Identifying Minors Online

Changes from January 2, 2024 to June 10, 2024

This page shows textual changes in the document between the two versions indicated in the dates above. Textual matter removed in the later version is indicated with ~~red strikethrough~~ and textual matter added in the later version is indicated with blue.

Identifying Minors Online
~~January 2~~June 10, 2024 , 2024
Concerns about potential harms to minors on the internet, particularly on social media platforms, Concerns about potential harms to minors on the internet, particularly on social media platforms,
have grown in recent years. have grown in recent years. ~~Since at least~~Dating to the 1990s, policymakers have enacted legislation the 1990s, policymakers have enacted legislation
seeking Clare Y. Cho
~~seeking~~ to protect minors online, some of which create requirements for entities that provide to protect minors online, some of which create requirements for entities that provide
websites, Specialist ~~Analyst~~ in Industrial in Industrial
~~websites,~~ mobile applications, and online platforms (collectively, website operators). mobile applications, and online platforms (collectively, website operators).
Organization and Business Organization and Business

Policy Website operators have developed various methods to determine users’ ages, often in response to Website operators have developed various methods to determine users’ ages, often in response to
federal or state legislation. Some commonly used methods include (1) relying on self-federal or state legislation. Some commonly used methods include (1) relying on self-

identification, such as requiring a user to provide their date of birth or check a box to indicate the identification, such as requiring a user to provide their date of birth or check a box to indicate the
user is of a certain age; (2) requesting documentation, such as a photo identification (ID) or a digitized driver’s license user is of a certain age; (2) requesting documentation, such as a photo identification (ID) or a digitized driver’s license
containing the user’s name and age; and (3) using consumer data, such as analyzing user content posted on the website or an containing the user’s name and age; and (3) using consumer data, such as analyzing user content posted on the website or an
image of the user’s face. Each of these age verification methods presents different advantages and challenges. For example, image of the user’s face. Each of these age verification methods presents different advantages and challenges. For example,
everyone can provide a date of birth, but a website operator cannot verify that information without additional data or everyone can provide a date of birth, but a website operator cannot verify that information without additional data or
documentation. A website operator that receives a user’s government-issued photo ID might be assured that the individual documentation. A website operator that receives a user’s government-issued photo ID might be assured that the individual
meets a minimum age requirement, but not everyone has a government-issued photo ID. This might also raise consumer data meets a minimum age requirement, but not everyone has a government-issued photo ID. This might also raise consumer data
privacy concerns, depending on how the information is privacy concerns, depending on how the information is ~~stored and shared~~shared and stored. .
Some Members of Congress have proposed increasing protections for minors online by implementing additional Some Members of Congress have proposed increasing protections for minors online by implementing additional
requirements for website operators. Website operators might respond by (1) implementing changes for all users; (2) requirements for website operators. Website operators might respond by (1) implementing changes for all users; (2)
implementing changes for individuals identified as minors, potentially using one of the methods mentioned above; (3) no implementing changes for individuals identified as minors, potentially using one of the methods mentioned above; (3) no
longer offering certain services; or (4) no longer offering the entire service in the United States. longer offering certain services; or (4) no longer offering the entire service in the United States.
If Congress chooses not to address age verification methods used by website operators in legislation, website operators might If Congress chooses not to address age verification methods used by website operators in legislation, website operators might
still develop and implement new age verification methods in response to public scrutiny, lawsuits, and laws enacted by states still develop and implement new age verification methods in response to public scrutiny, lawsuits, and laws enacted by states
and other countries. If Congress wishes to address age verification in legislation, some potential options include the and other countries. If Congress wishes to address age verification in legislation, some potential options include the
following: following:
• • Supporting research on age verification. Congress could, for example, provide funding for or direct a Congress could, for example, provide funding for or direct a
federal agency to conduct research federal agency to conduct research related to age verification. This might help inform Congress for future legislative action. Website . This might help inform Congress for future legislative action. Website
operators would be able to continue using a wide range of age verification operators would be able to continue using a wide range of age verification methods. The Kids Online Safety Act (H.R. 7891, S. 1409), for example, would direct some~~methods. Some bills, such as the~~
~~Kids Online Safety Act (S. 1409), would require~~ federal agencies to conduct a study evaluating methods federal agencies to conduct a study evaluating methods ~~for~~
~~developing an age verification system, in addition to implementing requirements for online platforms~~to verify age at the device or operating system level..
• • Directing a federal agency to issue guidance or regulations. An agency could, for example, provide An agency could, for example, provide
criteria that are to be considered in the development of age verification methods. This could influence the criteria that are to be considered in the development of age verification methods. This could influence the
age verification methods that website operators develop and use. A consideration might include how much age verification methods that website operators develop and use. A consideration might include how much
authority to provide the agency. authority to provide the agency. ~~Some bills, such as the~~The Kids PRIVACY Act (H.R. 2801), Kids PRIVACY Act (H.R. 2801), for example, would direct the would direct the
Federal Trade Commission to promulgate regulations requiring a risk-based approach to determine the age Federal Trade Commission to promulgate regulations requiring a risk-based approach to determine the age
of a userof a user~~, in addition to implementing requirements for online platforms~~..
• • Requiring or prohibiting certain age verification methods. Website operators’ responses would likely Website operators’ responses would likely
depend on the number and type of options specified. Allowing operators to use various forms of age depend on the number and type of options specified. Allowing operators to use various forms of age
verificationverification, for example, might not address Congress’s concerns or may raise new ones. Limiting the methods operators might not address Congress’s concerns or may raise new ones. Limiting the methods operators
can use might increase the likelihood that they are unable or unwilling to determine a user’s age. can use might increase the likelihood that they are unable or unwilling to determine a user’s age. ~~Some~~
~~bills, such as the~~The Protecting Kids on Social Media Act (S. 1291), Protecting Kids on Social Media Act (S. 1291), for example, would require social media platforms to would require social media platforms to
take “reasonable steps beyond merely requiring attestationtake “reasonable steps beyond merely requiring attestation~~,” in addition to other requirements~~” and direct the Department of Commerce to establish a pilot program to provide secure digital identification credentials..
• • Implementing or supporting a government age verification system. Legislative options could include Legislative options could include
directing a federal agency to develop a system to help confirm users’ ages or incentivize states to directing a federal agency to develop a system to help confirm users’ ages or incentivize states to
implement an age verification system. Some considerations might include which agency would be best implement an age verification system. Some considerations might include which agency would be best
suited to provide the system and what information would be provided to whom.suited to provide the system and what information would be provided to whom.
Some general considerations for Congress might include (1) who should be responsible for determining an individual’s age Some general considerations for Congress might include (1) who should be responsible for determining an individual’s age
online, (2) how would legislation on age verification be implemented and what are the potential effects, and (3) how an entity online, (2) how would legislation on age verification be implemented and what are the potential effects, and (3) how an entity
conducting age verification online can confirm that individuals are who they claim to be. conducting age verification online can confirm that individuals are who they claim to be.
Congressional Research Service Congressional Research Service

Identifying Minors Online

oncerns about potential harms to minors using the internet have grown over the last few oncerns about potential harms to minors using the internet have grown over the last few
years. Surveys conducted by the Centers for Disease Control and Prevention have found years. Surveys conducted by the Centers for Disease Control and Prevention have found
C that the percentage of high school students considering suicide and experiencing persistent C that the percentage of high school students considering suicide and experiencing persistent
feelings of sadness increased over the last decade, particularly for females.1 Some studies, feelings of sadness increased over the last decade, particularly for females.1 Some studies,
including internal research conducted by website operators,2 suggest that although some minors including internal research conducted by website operators,2 suggest that although some minors
benefit from using social media, some minors are harmed.3 The Biden Administration created an benefit from using social media, some minors are harmed.3 The Biden Administration created an
interagency task force on kids’ online health and safety to “identify current and emerging risks of interagency task force on kids’ online health and safety to “identify current and emerging risks of
harm to minors associated with online platforms.”4 harm to minors associated with online platforms.”4
Congress has enacted legislation seeking to protect minors online. Some of the legislation creates Congress has enacted legislation seeking to protect minors online. Some of the legislation creates
requirements for website operators:5 requirements for website operators:5
• The Children’s Online Privacy Protection Act of 1998 (COPPA) requires • The Children’s Online Privacy Protection Act of 1998 (COPPA) requires
operators of online services that collect personal information and that are directed operators of online services that collect personal information and that are directed
to, or knowingly collect data from, children under 13 years of age to notify users to, or knowingly collect data from, children under 13 years of age to notify users
about the data collection, obtain advance parental consent for the collection, and about the data collection, obtain advance parental consent for the collection, and
maintain “reasonable procedures” to protect the data.6 maintain “reasonable procedures” to protect the data.6
• The PROTECT Our Children Act of 2008 requires providers of electronic • The PROTECT Our Children Act of 2008 requires providers of electronic
communication services and remote computing services to report information communication services and remote computing services to report information
related to child sexual abuse material (CSAM) to the CyberTipline operated by related to child sexual abuse material (CSAM) to the CyberTipline operated by
the National Center for Missing and Exploited Children, which provides the the National Center for Missing and Exploited Children, which provides the
information to law enforcement.7 Providers are not required to monitor users and information to law enforcement.7 Providers are not required to monitor users and
content or “affirmatively search, screen, or scan” for CSAM.8 content or “affirmatively search, screen, or scan” for CSAM.8

