Companies Face Influx of Conflicting Age Verification Laws

Companies are preparing for a wave of state laws requiring online service providers to verify users’ ages and limit minors’ access to certain services and content.

The laws seek to fill the gap in federal protections for minors online, which haven’t been updated since 1998 and only cover children 13 and under. State legislators have proposed at least 18 new age verification laws already this year, while several existing laws on age-verification have been enjoined by the tech industry’s court challenges and await reconsideration by appeals courts.

The patchwork created by states has fueled a compliance nightmare for companies rife with uncertainty about which technologies regulators will approve and how requirements will be enforced.

“There are so many questions to sort out for these companies just to know what’s actually required,” said Mark Brennan, partner at Hogan Lovells. “It’s an area where tech and online services companies have continued to put additional attention and resourcing to understand the requirements.”

Evolving Landscape

Lawmakers’ approaches to age verification have evolved in response to losses at court. Previous efforts largely focused on “age-appropriate design” codes that require platforms to provide extra privacy and safety features to minors. But the model drew swift court challenges from tech industry groups. California, the first state to pass an age-appropriate design code, is currently appealing a court decision blocking the law. Despite the uncertainty, Vermont, Nebraska, and Maryland passed similar codes last year, and New Hampshire lawmakers introduced copycat legislation this month.

The newest wave of legislation, however, focuses on device-level age verification. This group of bills focuses on requiring app stores to send signals inferring user ages to apps in order to verify them. So-called app store laws are set to go into effect in Utah and Louisiana later this year, while a similar law in Texas slated for enforcement Jan. 1 was blocked by the courts.

“It still remains to be seeing what exactly people will jump behind,” said Daniel Hales, policy counsel at the Future of Privacy Forum. “Litigation factors will definitely play a role in what is ultimately settled on in this domain.”

Compliance Woes

Adding to the complex environment, most state laws broadly require the form of age verification used be only “commercially reasonable,” leaving companies unclear as to what vendors might meet that standard.

“There seems to be a variety of technologies that are trying to solve the challenge of protecting data, especially sensitive data that may be required for more intrusive forms of age verification or age assurance,” said Hales. “But at the same time, there isn’t a clear silver bullet out there for solving that challenge.”

Rulemaking mandated by some laws, including New York’s SAFE for Kids Act and the Utah App Store Accountability Act, could provide additional guidance, as well as additional compliance burdens.

Some companies have been driven by global requirements in the United Kingdom and Australia, as well as heightened scrutiny from US law enforcement, to start using age verification in the US. Earlier this month, Roblox Corporation, which has been the subject of investigations and lawsuits by state attorneys general, rolled out mandatory age verification via facial estimation or government identification to all users accessing the platform’s chat feature.

Scaling age verification systems across jurisdictions comes with compliance questions of its own said Brennan, who advises global companies. Companies must weigh use of the technology against other local privacy laws, including biometric privacy, data minimization, and cross-border data transfers.

Moreover, smaller companies may find themselves taking on costly measures. Nonprofit economic policy group Engine estimated in a 2024 paperthat implementing age verification technology for even a small startup would cost at least $500,000 dollars.

Patrick Austin, a Richmond-based attorney at Woods Rogers, has seen the complications as clients sought to comply with revisions to the Virginia Consumer Data Protection Act, which were effective Jan. 1 and create social media time limits for users under 16.

Smaller companies with fewer resources may face greater financial hurdles for compliance and feel constrained to cheaper, less rigorous vendors, he said.

Legal Battles

The legal battle over these laws will see several flash points this year. States can expect more legal challenges as new laws are introduced and go into effect, said Ambika Kumar, partner at Davis Wright Tremaine LLP.

Along with California, Mississippi, Texas and Utah are challenging court injunctions of their kids safety laws, with appeals set before the Fifth, Tenth, and Ninth circuits. Challenges could set up potential legal precedents lawmakers will have to weigh when crafting new legislation in order to avoid similar legal challenges.

The hearings come on the heals of a decision in Free Speech Coalition v. Paxton in which the Supreme Court affirmed the Texas law’s use of age verification to restrict access to online porn sites. The high court did not not weigh in on the constitutionality of requiring age verification more broadly.

The court is unlikely to weigh in on the issue again this year, said Kumar. It already denied a petition from Mississippi for an emergency stay on its age-verification law. Congress, which has introduced but not passed age verification legislation, has also left companies with a federal guidance vacuum.

“The main problem is that Congress won’t act on these issues which creates the complexity of different requirements,” said Kumar, who represented plaintiffs challenging age-verification laws in California, Utah and Texas.