; verification built; law repealed.]

Owner and review date. [ ]

Drafting notes.

• In Aylo, the court recorded a three-step method Utah offered as reasonable: detect VPN or proxy use with a commercial service, estimate presence from non-IP indicators such as time zone and language, and offer the remaining users a device-location check, age assurance, or turning off the VPN. Consider which of these you can adopt. The court also noted that such methods are over- and under-inclusive, using the example of a large number of Mountain Time, English-language visits that cannot be pinned to one state.
• That decision rested on the dormant Commerce Clause, on a direct-regulation theory and under Pike balancing, a demanding route after National Pork Producers Council v. Ross, 598 U.S. 356 (2023). Do not assume every location clause will fall. New York's § 1507 addresses a user physically outside the state and may be read differently.
• Blocking does not end personal jurisdiction for past contacts. See State v. Meta Platforms, Inc., 2025 VT 51, and Personal Jurisdiction Over Online and Foreign Defendants: From Zippo to Ford Motor.
• Mark the memo privileged only if it truly gives legal advice. A business record written by a lawyer is still a business record.

Tool 6: Age assurance vendor diligence questionnaire

Purpose: learn what the product actually does before signing. Owner: security lead and counsel. Timing: during procurement and at each renewal.

Function and data

1. Which methods do you offer (document, face estimation, transactional data, card, device or wallet credential, inference)?
2. List every data element collected, computed, or received, for each method.
3. Do you create a face template, embedding, or any other numerical representation? Can it be used to recognize the person? Is it persisted, even briefly? Where and how long?
4. What precisely do you return to us? Can you return only a pass or fail and an age band?
5. Can you see which site or app the user is verifying for? Do you log that?
6. Do you retain any data to prevent repeat fraud? On what basis?

Retention and reuse

7. What is the retention period for each element in the automated path? In the manual review path? In backups? In your subprocessors' systems?
8. Do you use customer data to train or improve your models? Can that be turned off by contract?
9. Do you combine data across customers?

Accuracy

10. Provide your error at ages 13, 16, 18, and 21, by age, sex, and skin tone, with the test set described.
11. Have you been evaluated by NIST's age estimation program or another independent tester? Provide the report and the version of the model tested, and state whether that version is the one in production.
12. What is the recommended buffer? What share of users fall to fallback or manual review?
13. How do you detect presentation attacks, injection attacks, and synthetic faces?

Security and people

14. Provide your latest SOC 2 Type II or ISO 27001 reports.
15. Who can view IDs or faces in manual review? Where are they located? What tools do they use? Are screenshots blocked?
16. List subprocessors, including support vendors and ticketing tools.
17. Describe any security incident in the past three years involving identity documents.

Law

18. Which state statutes have you mapped your methods against? Provide the mapping and your counsel's view, if you can share it.
19. What is your position on BIPA, Texas's biometric statute, and Washington's biometric and consumer health laws? Have you been sued under them? What was the outcome?
20. Will you sign the release language required by Illinois, or help us collect it?
21. Do you hold personal information of minors? How does your flow comply with COPPA when the user is under 13?
22. How do you respond to subpoenas and government demands for verification records?
23. Can you support annual testing and retain evidence for 10 years if a state's rules require it?

Drafting notes. Questions 3 and 19 come straight from Zellmer v. Meta Platforms, Inc., 104 F.4th 1117 (9th Cir. 2024), which turned on whether a face signature could identify anyone, and Rosenbach v. Six Flags Entertainment Corp., 2019 IL 123186. Questions 7 and 16 respond to the support-vendor exposure in the 2025 Discord incident. Questions 10 to 12 support the FTC's condition that you take reasonable steps to ensure reasonable accuracy. Question 22 responds to Justice Kagan's concern in Free Speech Coalition that an operator might be subpoenaed. Question 23 tracks New York's Attorney General's description of the rules; confirm against the rule text. Combine this with the general Vendor Cybersecurity Diligence Checklist: A Practical Checklist and Building a Vendor and Third-Party Risk Management Program.

Tool 7: Age assurance vendor clause bank

Purpose: contract language that turns the vendor's sales claims into obligations. Owner: counsel. Timing: at contracting. Each clause assumes a master agreement and data processing addendum. Adjust the party labels to your form.

Clause 1: Limited purpose.