1 From 2011 to 2021, the percentage of high school students who seriously considered attempting suicide increased 1 From 2011 to 2021, the percentage of high school students who seriously considered attempting suicide increased
from 16% to 22% (19% to 30% for females, 13% to 14% for males), and the percentage who experienced persistent from 16% to 22% (19% to 30% for females, 13% to 14% for males), and the percentage who experienced persistent
feelings of sadness or hopelessness increased from 28% to 42% (36% to 57% for females, 21% to 29% for males). See feelings of sadness or hopelessness increased from 28% to 42% (36% to 57% for females, 21% to 29% for males). See
Centers for Disease Control and Prevention, Centers for Disease Control and Prevention, Youth Risk Behavior Survey: Data Summary and Trends Report, 2011-
2021, pp. 58-70, https://www.cdc.gov/healthyyouth/data/yrbs/yrbs_data_summary_and_trends.htm. , pp. 58-70, https://www.cdc.gov/healthyyouth/data/yrbs/yrbs_data_summary_and_trends.htm.
2 This report uses the term 2 This report uses the term website to refer to websites, online platforms, and mobile applications, and the term to refer to websites, online platforms, and mobile applications, and the term website
operator for the entities that provide these websites. for the entities that provide these websites.
3 For example, see U.S. Surgeon General Vivek Murthy, 3 For example, see U.S. Surgeon General Vivek Murthy, Social Media and Youth Mental Health: The U.S. Surgeon
General’s Advisory, U.S. Department of Health and Human Services, 2023, https://www.hhs.gov/sites/default/files/sg-, U.S. Department of Health and Human Services, 2023, https://www.hhs.gov/sites/default/files/sg-
youth-mental-health-social-media-advisory.pdf; Department of Science, Innovation, and Technology and Department youth-mental-health-social-media-advisory.pdf; Department of Science, Innovation, and Technology and Department
of Digital, Culture, Media, and Sport, “Online Harms Research Publications: December 2022,” U.K. Government, of Digital, Culture, Media, and Sport, “Online Harms Research Publications: December 2022,” U.K. Government,
December 13, 2022, https://www.gov.uk/government/publications/online-harms-research-publications-december-2022; December 13, 2022, https://www.gov.uk/government/publications/online-harms-research-publications-december-2022;
and Georgia Wells, Jeff Horwitz, and Deepa Seetharaman, “The Facebook Files: Facebook Knows Instagram Is Toxic and Georgia Wells, Jeff Horwitz, and Deepa Seetharaman, “The Facebook Files: Facebook Knows Instagram Is Toxic
for Teen girls, Company Documents Show,” for Teen girls, Company Documents Show,” Wall Street Journal, September 14, 2021, https://www.wsj.com/articles/, September 14, 2021, https://www.wsj.com/articles/
facebook-knows-instagram-is-toxic-for-teen-girls-company-documents-show-11631620739. facebook-knows-instagram-is-toxic-for-teen-girls-company-documents-show-11631620739.
4 White House, “Fact Sheet: Biden-Harris Administration Announces Actions to Protect Youth Mental Health, Safety, 4 White House, “Fact Sheet: Biden-Harris Administration Announces Actions to Protect Youth Mental Health, Safety,
and Privacy Online,” May 23, 2023, https://www.whitehouse.gov/briefing-room/statements-releases/2023/05/23/fact-and Privacy Online,” May 23, 2023, https://www.whitehouse.gov/briefing-room/statements-releases/2023/05/23/fact-
sheet-biden-harris-administration-announces-actions-to-protect-youth-mental-health-safety-privacy-online/. The sheet-biden-harris-administration-announces-actions-to-protect-youth-mental-health-safety-privacy-online/. The
National Telecommunications and Information Administration (NTIA) published a request for public comment on National Telecommunications and Information Administration (NTIA) published a request for public comment on
behalf of the task force. See NTIA, “Initiative to Protect Youth Mental Health, Safety, and Privacy Online,” 88 behalf of the task force. See NTIA, “Initiative to Protect Youth Mental Health, Safety, and Privacy Online,” 88 Federal
Register 67733, October 2, 2023, https://www.federalregister.gov/documents/2023/10/02/2023-21606/initiative-to- 67733, October 2, 2023, https://www.federalregister.gov/documents/2023/10/02/2023-21606/initiative-to-
protect-youth-mental-health-safety-and-privacy-online. protect-youth-mental-health-safety-and-privacy-online.
5 An example of legislation Congress has enacted that does not create requirements for website operators is the 5 An example of legislation Congress has enacted that does not create requirements for website operators is the
Protecting Children in the 21st Century Act, which implemented a nationwide program to increase public awareness Protecting Children in the 21st Century Act, which implemented a nationwide program to increase public awareness
and provide education on strategies to promote safe use of the internet by children (P.L. 110-385, Title II, §§201-216; and provide education on strategies to promote safe use of the internet by children (P.L. 110-385, Title II, §§201-216;
15 U.S.C. §§6551-6555). 15 U.S.C. §§6551-6555).
6 P.L. 105-277, Division C, Title XIII, §§1301-1308; 15 U.S.C. §§6501-6506. 6 P.L. 105-277, Division C, Title XIII, §§1301-1308; 15 U.S.C. §§6501-6506.
7 P.L. 110-401, Title V, §§501-5037 P.L. 110-401, Title V, §§501-503 (has been amended twice: P.L. 115-395, P.L. 118-59); 18 U.S.C. §§2258A-2258E. ; 18 U.S.C. §§2258A-2258E.
8 Legislation requiring website operators to actively search for content might raise constitutional concerns under the 8 Legislation requiring website operators to actively search for content might raise constitutional concerns under the
(continued...) (continued...)
Congressional Research Service Congressional Research Service

1 1

Identifying Minors Online

Congress has held hearings and bills have been introduced proposing to increase protections for Congress has held hearings and bills have been introduced proposing to increase protections for
minors online by implementing additional requirements for website operators.9 Several states minors online by implementing additional requirements for website operators.9 Several states
have enacted laws creating requirements for websites that provide material intended for or likely have enacted laws creating requirements for websites that provide material intended for or likely
to be accessed by minors and for websites that provide material that is deemed harmful to minors to be accessed by minors and for websites that provide material that is deemed harmful to minors
in the legislation.10 Courts have ruled that some of these state laws likely violate the First in the legislation.10 Courts have ruled that some of these state laws likely violate the First
Amendment.11 In addition, some federal laws seeking to protect minors online have been deemed Amendment.11 In addition, some federal laws seeking to protect minors online have been deemed
unconstitutional under the First Amendment by federal courts.12 unconstitutional under the First Amendment by federal courts.12
A consideration for implementing requirements for website operators might include whether A consideration for implementing requirements for website operators might include whether
operators are able to identify minors. Some bills introduced in the 118th Congress and state laws operators are able to identify minors. Some bills introduced in the 118th Congress and state laws
require or would likely incentivize website operators to implement age verification methods.13 require or would likely incentivize website operators to implement age verification methods.13
This report discusses some methods used by website operators to determine users’ ages and This report discusses some methods used by website operators to determine users’ ages and
potential trade-offs associated with each method. It also analyzes selected legislative options to potential trade-offs associated with each method. It also analyzes selected legislative options to
address age verification and provides some considerations for Congress related to age verification address age verification and provides some considerations for Congress related to age verification
and protecting minors online. and protecting minors online.
Methods Used to Identify Minors Online
No federal statute explicitly requires website operators to determine the age of individuals who No federal statute explicitly requires website operators to determine the age of individuals who
use their websites. Nevertheless, some website operators have developed age verification use their websites. Nevertheless, some website operators have developed age verification
methods or use methods provided by third parties to prevent minors from accessing their methods or use methods provided by third parties to prevent minors from accessing their
websites,14 often in response to federal and state laws. Some examples websites,14 often in response to federal and state laws. Some examples of age verification methods include the following: include the following:

Fourth Amendment. For more information, see CRS Legal Sidebar LSB10713, Fourth Amendment. For more information, see CRS Legal Sidebar LSB10713, The Fourth Amendment and the
Internet: Legal Limits on Digital Searches for Child Sexual Abuse Material (CSAM), by Michael A. Foster. , by Michael A. Foster.
9 For example, see U.S. Congress, Senate Committee on the Judiciary, 9 For example, see U.S. Congress, Senate Committee on the Judiciary, Protecting Our Children Online, hearing, 118th , hearing, 118th
Cong., 1st sess., February 14, 2023, S. Hrg. 118-028 (Washington, DC: GPO, 2023), https://www.govinfo.gov/content/Cong., 1st sess., February 14, 2023, S. Hrg. 118-028 (Washington, DC: GPO, 2023), https://www.govinfo.gov/content/
pkg/CHRG-118shrg52253/pdf/CHRG-118shrg52253.pdf. pkg/CHRG-118shrg52253/pdf/CHRG-118shrg52253.pdf.
10 For example, see California Age-Appropriate Design Code ( 10 For example, see California Age-Appropriate Design Code (California Civil Code, Division 3, Part 4, Title 1.81.47, , Division 3, Part 4, Title 1.81.47,
https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&title=1.81.47.&part=4.&https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&title=1.81.47.&part=4.&
chapter=&article=); and Utah Social Media Regulation Act (chapter=&article=); and Utah Social Media Regulation Act (Utah Code, Title 13, Chapter 63, https://le.utah.gov/xcode/, Title 13, Chapter 63, https://le.utah.gov/xcode/
Title13/Chapter63/13-63.html). Title13/Chapter63/13-63.html).
For an overview of some state laws seeking to protect minors online, see CRS Legal Sidebar LSB11020, For an overview of some state laws seeking to protect minors online, see CRS Legal Sidebar LSB11020, Online Age
Verification (Part I): Current Context, by Eric N. Holmes. , by Eric N. Holmes.
11 For example, see CRS Legal Sidebar LSB11071, 11 For example, see CRS Legal Sidebar LSB11071, NetChoice v. Bonta and First Amendment Limits on Protecting
Children Online, by Peter J. Benson; and Skye Witley, “Online Age-Check State Law Run into Constitutional , by Peter J. Benson; and Skye Witley, “Online Age-Check State Law Run into Constitutional
Headwinds,” Headwinds,” Bloomberg Law, September 19, 2023, https://news.bloomberglaw.com/privacy-and-data-security/online-, September 19, 2023, https://news.bloomberglaw.com/privacy-and-data-security/online-
age-check-state-laws-run-into-constitutional-headwinds. age-check-state-laws-run-into-constitutional-headwinds.
12 For example, the Child Online Protection Act (P.L. 105-277, Division C, Title XIV, §§1401-1406; 47 U.S.C. §231). 12 For example, the Child Online Protection Act (P.L. 105-277, Division C, Title XIV, §§1401-1406; 47 U.S.C. §231).
For more information, see CRS Report R47049, For more information, see CRS Report R47049, Children and the Internet: Legal Considerations in Restricting Access
to Content, by Eric N. Holmes. , by Eric N. Holmes.
13 Throughout this report, the term 13 Throughout this report, the term age verification is used to discuss all methods used to determine the age of an is used to discuss all methods used to determine the age of an
individual. The term individual. The term age assurance is used as an umbrella term that includes is used as an umbrella term that includes age verification and and age estimation, which , which
consist of different methods (for example, see Age Check Certification Scheme, “ISO Working Draft Age Assurance consist of different methods (for example, see Age Check Certification Scheme, “ISO Working Draft Age Assurance
Systems Standard,” euCONSENT, November 2021, https://euconsent.eu/download/iso-working-draft-age-assurance-Systems Standard,” euCONSENT, November 2021, https://euconsent.eu/download/iso-working-draft-age-assurance-
systems-standard/). This report does not make this distinction. systems-standard/). This report does not make this distinction.
14 Examples of companies that offer age verification services include Onfido and Veratad. See Onfido, “Age 14 Examples of companies that offer age verification services include Onfido and Veratad. See Onfido, “Age
Verification,” 2023, https://onfido.com/use-cases/age-verification/; and Veratad Technologies, “Flexible, Secure Age Verification,” 2023, https://onfido.com/use-cases/age-verification/; and Veratad Technologies, “Flexible, Secure Age
Verification,” 2023, https://veratad.com/solutions/age-verification/. Verification,” 2023, https://veratad.com/solutions/age-verification/.
Congressional Research Service Congressional Research Service

2 2

Identifying Minors Online

• Some websites associated with • Some websites associated with ~~alcohol~~alcoholic beverages—such as Guinness, —such as Guinness, Budweiser, and Budweiser, and
Patron Tequila—require users to enter their birthdates to indicate that they are at Patron Tequila—require users to enter their birthdates to indicate that they are at
least 21 years old before accessing content.15 least 21 years old before accessing content.15
• Instagram, a social media platform, requires users to enter their birthdate when • Instagram, a social media platform, requires users to enter their birthdate when
creating an account to indicate that they are at least 13 years old; it provides creating an account to indicate that they are at least 13 years old; it provides
different default settings for individuals ages 13-17.16 Some users in certain different default settings for individuals ages 13-17.16 Some users in certain
countries also need to verify their age by (1) recording a video selfie that is countries also need to verify their age by (1) recording a video selfie that is
shared with Yoti,17 a company that uses artificial intelligence (AI) to conduct shared with Yoti,17 a company that uses artificial intelligence (AI) to conduct
facial estimations, or (2) uploading certain forms of identification (ID), including facial estimations, or (2) uploading certain forms of identification (ID), including
a driver’s license, passport, or birth certificate.18 a driver’s license, passport, or birth certificate.18
• Tinder, a dating app, requires users to enter their birthdate when creating an • Tinder, a dating app, requires users to enter their birthdate when creating an
account to indicate that they are at least 18 years old. account to indicate that they are at least 18 years old.19 It requires some users in It requires some users in
certain countries to certain countries to ~~provide~~verify their age by providing a copy of their driver’s license or passport a copy of their driver’s license or passport ~~to verify~~
~~their age~~; it does not allow users to verify their age with a resident card, ; it does not allow users to verify their age with a resident card,
temporary driver’s license, or student ID.temporary driver’s license, or student ID.19
• Pornhub, a platform that hosts pornographic content, requires users in Louisiana • Pornhub, a platform that hosts pornographic content, requires users in Louisiana
to verify that they are at least 18 years old using a digital ID through the LA to verify that they are at least 18 years old using a digital ID through the LA
Wallet app.Wallet app.20 Pornhub is blocking access for users in Pornhub is blocking access for users in ~~Mississippi, Virginia, and~~
~~Utah in response to laws enacted in the respective states.20~~certain states in response to state laws.21
This section discusses potential trade-offs—such as level of assurance, feasibility for operators, This section discusses potential trade-offs—such as level of assurance, feasibility for operators,
accessibility for users, and user privacy—for some methods used to identify minors online. These accessibility for users, and user privacy—for some methods used to identify minors online. These
methods are grouped into three categories: (1) users self-report their age or date of birth, (2) users methods are grouped into three categories: (1) users self-report their age or date of birth, (2) users
provide documentation to verify their age, and (3) operators or third parties use data collected provide documentation to verify their age, and (3) operators or third parties use data collected
about individuals to determine their age. about individuals to determine their age.
Self-Identification or User Attestation
Some websites require users to self-attest that they meet a minimum age requirement—such as by Some websites require users to self-attest that they meet a minimum age requirement—such as by
checking a box or providing their age or date of birth—when creating an account or accessing the checking a box or providing their age or date of birth—when creating an account or accessing the
website. This age verification method can be accomplished by all individuals and generally website. This age verification method can be accomplished by all individuals and generally
requires relatively low effort and costs for operators. However, users can easily claim to meet the requires relatively low effort and costs for operators. However, users can easily claim to meet the
~~age requirement when they do not. A website operator cannot determine whether users are~~
~~providing their actual age without additional information.~~