Vendor shall collect, use, and disclose Verification Data solely to determine a user's age or age range for Customer ("Age Verification Purposes"). Vendor shall not use or disclose Verification Data for any other purpose, including advertising, profiling, identity graphing, or sale.

Clause 2: No model training.

Vendor shall not use Verification Data to train, tune, test, or improve any model or product, unless Customer gives prior written consent for a specified dataset and purpose and the required user consent has been obtained.

Clause 3: Result-only return.

Vendor shall return to Customer only [pass or fail / age band], a transaction identifier, and a timestamp. Vendor shall not return name, date of birth, image, document number, or any biometric data.

Clause 4: Deletion and certification.

Vendor shall delete Verification Data (a) within [ ] minutes after a result in the automated path, and (b) within [ ] days after final disposition in any manual review path, including from subprocessors, ticketing tools, logs, and caches, and from backups within [ ] days on normal rotation. Within [ ] days after each calendar quarter, an officer of Vendor shall certify compliance in writing.

Clause 5: No retention where prohibited.

Where Applicable Law prohibits retention of identifying information used for age verification or parental consent, Vendor shall not retain such information after the determination is made, notwithstanding any other retention period in this Agreement.

Clause 6: Biometric data.

Vendor represents that [Method] [does / does not] create a scan of face geometry, faceprint, template, or embedding, and describes its processing in Exhibit [ ]. Vendor shall not sell, lease, trade, or profit from biometric data, shall maintain a public retention schedule, and shall support Customer in giving notice and obtaining written releases where required. Vendor shall immediately notify Customer of any change to Exhibit [ ].

Clause 7: Accuracy warranty and testing.

Vendor warrants that [Method], as deployed, will meet the performance levels in Exhibit [ ] at each threshold age. Vendor shall test annually using a documented method, shall provide the results to Customer, and shall retain results for [10] years. Vendor shall promptly notify Customer of any model change that may materially affect performance.

Clause 8: Non-discrimination.

Vendor shall measure differences in performance across age, sex, and skin tone and shall report them to Customer, with its plan to reduce any material disparity.

Clause 9: Alternative methods.

Vendor shall make available at least one age assurance method that does not require government-issued identification, and shall support a review path for users who dispute a result.

Clause 10: Manual review controls.

Manual review shall occur only in a restricted environment with role-based access, logging, and technical controls against copying. No identity document shall enter a general support ticketing system.

Clause 11: Subprocessors.

Vendor shall list all subprocessors in Exhibit [ ], give [30] days' notice of changes, and remain liable for their acts. Vendor shall impose on each terms at least as protective as this Agreement.

Clause 12: Security.

Vendor shall maintain a written information security program with safeguards appropriate to the sensitivity of Verification Data, encrypt data in transit and at rest, and maintain [SOC 2 Type II or ISO 27001] for the systems that process Verification Data.

Clause 13: Incident notice.

Vendor shall notify Customer within [24] hours after becoming aware of any actual or reasonably suspected unauthorized access to Verification Data, and shall provide the facts Customer needs to meet its legal obligations, and shall not notify users or regulators about Customer's users without Customer's approval, except as law requires.

Clause 14: Written assurances for COPPA.

Vendor confirms that it is capable of maintaining the confidentiality, security, and integrity of Verification Data, that it will employ reasonable measures to do so, that it will not use or disclose the data for any other purpose, and that it will delete the data promptly after fulfilling the Age Verification Purposes.

Clause 15: Government and third-party demands.

Vendor shall, unless legally prohibited, notify Customer before responding to any subpoena or government demand for Verification Data and shall disclose only what is legally required.

Clause 16: Change in law.

If Applicable Law changes, or an order affects the method's use in any jurisdiction, the parties shall work in good faith on changes, and Customer may suspend use for that jurisdiction without penalty.

Clause 17: Audit.

Customer may on [30] days' notice, and at any time after an incident, audit Vendor's compliance or receive an independent assessor's report.

Clause 18: Indemnity and liability.

Vendor shall defend and indemnify Customer against third-party claims and regulatory actions arising from Vendor's breach of Clauses 1 to 15, including claims under biometric privacy and data breach statutes. Vendor's liability for these matters shall not be limited by [general cap] [or shall be limited to the greater of $[ ] and [ ] times annual fees].

Drafting notes.