15 Guinness, https://www.guinness.com/en-us; Budweiser, https://us.budweiser.com/; and Patron Tequila, 15 Guinness, https://www.guinness.com/en-us; Budweiser, https://us.budweiser.com/; and Patron Tequila,
https://www.patrontequila.com/. https://www.patrontequila.com/.
16 Meta Platforms, “Introducing New Ways to Verify Age on Instagram,” June 23, 2022, https://about.instagram.com/ 16 Meta Platforms, “Introducing New Ways to Verify Age on Instagram,” June 23, 2022, https://about.instagram.com/
blog/announcements/new-ways-to-verify-age-on-instagram. blog/announcements/new-ways-to-verify-age-on-instagram.
17 Yoti, “Age Verification Should Be Just an Age,” https://www.yoti.com/business/age-verification/. 17 Yoti, “Age Verification Should Be Just an Age,” https://www.yoti.com/business/age-verification/.
18 Instagram used to allow users to confirm their age with 18 Instagram used to allow users to confirm their age with social vouching (i.e., other users confirm a user’s age) but (i.e., other users confirm a user’s age) but
stated the option was removed to make improvements on October 13, 2022. Meta Platforms, “Introducing New Ways stated the option was removed to make improvements on October 13, 2022. Meta Platforms, “Introducing New Ways
to Verify Age on Instagram,” June 23, 2022, https://about.instagram.com/blog/announcements/new-ways-to-verify-to Verify Age on Instagram,” June 23, 2022, https://about.instagram.com/blog/announcements/new-ways-to-verify-
age-on-instagram. age-on-instagram.
19 Tinder, “How Does Age Verification Work?,” https://www.help.tinder.com/hc/en-us/articles/360040592771-How- 19 Tinder, “How Does Age Verification Work?,” https://www.help.tinder.com/hc/en-us/articles/360040592771-How-
does-age-verification-work-. does-age-verification-work-.
20 20 ~~Amanda Silberling, “Pornhub Blocks Access in Mississippi, Virginia, and Utah Amid Changing Laws,” TechCrunch,~~
~~July 3, 2023, https://techcrunch.com/2023/07/03/pornhub-blocks-access-in-mississippi-virginia-and-utah-amid-~~
~~changing-laws/.~~
~~Congressional Research Service~~

3

~~link to page 7~~ ~~Identifying Minors Online~~

Adi Robertson, “Louisiana Now Requires a Government ID to Access Pornhub,” Verge, January 3, 2023, https://www.theverge.com/2023/1/3/23537226/louisiana-pornhub-age-verification-law-government-id. 21 Pornhub has restricted access in Arkansas, Mississippi, Montana, North Carolina, Utah, and Virginia (see Jon Brodkin, “Supreme Court Decides Not to Block Texas Law that Age-Gates Porn Websites,” ArsTechnica, May 1, 2024, https://arstechnica.com/tech-policy/2024/05/supreme-court-lets-texas-keep-enforcing-age-verification-law-for-porn-sites/). Congressional Research Service 3 Identifying Minors Online age requirement when they do not. A website operator cannot determine whether users are providing their actual age without additional information. Documentation
Some websites require users to provide documentation to verify their age. These often include Some websites require users to provide documentation to verify their age. These often include
government-issued documents—such as a driver’s license, passport, or birth certificate—or other government-issued documents—such as a driver’s license, passport, or birth certificate—or other
documents that provide some combination of the individual’s full name, photo, age, and date of documents that provide some combination of the individual’s full name, photo, age, and date of
birth, such as a medical record, school ID, or membership ID. A website operator has an incentive birth, such as a medical record, school ID, or membership ID. A website operator has an incentive
to accept a wide range of documents or documents that most individuals can access to increase to accept a wide range of documents or documents that most individuals can access to increase
the number of potential users. Some operators might choose not to accept certain documents to the number of potential users. Some operators might choose not to accept certain documents to
maintain a higher level of assurance. maintain a higher level of assurance.
The types of documents held by most individuals vary. For example, the number of valid The types of documents held by most individuals vary. For example, the number of valid
passports in circulation suggests that the majority of U.S. citizens do not have a passport.passports in circulation suggests that the majority of U.S. citizens do not have a passport.2122 About About
7071% of individuals residing in the United States had a driver’s license in % of individuals residing in the United States had a driver’s license in ~~2021,22~~2022,23 with over 90% with over 90%
of those ages 30-79.of those ages 30-79.2324 About About ~~2.6~~1.3% of individuals ages 14 and 15 had a driver’s license,% of individuals ages 14 and 15 had a driver’s license,2425 and the and the
~~percentage~~percentages of individuals ages 16, 17, and 18 that had a driver’s license of individuals ages 16, 17, and 18 that had a driver’s license ~~was~~were about 25%, about 25%, 4243%, and %, and
60%, respectively.60%, respectively.2526 CRS could not find similar information for other state-issued IDs. CRS could not find similar information for other state-issued IDs.
A larger number of minors have access to other documents, such as birth certificates and school A larger number of minors have access to other documents, such as birth certificates and school
IDs, but accessibility might remain an issue for some individuals. For example, although most IDs, but accessibility might remain an issue for some individuals. For example, although most
individuals born in the United States have a birth certificate, about 14% of individuals in the individuals born in the United States have a birth certificate, about 14% of individuals in the
United States in 2022 were born in a foreign country, some of which might not offer birth United States in 2022 were born in a foreign country, some of which might not offer birth
certificates.certificates.2627 While nearly all children under five in Western Europe and North America have a While nearly all children under five in Western Europe and North America have a
birth certificate, UNICEF estimates that 77% of children under five across the world have their birth certificate, UNICEF estimates that 77% of children under five across the world have their
~~births registered, with only 47% in the least developed countries.27 Similarly, some schools might~~
~~not offer a school ID, and those that do might not indicate the individual’s birthdate or age on the~~
~~school ID.~~

21 22 In 2022, 151,814,305 valid passports were in circulation, according to U.S. Department of State, Bureau of Consular In 2022, 151,814,305 valid passports were in circulation, according to U.S. Department of State, Bureau of Consular
Affairs, “Reports and Statistics,” https://travel.state.gov/content/travel/en/about-us/reports-and-statistics.html. That Affairs, “Reports and Statistics,” https://travel.state.gov/content/travel/en/about-us/reports-and-statistics.html. That
year, the number of U.S. citizens was 311,614,516, according to the Census Bureau’s American Community Survey year, the number of U.S. citizens was 311,614,516, according to the Census Bureau’s American Community Survey
one-year estimates at U.S. Census Bureau, Table K200501: Citizenship Status in the United States, one-year estimates at U.S. Census Bureau, Table K200501: Citizenship Status in the United States,
https://data.census.gov/table/ACSSE2022.K200501. This means that if each valid passport belonged to a different https://data.census.gov/table/ACSSE2022.K200501. This means that if each valid passport belonged to a different
individual, at most, 48.7% of U.S. citizens had a U.S. passport. The actual percentage may be lower; an individual can individual, at most, 48.7% of U.S. citizens had a U.S. passport. The actual percentage may be lower; an individual can
have both a passport book and card, which counts as two valid passports, and qualifying non-U.S. citizens can have a have both a passport book and card, which counts as two valid passports, and qualifying non-U.S. citizens can have a
U.S. passport. U.S. passport.
2223 U.S. Department of Transportation (DOT), Federal Highway Administration (FHWA), Office of Highway Policy U.S. Department of Transportation (DOT), Federal Highway Administration (FHWA), Office of Highway Policy
Information, Policy and Governmental Affairs, “6.Information, Policy and Governmental Affairs, “6.23.1. Licensed Drivers.1. Licensed Drivers~~, Vehicle Registrations, and Resident~~
—Ratio of Licensed Drivers to Population,” Population,” Highway Statistics Series ~~2021~~~~, December 2022~~2022, last modified on February 5, 2024, https://www.fhwa.dot.gov/policyinformation/statistics/, https://www.fhwa.dot.gov/policyinformation/statistics/
~~2021/dv1c~~2022/dl1c.cfm. .cfm.
2324 DOT, FHWA, Office of Highway Policy Information, Policy and Governmental Affairs, “6.3.2. Licensed Drivers, by DOT, FHWA, Office of Highway Policy Information, Policy and Governmental Affairs, “6.3.2. Licensed Drivers, by
Sex and Percentage in Each Age GroupSex and Percentage in Each Age Group~~, DL-20~~ (REVISED),” ,” Highway Statistics Series ~~2021~~~~, December 2022~~2022, last modified on May 6, 2024, ,
https://www.fhwa.dot.gov/policyinformation/statistics/https://www.fhwa.dot.gov/policyinformation/statistics/~~2021~~2022/dl20.cfm. /dl20.cfm.
2425 The “under 16” group is compared with 14- and 15-year-old population estimates ( The “under 16” group is compared with 14- and 15-year-old population estimates (~~see footnote 23). In most states,~~
noibid.). Ten states are estimated to have individuals younger than 16 individuals younger than 16 ~~held~~with a driver’s license in a driver’s license in ~~2021~~2022 (see DOT, FHWA, Office of Highway Policy (see DOT, FHWA, Office of Highway Policy
Information, Policy and Governmental Affairs, “6.3.3. Licensed Drivers, by State, Sex, and Age Group,Information, Policy and Governmental Affairs, “6.3.3. Licensed Drivers, by State, Sex, and Age Group, ~~DL-22,~~” ”
Highway Statistics Series ~~2021~~~~, December 2022~~2022, last modified on March 1, 2024, https://www.fhwa.dot.gov/policyinformation/statistics/, https://www.fhwa.dot.gov/policyinformation/statistics/~~2021~~2022//
dl22.cfm). dl22.cfm).
2526 Ibid. Ibid.
2627 In 2022, the number of foreign-born individuals (excluding U.S. citizens born abroad to American parent[s]) was In 2022, the number of foreign-born individuals (excluding U.S. citizens born abroad to American parent[s]) was
46,182,177, and the total U.S. population was 333,287,562, according to the Census Bureau’s American Community 46,182,177, and the total U.S. population was 333,287,562, according to the Census Bureau’s American Community
Service one-year estimate (https://data.census.gov/table/ACSSE2022.K200503)Service one-year estimate (https://data.census.gov/table/ACSSE2022.K200503).
~~27 UNICEF, “Birth Registration,” last updated June 2023, https://data.unicef.org/topic/child-protection/birth-~~
~~registration/~~. .
Congressional Research Service Congressional Research Service

4 4

link to page 8 link to page link to page 8 link to page ~~8 link to page 9~~ ~~Identifying Minors Online~~

9 Identifying Minors Online births registered, with 47% in the least developed countries.28 Similarly, some schools might not offer a school ID, and some school IDs might not indicate the individual’s birthdate or age. Some documents might be considered more reliable and harder to falsify than others. For Some documents might be considered more reliable and harder to falsify than others. For
example, the REAL ID Act prohibits federal agencies from accepting drivers’ licenses and state-example, the REAL ID Act prohibits federal agencies from accepting drivers’ licenses and state-
issued IDs unless the cards meet certain standards;issued IDs unless the cards meet certain standards;2829 enforcement is scheduled to begin on May 7, enforcement is scheduled to begin on May 7,
2025.2025.2930 In contrast, schools do not have a uniform ID system In contrast, schools do not have a uniform ID system~~, and~~; there were 98,577 public there were 98,577 public
schools, including kindergarten through high school, in the 2020-2021 school year.schools, including kindergarten through high school, in the 2020-2021 school year.3031 Schools Schools
might implement different security standards, if any, and use various designs, styles, and formats might implement different security standards, if any, and use various designs, styles, and formats
that could make it difficult to determine which school IDs are legitimate and which are fake. that could make it difficult to determine which school IDs are legitimate and which are fake.
The ability to counterfeit or falsify documents would also depend on other factors, such as the The ability to counterfeit or falsify documents would also depend on other factors, such as the
systems used to share documents. For example, an image of a driver’s license would likely be systems used to share documents. For example, an image of a driver’s license would likely be
easier to alter than a digital version of a driver’s license that is verified by a state agency, as easier to alter than a digital version of a driver’s license that is verified by a state agency, as
discussed discussed ~~in the following section,~~below in “Digital ID.” Government-issued documents are considered to ” Government-issued documents are considered to
be reliable, and often used to verify an individual’s identity. be reliable, and often used to verify an individual’s identity. ~~Thus, sharing~~Sharing government-issued government-issued
documents with other entities might raise greater privacy and identity theft concerns than sharing documents with other entities might raise greater privacy and identity theft concerns than sharing
other types of documents. other types of documents.
Digital ID
Some states offer digital IDs in the form of a digitized driver’s license and state ID Some states offer digital IDs in the form of a digitized driver’s license and state ID (Table 1).3132
These digital IDs are accessible through an app operated by the state government or a company These digital IDs are accessible through an app operated by the state government or a company
partnering with the state government, often with the state’s Department of Motor Vehicles partnering with the state government, often with the state’s Department of Motor Vehicles
(DMV). Some states allow these digital IDs to be used only at Transportation Security (DMV). Some states allow these digital IDs to be used only at Transportation Security
Administration (TSA) PreCheck entrances at certain airports;Administration (TSA) PreCheck entrances at certain airports;3233 others allow various entities— others allow various entities—
such as restaurants, bars, credit unions, and websites—to accept digital IDs. such as restaurants, bars, credit unions, and websites—to accept digital IDs.
~~Table 1. Selected Apps Providing Access to Digital IDs~~
~~Name of~~
~~Operator of~~
~~Selected Places~~
~~State~~
~~App~~
Appa
~~Accepting Digital ID~~
~~Website~~
~~Arizona~~
~~Apple Wallet~~
~~Apple~~
~~TSA~~
~~https://azdot.gov/apple-wallet~~
~~Mobile ID~~
~~IDEMIA~~
~~N/A~~
~~https://azdot.gov/mvd/services/~~
~~driver-services/mobile-id~~
~~California~~
~~CA DMV~~
~~California DMV~~
~~TSA, certain retail locations~~
~~https://www.dmv.ca.gov/portal/~~
Wallet App*
~~in Sacramento~~
~~ca-dmv-wallet/~~
~~Colorado~~
~~Apple Wallet~~
~~Apple~~
~~TSA~~
~~https://dmv.colorado.gov/~~
~~applewallet~~

28Most of the digital ID systems implemented by states thus far comply with standards set by two international organizations: the International Organization of Standardization (ISO) and the International Electrotechnical Commission (IEC).34 The ISO/IEC 18013-5 standards provide technical and functional requirements to maintain security, privacy, and interoperability for mobile drivers’ licenses.35 These standards differ from the REAL ID requirements, which were 28 UNICEF, “Birth Registration,” last updated June 2023, https://data.unicef.org/topic/child-protection/birth-registration/. 29 P.L. 109-13, Division B, Title II. For more information about REAL ID, see U.S. Department of Homeland Security P.L. 109-13, Division B, Title II. For more information about REAL ID, see U.S. Department of Homeland Security
(DHS), “About REAL ID,” last updated (DHS), “About REAL ID,” last updated ~~November 16, 2022~~May 7, 2024, https://www.dhs.gov/real-id/about-real-id. , https://www.dhs.gov/real-id/about-real-id.
~~29 As of March 26, 2021, 55 states and territories were fully compliant with the REAL ID requirements, and all states~~
~~were on track to begin issuing compliant IDs by the time enforcement begins~~30 All states, the District of Columbia, and the five territories are REAL ID compliant. See DHS, “REAL ID Frequently Asked . See DHS, “REAL ID Frequently Asked
Questions,” last updated August 30, 2023, https://www.dhs.gov/real-id/real-id-faqs. Questions,” last updated August 30, 2023, https://www.dhs.gov/real-id/real-id-faqs.
3031 The number of private schools is reported every other year and was not reported for the 2020-2021 school year; there The number of private schools is reported every other year and was not reported for the 2020-2021 school year; there
were 30,492 private schools in the 2019-2020 school year. See National Center for Education Statistics, “Educational were 30,492 private schools in the 2019-2020 school year. See National Center for Education Statistics, “Educational
Institutions,” https://nces.ed.gov/fastfacts/display.asp?id=84. Institutions,” https://nces.ed.gov/fastfacts/display.asp?id=84.
3132 In this report, a In this report, a digital ID refers to an electronic version of a government-issued document. It does not include other refers to an electronic version of a government-issued document. It does not include other
information individuals might use to identify themselves on the internet, such as usernames or sign-in information. information individuals might use to identify themselves on the internet, such as usernames or sign-in information.
~~32 American Airlines allows customers to use a mobile ID through the Digital Identity App at Transportation Security~~
~~Administration (TSA) checkpoints.~~33 For more information about using digital IDs at TSA PreCheck, see TSA, “Facial For more information about using digital IDs at TSA PreCheck, see TSA, “Facial
Recognition and Digital Identity Recognition and Digital Identity Solutions,” https://www.tsa.gov/digital-id. 34 For example, see Utah Department of Public Safety, “Utah mDL FAQs,” https://dld.utah.gov/mdlfaqs/; and Iowa Department of Transportation, “Iowa Mobile ID for Businesses, Organizations, and Agencies,” https://iowadot.gov/mvd/MID-businesses. 35 The International Organization of Standardization (ISO) and the International Electrotechnical Commission (IEC), Personal Identification – ISO-compliant Driving License – Part 5: Mobile Driving License Application, ISO/IEC 18013-5, September 2021~~Solutions,” https://www.tsa.gov/digital-id~~. .
Congressional Research Service Congressional Research Service