• Clauses 1, 4, 12, and 14 track the conditions in the FTC's Enforcement Policy Statement Promoting the Adoption of Age-Verification Technology. The statement requires "written assurances" from third parties, so make sure Clause 14 is really in the signed paper.
• Clause 5 addresses laws like Tennessee's, Tenn. Code § 47-18-5703(c), quoted in Skrmetti, that bar company and third-party retention.
• Clause 6 borrows from the sale-and-profit and retention-schedule duties in Illinois's biometric statute. See the fuller form in the Biometric Privacy Toolkit: Retention Policies, Consent Forms, and Vendor Terms, and Tex. Bus. & Com. Code § 503.001 for Texas.
• Clause 9 supports N.Y. Gen. Bus. Law § 1501.
• Clause 12 echoes 16 C.F.R. § 312.8, which also requires written assurances for those receiving children's data.
• On Clause 18, large vendors resist uncapped indemnities. If you can't get one, keep the cap high for identity-document breaches, and check your cyber policy for biometric exclusions. A class action over leaked IDs is the scenario. See Data Breach Class Actions: Article III Standing, Negligence Claims, and Forensic Report Privilege.

Tool 8: Age assurance impact assessment

Purpose: document that you weighed necessity, proportionality, and risks before launch. Owner: privacy lead, reviewed by counsel. Timing: before launch, on any method change, and annually.

A. Project description. Service: [ ]. States: [ ]. Legal driver: [from Tool 1]. Method and vendor: [ ].

B. Necessity. Why must we determine age at all? What alternatives were considered (Tool 4)? Could we apply protective defaults to all users instead?

C. Data inventory.

D. Risks and mitigations.

E. Legal mapping. [Biometric statutes; state privacy sensitive-data rules; COPPA; retention bans.]

F. Testing. [Accuracy result; date; version; next test.]

G. Decision. Approved / changed / rejected by [ ] on [ ].

Drafting notes. A privacy assessment about your data practices is good hygiene and may be mandatory under state consumer privacy statutes. But be careful what you write about content. NetChoice, LLC v. Bonta, 113 F.4th 1101 (9th Cir. 2024), enjoined California's requirement that businesses opine on whether their services expose children to harmful content, on First Amendment grounds. That ruling doesn't make a voluntary assessment improper. It does mean the form should concentrate on your data flows and design choices and not read like a confession about user content. The assessment may be discoverable, and regulators may be able to demand it, so write it for that audience. For the discipline of retention, see Data Minimization and Avoiding the Over-Retention of Personal Information. For the program it sits inside, see Developing a Privacy Compliance Program.

Tool 9: Parental consent flows and scripts

Purpose: a working sequence for under-13 and teen consent. Owner: product and privacy. Timing: before launch of any feature requiring consent.

Flow A: Under 13 (COPPA)

1. Neutral age screen. Ask for birth month and year, with no pre-filled value and no statement of what age is required.
2. If under 13, stop collection, except what the exceptions in 16 C.F.R. § 312.5(c) allow, such as the parent's online contact details for notice.
3. Direct notice to the parent: what is collected, why, who receives it, retention, and how to consent or refuse.
4. Verifiable consent method per § 312.5(b)(2). Choose by whether you disclose data. If you don't, email-plus or text-plus is available.
5. Separate choice for third-party disclosure unless integral.
6. Delete the parent's contact details if no consent arrives in a reasonable time.
7. Offer access, deletion, and withdrawal.
8. Record date, method, notice version.

Flow B: Teen consent (state law)

1. Determine age by the method chosen in Tool 4.
2. If minor in a covered state, hold the restricted feature. Do not block the rest of the service unless the statute requires it.
3. Minor requests consent and provides parent contact, or the parent starts from their own account.
4. Parent passes age assurance, where required.
5. Parent receives notice tailored to the state (Tool 9 notice below).
6. Parent attests to the relationship and consents.
7. Confirmation sent by a separate channel. In Ohio, confirm by written mail or telephone.
8. Parent tools delivered where required.
9. Annual or event-based refresh, including when a significant change occurs.
10. Revocation takes effect within [ ] hours.

Parent notice (teen)

Subject: Your consent is needed for [teen's display name] on [Service]

Someone who identifies as your child has asked to use [feature]. Because of [State] law, we need a parent or legal guardian to decide.

[Service] is [one-sentence description]. If you consent, your teen will be able to [feature]. We will collect [categories]. We [do / do not] show targeted ads to minors. The moderation features on the service include [list, with link].