5 5

link to page link to page 910 Identifying Minors Online

~~Name of~~
~~Operator of~~
~~Selected Places~~
~~State~~
~~App~~
Appa
~~Accepting Digital ID~~
~~Website~~
~~myColorado~~
~~Colorado Office Certain restaurants, bars,~~
~~https://mycolorado.gov/~~
~~of Information~~
~~liquor stores~~
~~colorado-~~expanded to mobile drivers’ licenses in 2019.36 The TSA has proposed rulemaking to temporarily waive the requirement that mobile drivers’ licenses be compliant with REAL ID standards.37 Digital IDs can be compliant with both ISO/IEC 18013-5 and REAL ID standards with some minor adjustments.38 Table 1. Selected Apps Providing Access to Digital IDs Operator of Selected Places State Name of App Appa Accepting Digital ID Website Arizona Apple Wallet Apple TSA https://azdot.gov/apple-wallet Google Wallet Google TSA https://azdot.gov/google-wal et Mobile ID IDEMIA N/A https://azdot.gov/mvd/services/driver-services/mobile-id Samsung Wallet Samsung TSA https://azdot.gov/samsung-wallet California CA DMV California DMV TSA, certain retail https://www.dmv.ca.gov/portal/ca- Wallet App* locations in Sacramento dmv-wallet/ Colorado Apple Wallet Apple TSA https://dmv.colorado.gov/applewallet Google Wallet Google TSA https://dmv.colorado.gov/colorado-id-in-google-wal et myColorado Colorado Office Certain restaurants, https://mycolorado.gov/colorado- of Information bars, liquor stores digital-id digital-id
and Technology and Technology
Delaware Delaware
Mobile ID Mobile ID
IDEMIA IDEMIA
N/A N/A
https://www.dmv.de.gov/ https://www.dmv.de.gov/
mobileID/ mobileID/
Florida Florida
Smart ID* Smart ID*
Thales Thales
N/A N/A
https://www.flhsmv.gov/ https://www.flhsmv.gov/
floridasmartid/ floridasmartid/
Georgia Georgia
Apple Wallet Apple Wallet
Apple Apple
TSA TSA
https://dds.georgia.gov/ https://dds.georgia.gov/~~georgia-~~
~~licenseid/~~ga-digital-drivers-ga-digital-drivers-
license-license-~~apple~~and-id Google Wallet Google N/A https://dds.georgia.gov/digital-id-google-wal et
Iowa Iowa
Mobile ID Mobile ID
IDEMIA IDEMIA
TSA, TSA, ~~Central Iowa Vapors,~~certain retail
https://iowadot.gov/mvd/ https://iowadot.gov/mvd/
~~Dodge Family Farm~~
~~Mobile-ID~~Mobile-ID locations, restaurants, bars, credit unions
Louisiana Louisiana
LA Wallet LA Wallet
Envoc Envoc
Certain Certain ~~restaurants, bars~~retail locations, ,
https://lawallet.com/about/ https://lawallet.com/about/
~~grocery stores, convenience~~
~~stores, and~~ restaurants, bars, websites websites
Maryland Maryland
Apple Wallet Apple Wallet
Apple Apple
TSA TSA
https://mva.maryland.gov/ https://mva.maryland.gov/
Pages/Pages/
MDMobileID_Apple.aspx MDMobileID_Apple.aspx
Google Wallet Google Wallet
Google Google
TSA TSA
https://mva.maryland.gov/ https://mva.maryland.gov/
Pages/Pages/
MDMobileID_Googlewal et.MDMobileID_Googlewal et.as
px
~~Mississippi Mobile ID~~
~~IDEMIA~~
~~N/A~~
~~https://www.driverservicebure~~
~~au.dps.ms.gov/mobile-id/~~
~~Oklahoma Mobile ID~~
~~IDEMIA~~
~~N/A~~
~~https://oklahoma.gov/dps/real-~~
~~id/mobile-id.html~~
~~Utah~~
~~GET Mobile~~
~~GET North~~
~~TSA, certain credit union~~
~~https://dld.utah.gov/utahmdl/~~
~~App~~
~~America~~
~~branches, Harmons, various~~
~~state liquor stores~~
Source: Congressional Research Service (CRS).
Notes: TSA = Transportation Security Administration. *aspx 36 P.L. 116-260, Division U, Title X, §1001. 37 TSA, “Minimum Standards for Driver’s Licenses and Identification Cards Acceptable by Federal Agencies for Official Purposes; Waiver for Mobile Driver’s Licenses,” 88 Federal Register 60056, August 30, 2023, https://www.federalregister.gov/documents/2023/08/30/2023-18582/minimum-standards-for-drivers-licenses-and-identification-cards-acceptable-by-federal-agencies-for. 38 American Association of Motor Vehicle Administrators, Mobile Driver’s License (mDL) Implementation Guidelines, version 1.2, January 2023, https://aamva.org/getmedia/b801da7b-5584-466c-8aeb-f230cef6dda5/mDL-Implementation-Guidelines-Version-1-2_final.pdf. Congressional Research Service 6 link to page 10 link to page 7 link to page 9 Identifying Minors Online Operator of Selected Places State Name of App Appa Accepting Digital ID Website Mississippi Mobile ID IDEMIA N/A https://www.driverservicebureau.dps.ms.gov/mobile-id/ Utah GET Mobile GET North TSA, certain credit https://dld.utah.gov/utahmdl/ App America unions, grocery stores, liquor stores Source: CRS using information provided by state DMV websites and other websites. Notes: TSA = Transportation Security Administration. An asterisk (*) indicates that the app is currently a pilot program with indicates that the app is currently a pilot program with
limited participants. N/A indicates that the website did not specify the places where the digital ID could be used. limited participants. N/A indicates that the website did not specify the places where the digital ID could be used.
a. If a company provides support for or continues to remain involved with the app, the company is listed as a. If a company provides support for or continues to remain involved with the app, the company is listed as
the operator. The company works with the state, which manages the program itself. The state’s department the operator. The company works with the state, which manages the program itself. The state’s department
is listed as the operator if it provides support for the app and is the listed entity in the app’s terms of use.is listed as the operator if it provides support for the app and is the listed entity in the app’s terms of use.
~~Most of the digital ID systems implemented by states thus far comply with standards set by two~~
~~international organizations: the International Organization of Standardization (ISO) and the~~
~~International Electrotechnical Commission (IEC).33 The ISO/IEC 18013-5 standards provide~~
~~technical and functional requirements to maintain security, privacy, and interoperability for~~
~~mobile drivers’ licenses.34 These standards differ from the REAL ID requirements, which were~~

~~33 For example, see Utah Department of Public Safety, “Utah mDL FAQs,” https://dld.utah.gov/mdlfaqs/; and Iowa~~
~~Department of Transportation, “Iowa Mobile ID for Businesses, Organizations, and Agencies,” https://iowadot.gov/~~
~~mvd/MID-businesses.~~
~~34 The International Organization of Standardization (ISO) and the International Electrotechnical Commission (IEC),~~
Personal Identification – ISO-compliant Driving License – Part 5: Mobile Driving License Application, ISO/IEC
~~18013-5, September 2021.~~
~~Congressional Research Service~~

6

~~link to page 7 link to page 8~~ ~~Identifying Minors Online~~

~~expanded to mobile drivers’ licenses in 2019.35 The TSA has proposed rulemaking to temporarily~~
~~waive the requirement that mobile drivers’ licenses be compliant with REAL ID standards.36~~
~~Digital IDs can be compliant with both ISO/IEC 18013-5 and REAL ID standards with relatively~~
~~minimal adjustments.37~~
Some of the accessibility concerns discussed in Some of the accessibility concerns discussed in “Documentation” may be applicable to digital ay be applicable to digital
IDs. For example, because most individuals younger than 18 and nearly all individuals under 16 IDs. For example, because most individuals younger than 18 and nearly all individuals under 16
do not have a driver’s license, a mobile driver’s license would not be an option for most minors. do not have a driver’s license, a mobile driver’s license would not be an option for most minors.
However, the percentage of minors with a driver’s license or other state-issued IDs might increase However, the percentage of minors with a driver’s license or other state-issued IDs might increase
if if itthese IDs can be used to access websites. Accessibility might remain an issue for some individuals if can be used to access websites. Accessibility might remain an issue for some individuals if
the app is provided only on mobile devices, particularly for individuals who do not have access to the app is provided only on mobile devices, particularly for individuals who do not have access to
a mobile device and access the internet using computers and laptops. a mobile device and access the internet using computers and laptops.
A digital ID system might provide greater privacy protections than, for example, having A digital ID system might provide greater privacy protections than, for example, having
individuals send photos of government-issued documents to every website they wish to access. A individuals send photos of government-issued documents to every website they wish to access. A
digital ID system could allow a government agency verify an individual’s age without disclosing digital ID system could allow a government agency verify an individual’s age without disclosing
additional information to various website operators. Nevertheless, privacy concerns might depend additional information to various website operators. Nevertheless, privacy concerns might depend
on various factors, including the security of the system implemented and the amount and type of on various factors, including the security of the system implemented and the amount and type of
data the operator of a digital ID system would be able to access. There may be concern, for data the operator of a digital ID system would be able to access. There may be concern, for
example, that the operator of the system would be able to track an individual’s movements across example, that the operator of the system would be able to track an individual’s movements across
websites. The operators of the digital ID systems mentioned iwebsites. The operators of the digital ID systems mentioned in Table 1 state that they do not store state that they do not store
users’ data.users’ data.3839
A potential complication with relying on digital IDs for age verification is that most states A potential complication with relying on digital IDs for age verification is that most states
currently do not have a digital ID system that website operators can use to verify users’ ages.currently do not have a digital ID system that website operators can use to verify users’ ages.3940
However, several states have implemented digital IDs for some entities, and other states might be However, several states have implemented digital IDs for some entities, and other states might be
implementing their own systems.implementing their own systems.4041 If states rely on companies to provide their digital IDs, it If states rely on companies to provide their digital IDs, it
might raise concerns about potential unintended effects, such as whether consumers would be might raise concerns about potential unintended effects, such as whether consumers would be
encouraged to use the companies’ mobile wallets and other adjacent products.encouraged to use the companies’ mobile wallets and other adjacent products.41

~~35 P.L. 116-260, Division U, Title X, §1001.~~
~~36 TSA, “Minimum Standards for Driver’s Licenses and Identification Cards Acceptable by Federal Agencies for~~
~~Official Purposes; Waiver for Mobile Driver’s Licenses,” 88 Federal Register 60056, August 30, 2023,~~
~~https://www.federalregister.gov/documents/2023/08/30/2023-18582/minimum-standards-for-drivers-licenses-and-~~
~~identification-cards-acceptable-by-federal-agencies-for.~~
37 American Association of Motor Vehicle Administrators, Mobile Driver’s License (mDL) Implementation Guidelines,
~~version 1.2, January 2023, https://aamva.org/getmedia/b801da7b-5584-466c-8aeb-f230cef6dda5/mDL-Implementation-~~
~~Guidelines-Version-1-2_final.pdf.~~
3842 39 For example, see IDEMIA, “Mobile ID: Frequently Asked Questions,” https://na.idemia.com/dmv-2/mobile-id/. For example, see IDEMIA, “Mobile ID: Frequently Asked Questions,” https://na.idemia.com/dmv-2/mobile-id/.
3940 When this report was published, Louisiana was the only state that explicitly stated its digital ID system can be used When this report was published, Louisiana was the only state that explicitly stated its digital ID system can be used
for online identity verification (LA Wallet, “Bring Digital Verification to Your Business,” https://lawallet.com/digital-for online identity verification (LA Wallet, “Bring Digital Verification to Your Business,” https://lawallet.com/digital-
verification/). verification/).
4041 For example, see Apple, “Apple Launches the First Driver’s License and State ID in Wallet with Arizona,” Apple For example, see Apple, “Apple Launches the First Driver’s License and State ID in Wallet with Arizona,” Apple
Newsroom, last updated March 23, 2022, https://www.apple.com/newsroom/2022/03/apple-launches-the-first-drivers-Newsroom, last updated March 23, 2022, https://www.apple.com/newsroom/2022/03/apple-launches-the-first-drivers-
license-and-state-id-in-wallet-with-arizona/; and Idemia, “Mobile ID: Everything Is on Your Phone. Now Your ID Is license-and-state-id-in-wallet-with-arizona/; and Idemia, “Mobile ID: Everything Is on Your Phone. Now Your ID Is
Too,” https://na.idemia.com/dmv-2/mobile-id/. Too,” https://na.idemia.com/dmv-2/mobile-id/.
4142 Grace Broadbent, “Samsung Wallet Adds State IDs to Compete Against Apple Pay and Google Pay,” eMarketer, Grace Broadbent, “Samsung Wallet Adds State IDs to Compete Against Apple Pay and Google Pay,” eMarketer,
October 11, 2023, https://content-na1.emarketer.com/samsung-wallets-adds-state-ids-compete-against-apple-pay-October 11, 2023, https://content-na1.emarketer.com/samsung-wallets-adds-state-ids-compete-against-apple-pay-
google-pay. google-pay.
Congressional Research Service Congressional Research Service

7 7

Identifying Minors Online

Consumer Data
Consumer data can be used to estimate a user’s age on a website. Data that might be used include Consumer data can be used to estimate a user’s age on a website. Data that might be used include
conversations users have with their peers (e.g., upcoming birthday, classes), biometric data (e.g., conversations users have with their peers (e.g., upcoming birthday, classes), biometric data (e.g.,
image of a user’s face), and data provided by other entities (e.g., credit card number).image of a user’s face), and data provided by other entities (e.g., credit card number).4243 Operators Operators
of websites that host large amounts of user-generated content may be able to use information of websites that host large amounts of user-generated content may be able to use information
provided directly on the website, while others might need to rely on data provided by other provided directly on the website, while others might need to rely on data provided by other
entities, such as data brokers, or age verification services offered by third parties. entities, such as data brokers, or age verification services offered by third parties.
To estimate a user’s age, consumer data are typically analyzed using algorithms, To estimate a user’s age, consumer data are typically analyzed using algorithms, ~~artificial~~
~~intelligence (AI)~~AI, and other technologies; the accuracy depends on the system used. For example, , and other technologies; the accuracy depends on the system used. For example,
some studies suggest that facial age estimation systems can estimate age within a range but have some studies suggest that facial age estimation systems can estimate age within a range but have
difficulty distinguishing between small differences in age (e.g., whether someone is 13 or 14 difficulty distinguishing between small differences in age (e.g., whether someone is 13 or 14
years old).years old).4344 Additionally, the accuracy of these systems can be affected by factors such as facial Additionally, the accuracy of these systems can be affected by factors such as facial
expressions, makeup, color mode, and the use of props (e.g., glasses).expressions, makeup, color mode, and the use of props (e.g., glasses).4445 These systems might These systems might
perpetuate or amplify biases in the datasets they are trained on.perpetuate or amplify biases in the datasets they are trained on.4546
Using consumer data to estimate a user’s age might raise privacy concerns. Website operators and Using consumer data to estimate a user’s age might raise privacy concerns. Website operators and
third parties offering age verification services might be compelled to collect greater amounts of third parties offering age verification services might be compelled to collect greater amounts of
consumer data to develop and improve the models and systems used to estimate a user’s age. For consumer data to develop and improve the models and systems used to estimate a user’s age. For
example, some methods of facial age estimation require large datasets.example, some methods of facial age estimation require large datasets.4647 Data collection and Data collection and
tracking tools—such as cookies and pixels—have enabled various entities to collect consumer tracking tools—such as cookies and pixels—have enabled various entities to collect consumer
data on the internet, which has led some policymakers to introduce or enact comprehensive data on the internet, which has led some policymakers to introduce or enact comprehensive
consumer data privacy laws.consumer data privacy laws.4748
Consumer data privacy laws might affect the feasibility of using consumer data for age Consumer data privacy laws might affect the feasibility of using consumer data for age
verification. Comprehensive data privacy bills have been introduced in verification. Comprehensive data privacy bills have been introduced in ~~previous Congresses,48~~