To decide, go to [link]. You'll be asked to confirm your own age and that you are the parent or legal guardian. If you do nothing, your teen will not have access to [feature]. You can change your decision any time at [link].

If you did not expect this message or you are not this person's parent, tell us at [link].

Support scripts

Parent says: "I didn't approve this."

Thank you for telling me. I'm going to pause [feature] on that account now while we review. Can you tell me the email or phone number where you received our message? I can't share details about the account until we've confirmed your relationship, but I can explain how to do that. [Route to trained reviewer.]

Two parents disagree.

We can record one parent's decision to withdraw consent right away. We aren't able to decide custody questions. If there is a court order, please send it through [secure link], and our team will review it.

Minor says consent is unsafe to request.

You don't have to ask a parent. You can keep using [parts that don't need consent]. If you are not safe at home, here are people who can help: [crisis and child-safety resources]. I can also send this to our safety team if you want. [Route immediately under escalation policy. Do not disclose to the parent.]

User asks to email a copy of ID.

Please don't send ID by email or chat. It isn't safe, and we can't accept it here. Use this secure link instead: [link].

Drafting notes.

• Flow A follows the amended 16 C.F.R. Part 312, including its neutral-screen language in the mixed audience definition.
• Flow B step 2 reflects New York's rule as the Attorney General describes it, that a platform may not block general access because consent was declined, and § 1504. Florida works differently: under-14s must be excluded from accounts.
• Step 4 reflects the same New York description. Step 7 reflects Ohio, as described in Yost. Step 8 reflects Tennessee.
• Language access: § 1506 calls for instructions in at least the twelve most common languages in New York.
• § 1503 says the New York article doesn't require special parental access. By contrast, Nebraska's parental view provisions survived in Hilgers, on the reasoning that they allow but don't mandate monitoring. That is one to discuss with counsel, because a consent screen that says "we will not share your teen's messages" may be untrue in Nebraska.
• Judge Ritz in Yost criticized one-time consent as doing little. The state may answer with periodic refresh. Your flow should make a refresh possible regardless.
• For teens' contracts and whether terms bind them, see Website Terms of Service and Online Contract Formation: Clickwrap, Browsewrap, and Enforceable Arbitration. The consent mechanics connect with the Privacy Notice Toolkit: Policy Templates, Consent Flows, and Change Management Records.

Tool 10: User-facing notices

Purpose: consistent, truthful text. Owner: counsel and content design. Timing: with each flow.

Face estimation release (Illinois-grade).

Before we continue. To estimate your age, [Vendor] will collect a short video of your face and may create measurements of your facial geometry. It does this only to estimate your age. [Vendor] will permanently delete this data no later than [time], and its retention schedule is at [link]. We receive only a result. Do you give written consent? [I consent] [Use a different method]

Document check screen.

You'll need a photo of a government-issued ID. [Vendor] checks that it's genuine and reads your date of birth. You may cover [fields], if your method allows it. [Vendor] deletes the image [time]. If the automatic check fails and you ask for human review, a trained reviewer at [Vendor] may view it for up to [time]. We never see it.

State restriction notice.

[Service] is not available in [State] at this time because of [Statute]. If you believe you've reached this page by mistake, contact [link]. To learn more or tell your legislators what you think, see [link to neutral information].

Failed-check notice.

We couldn't confirm your age. This can happen for many reasons, including lighting or camera quality. You can try [other method] or ask for review at [link]. You won't be charged, and this result doesn't appear anywhere else.

Under-13 report response.

Thanks for letting us know. [Service] isn't for children under 13 [without a parent's consent]. We have paused this account and will delete information it holds unless a parent contacts us at [link] within [days].

Drafting notes. Under 15 U.S.C. § 45, each statement above is a representation you must keep true. Test the deletion claim. Don't say "we never store" if the vendor does. "We never see it" is only safe if your own support staff also can't. See Privacy Policies, Notices, and Consent: Drafting Disclosures That Are True and Survive the FTC. Note the blocked-state notice tells people nothing about how to get around the block. Keep it that way. A minor can't be assumed to have the capacity to give the Illinois-style release, so route those under 18 to a non-biometric path or a parent's release, with advice.

Tool 11: Minors' feature review

Purpose: a repeatable pre-launch review for anything a minor can reach. Owner: product, trust and safety, counsel. Timing: at design, before launch.

Feature: [ ]. Date: [ ]. Reviewers: [ ].

Decision: Ship / change / hold. Reasons: [ ].

Drafting notes. Write this form plainly, because it may be read aloud later. Avoid speculation about harm you have no evidence for, and avoid euphemisms for harm you do have evidence for. Design-claim cases don't all come out the same way. Compare Anderson v. TikTok, Inc., 116 F.4th 180 (3d Cir. 2024), with Doe v. Grindr Inc., 128 F.4th 1148 (9th Cir. 2025), and Patterson v. Meta Platforms, Inc., 2025 NY Slip Op 04385. The vague "best interests" standard was enjoined in NetChoice, LLC v. Bonta, 170 F.4th 744 (9th Cir. 2026), so this form asks concrete questions instead. For the moderation side, see the Platform Liability Toolkit: Terms of Service, Notice Procedures, and Litigation Defenses.

Tool 12: App store signal table and release gate

Purpose: code-level handling of age signals and a release check. Owner: mobile lead. Timing: at implementation and each release.

Release gate (one question each, answered by the release manager):

1. Does this release change our terms or privacy policy?
2. Does it add monetization or new purchase opportunities?
3. Does it materially change functionality or user experience?
4. Does it change the data we collect or share about minors?
5. Does it change our age rating or content descriptors?

Any "yes" goes to counsel. Then decide: store notice, refreshed consent, or rating update.

Drafting notes. The bands above follow Texas's categories as commonly summarized (under 13, 13 to 15, 16 to 17, adult); check them against the text of Tex. Bus. & Com. Code ch. 121 and each other state. Questions 1 to 3 track § 121.053 as discussed in Students Engaged in Advancing Texas v. Paxton, No. 25-51073, where the panel read "materially changes" with reference to whether a change could influence a parent's decision. Question 5 relates to the developer protection in § 121.056(b) for using widely adopted standards consistently and in good faith, so write down the standard you chose. Utah's act, as amended, reportedly narrows "significant change," and Utah's enforcement is now through private suits, so your exposure there is different. Federal bills, such as H.R. 3149, may change this table. Keep age bands out of analytics, in line with the use limits. See also Legal Issues for Mobile Applications: Privacy.

Tool 13: Attorney general inquiry plan

Purpose: a 48-hour plan after a civil investigative demand, subpoena, or warning letter. Owner: general counsel. Timing: adopt now; use on receipt.

Hour 0 to 4

• Log receipt: who, when, how, and the deadline.
• Notify counsel and the executive sponsor.
• Issue a legal hold covering product decisions, age-check logs, vendor records, user reports of minors, and marketing about audience.

Hour 4 to 24

• Compare the demand with the statutory authority. Ohio, for example, allows investigation on "reason to believe" and subpoena enforcement in common pleas court.
• Pull Tool 1, Tool 3, and the decision memos.
• Check whether an injunction covers you.
• Find any cure period and its conditions.
• Notify insurers.
• Ask the vendor to preserve relevant records, consistent with deletion duties.

Hour 24 to 48

• Call the assistant attorney general to introduce counsel and discuss scope and timing.
• Decide whether voluntary changes should be made now, and record why.
• Assess any federal action, removal, or abstention issue before anything else is filed.

Hold notice excerpt.

Effective immediately, do not delete, alter, or discard materials relating to [age checks, minors' accounts, parental consent, product features for minors, marketing to young users, and communications with regulators]. Automatic deletion of ID images and verification data required by law or policy shall continue unless counsel instructs otherwise.

Drafting notes. The final sentence of the hold matters, because a hold that suspends deletion of ID images can itself violate a retention ban. Have counsel handle the conflict directly and document it. On removal, Attorney General of Florida v. Snap Inc., No. 25-12814 (11th Cir. Oct. 14, 2026), ordered remand after rejecting federal officer and diversity theories. On abstention, the companion Florida decision applied Younger v. Harris, 401 U.S. 37 (1971), and found the federal case had moved past its embryonic stage. A company that hasn't sued yet may lose that route once the state files. Civil penalties and procedures vary widely; the COPPA enforcement route under § 6504 requires notice to the FTC, so ask whether the agency is also involved.

Tool 14: As-applied declaration outline

Purpose: a fact declaration that survives the objections made in recent cases. Owner: litigation counsel and a business witness. Timing: before moving for a preliminary injunction.

1. Declarant. Name, role, personal knowledge.
2. The service. What it does, who uses it, how it makes money, in concrete terms.
3. Speech on the service. What users post and read; specific examples, including minors' uses of value.
4. Editorial choices, if any. How content is selected and displayed, and whether humans set rules. Describe the actual algorithm.
5. Coverage. Why the statute reaches this service, by element. Why the exemptions don't help, or how they favor rival subject matter.
6. What compliance requires. Specific system changes, with dates.
7. Cost. Dollars, per user and overall, with sources. How it compares with revenue per user. Why it is unrecoverable (sovereign immunity).
8. Lost speech. Estimated drop-off among adults and minors, with data. Any prior experience with friction.
9. Privacy consequences. Data the law forces you to collect, and risks.
10. Enforcement threat. Statements from the state, letters, suits against others, refusal to disavow.
11. Timing. When decisions must be made, and why waiting does irreparable harm.
12. Alternatives considered. Why redesign, exclusion, or blocking doesn't avoid the harm, or what each costs in speech.
13. Existing tools. Parental controls and safety features.

Drafting notes.

• Items 7 and 12 address Judge Clay's dissent in Skrmetti, which faulted general statements and treated exclusion of minors as undercutting cost claims. The majority held such costs and chill can be irreparable, but left the weighing to the district court.
• Item 4 answers Bonta, 152 F.4th 1002, which distinguished algorithms carrying editorial direction from those responding solely to user behavior, and Moody v. NetChoice, LLC, 603 U.S. 707 (2024).
• Item 5 uses the reasoning in Yost and Hilgers on exemptions. If the statute's coverage is function-only, prepare for the Eleventh Circuit's content-neutrality analysis under TikTok Inc. v. Garland, 604 U.S. 56 (2025).
• Judge Newsom's concurrence in the Florida case raises whether West Virginia v. B.P.J. limits as-applied claims under intermediate scrutiny. Preserve a facial alternative, and if you bring one, supply what United States v. Hansen, 599 U.S. 762 (2023), and Moody require: the law's full range of applications and a comparison.
• If you sue as an association, the Eleventh and Ninth Circuits differ on how far members must take part. Consider adding a member as a plaintiff.
• A state defending the law will ask for your records. Expect discovery into membership and operations, as NetChoice v. Murrill, No. 3:25-cv-00231 (M.D. La. Sept. 16, 2025), illustrates, and see NetChoice LLC v. Reyes, No. 2:23-cv-00911 (D. Utah July 22, 2024), on the limits of a Section 230 preemption claim brought as a sword. Combine with Preliminary Injunctions and Temporary Restraining Orders: Emergency Relief in Federal Court.

Tool 15: Monitoring calendar

Purpose: make sure someone looks. Owner: counsel or compliance lead. Timing: set now.

Drafting notes. These dates come from the statutes and public reports of the 2026 amendments in Utah and Louisiana. Confirm each against the enrolled text. For the COPPA side, the Children's and Student Privacy Toolkit: COPPA, FERPA, and Age-Appropriate Design has complementary forms.

Related Documents

Related Articles

• Age Verification and Minors Online After Free Speech Coalition v. Paxton: What States Can Require of Websites and Apps: the doctrine behind these forms.
• Data Breach Class Actions: Article III Standing, Negligence Claims, and Forensic Report Privilege: the suit that follows a leak of ID data.

Related Guides

• Deciding Whether Your Website or App Must Verify Age: A Practical Guide: when to use each tool.
• Building a Vendor and Third-Party Risk Management Program: the program around Tools 6 and 7.
• Developing a Privacy Compliance Program: where Tool 8 lives.

Related Checklists

• Minors Online Compliance Checklist: A Practical Checklist: the task list that assigns these forms.
• Vendor Cybersecurity Diligence Checklist: A Practical Checklist: a general companion to Tool 6.

Related Toolkits

• Biometric Privacy Toolkit: Retention Policies, Consent Forms, and Vendor Terms: deeper biometric forms.
• Children's and Student Privacy Toolkit: COPPA, FERPA, and Age-Appropriate Design: complementary children's privacy forms.
• Privacy Notice Toolkit: Policy Templates, Consent Flows, and Change Management Records: notice and consent records.
• Video Privacy Toolkit: Consent Language, Pixel Audits, and Litigation Response: pixel audits that also catch age-data leakage.
• Data Breach Litigation Toolkit: Privileged Investigation Protocols, Standing Motions, and Settlement Terms: if verification data is exposed.