42Congress,49 and 18 states 43 For example, see Lubna Takuri, “Age Verification System: How to Verify Customer Ages,” Onfido, January 24, For example, see Lubna Takuri, “Age Verification System: How to Verify Customer Ages,” Onfido, January 24,
2023, https://onfido.com/blog/age-verification-system/; Yoti, “Age Verification Should be Just an Age,” 2023, https://onfido.com/blog/age-verification-system/; Yoti, “Age Verification Should be Just an Age,”
https://www.yoti.com/business/age-verification/; and Google, “Access Age-Restricted Content and Features,” Google https://www.yoti.com/business/age-verification/; and Google, “Access Age-Restricted Content and Features,” Google
Account Help, https://support.google.com/accounts/answer/10071085?hl=en. Account Help, https://support.google.com/accounts/answer/10071085?hl=en.
4344 For example, Yoti reported that the probability that its facial age estimation system correctly identified an individual For example, Yoti reported that the probability that its facial age estimation system correctly identified an individual
age 6-11 as younger than 13 was 98.35%. The results separated by skin tone and gender indicate that, on average, the age 6-11 as younger than 13 was 98.35%. The results separated by skin tone and gender indicate that, on average, the
system estimated the ages of individuals 6-11 within a range of 2.2 years or less (based on mean absolute error for each system estimated the ages of individuals 6-11 within a range of 2.2 years or less (based on mean absolute error for each
year). Yoti, year). Yoti, Yoti Facial Age Estimation, white paper, March 2023, pp. 2, 5, https://www.yoti.com/wp-content/uploads/, white paper, March 2023, pp. 2, 5, https://www.yoti.com/wp-content/uploads/
Yoti-Age-Estimation-White-Paper-March-2023.pdf. Yoti-Age-Estimation-White-Paper-March-2023.pdf.
4445 For example, see Prachi Punyani, Rashmi Gupta, and Ashwani Kumar, “Neural Networks for Facial Age Estimation: For example, see Prachi Punyani, Rashmi Gupta, and Ashwani Kumar, “Neural Networks for Facial Age Estimation:
A Survey on Recent Advances,” A Survey on Recent Advances,” Artificial Intelligence Review, vol. 53 (2020), pp. 3299-3347, https://doi.org/10.1007/, vol. 53 (2020), pp. 3299-3347, https://doi.org/10.1007/
s10462-019-09765-w; and Tzvi Ganel, Carmel Sofer, and Melvyn Goodale, “Biases in Human Perception of Facial s10462-019-09765-w; and Tzvi Ganel, Carmel Sofer, and Melvyn Goodale, “Biases in Human Perception of Facial
Age Are Present and More Exaggerated in Current AI Technology,” Age Are Present and More Exaggerated in Current AI Technology,” Nature: Scientific Reports, vol. 12, no. 22519 , vol. 12, no. 22519
(2022), https://www.nature.com/articles/s41598-022-27009-w. (2022), https://www.nature.com/articles/s41598-022-27009-w.
4546 CRS Report R47644, CRS Report R47644, Artificial Intelligence: Overview, Recent Advances, and Considerations for the 118th
Congress, by Laurie A. Harris; and CRS Report R47569, , by Laurie A. Harris; and CRS Report R47569, Generative Artificial Intelligence and Data Privacy: A
Primer, by Kristen E. Busch. , by Kristen E. Busch.
4647 For example, facial age estimation using convolutional neural network (CNN) frameworks require very large datasets For example, facial age estimation using convolutional neural network (CNN) frameworks require very large datasets
for training; see Zichang Tan et al., “Efficient Group-n Encoding and Decoding for Facial Age Estimation,” for training; see Zichang Tan et al., “Efficient Group-n Encoding and Decoding for Facial Age Estimation,” IEEE
Transactions on Pattern Analysis and Machine Intelligence, vol. 40, no. 11 (2018), pp. 2610-2623, https://doi.org/, vol. 40, no. 11 (2018), pp. 2610-2623, https://doi.org/
10.1109/TPAMI.2017.2779808; and Oussama Guehairia et al., “Facial Age Estimation Using Tensor Based Subspace 10.1109/TPAMI.2017.2779808; and Oussama Guehairia et al., “Facial Age Estimation Using Tensor Based Subspace
Learning and Deep Random Forests,” Learning and Deep Random Forests,” Information Sciences, vol. 609 (September 2022), pp. 1309-1317, https://doi.org/, vol. 609 (September 2022), pp. 1309-1317, https://doi.org/
10.1016/j.ins.2022.07.135. 10.1016/j.ins.2022.07.135.
4748 For more information, see CRS Report R47298, For more information, see CRS Report R47298, Online Consumer Data Collection and Data Privacy, by Clare Y. , by Clare Y.
Cho and Kristen E. Busch. Cho and Kristen E. Busch.
~~48 A comprehensive data privacy bill has not been introduced in the 118th Congress, based on a search of “data privacy”~~49 For example, a discussion draft of the American Privacy Rights Act (APRA) was passed by the Subcommittee on
(continued...) (continued...)
Congressional Research Service Congressional Research Service

8 8

link to page 12 link to page link to page 12 link to page 1213 Identifying Minors Online

~~and 12 states~~ have passed comprehensive consumer data privacy laws; state laws in California, have passed comprehensive consumer data privacy laws; state laws in California,
Colorado, Connecticut, Utah, and Virginia are currently enforceable Colorado, Connecticut, Utah, and Virginia are currently enforceable (Table 2).
Table 2. Comprehensive Data Privacy Laws, by State
Name of State Law
Effective Date
Law Web Page
California Consumer Privacy California Consumer Privacy Acta
January 1, 2020 January 1, 2020
https://leginfo.legislature.ca.gov/faces/ https://leginfo.legislature.ca.gov/faces/
codes_displayText.xhtml?division=3.&part=4.&codes_displayText.xhtml?division=3.&part=4.&
lawCode=CIV&title=1.81.5 lawCode=CIV&title=1.81.5
Colorado Privacy Act Colorado Privacy Act
July 1, 2023 July 1, 2023
https://leg.colorado.gov/bil s/sb21-190 https://leg.colorado.gov/bil s/sb21-190
Connecticut Data Privacy Act Connecticut Data Privacy Act
July 1, 2023 July 1, 2023
https://www.cga.ct.gov/asp/cgabil status/ https://www.cga.ct.gov/asp/cgabil status/
cgabil status.asp?selBil Type=Bil &bil _num=cgabil status.asp?selBil Type=Bil &bil _num=
SB00006&which_year=2022 SB00006&which_year=2022
Delaware Personal Data Privacy Act Delaware Personal Data Privacy Act
January 1, 2025 January 1, 2025
https://legiscan.com/DE/text/HB154/id/2807502/ https://legiscan.com/DE/text/HB154/id/2807502/
Delaware-2023-HB154-Draft.html Delaware-2023-HB154-Draft.html
Indiana Consumer Data Protection Act Indiana Consumer Data Protection Act
January 1, 2026 January 1, 2026
https://iga.in.gov/legislative/2023/bil s/senate/5/ https://iga.in.gov/legislative/2023/bil s/senate/5/
details details
Iowa Consumer Data Protection Act Iowa Consumer Data Protection Act
January 1, 2025 January 1, 2025
https://www.legis.iowa.gov/docs/publications/ https://www.legis.iowa.gov/docs/publications/
LGE/90/SF262.pdf LGE/90/SF262.pdf
~~Montana Consumer Data Privacy Act~~
~~October 1, 2024~~
~~https://laws.leg.mt.gov/legprd/~~
~~LAW0210W$BSIV.ActionQuery?P_BILL_NO1=~~
~~384&P_BLTP_BILL_TYP_CD=SB&Z_ACTION=~~
~~Find&P_SESS=20231~~Kentucky Consumer Data Protection January 1, 2026 https://apps.legislature.ky.gov/record/24RS/ Act hb15.html Maryland Online Data Privacy Act October 1, 2025 https://mgaleg.maryland.gov/mgawebsite/Legislation/Details/sb0541 Minnesota Consumer Data Privacy Act July 31, 2025 https://www.revisor.mn.gov/bil s/bil .php?f=HF4757&b=house&y=2024&ssn=0 Montana Consumer Data Privacy Act October 1, 2024 https://laws.leg.mt.gov/legprd/LAW0210W$BSIV.ActionQuery?P_BILL_NO1=384&P_BLTP_BILL_TYP_CD=SB&Z_ACTION=Find&P_SESS=20231 Nebraska Data Privacy Act January 1, 2025 https://nebraskalegislature.gov/bil s/view_bil .php?DocumentID=54904 New Hampshire January 1, 2025 https://gencourt.state.nh.us/bil _status/bil info.aspx?id=865&inflect=1 New Jersey January 15, 2025 https://www.njleg.state.nj.us/bil -search/2022/S332
Oregon Consumer Privacy Act Oregon Consumer Privacy Act
July 1, 2024 July 1, 2024
https://olis.oregonlegislature.gov/liz/2023R1/ https://olis.oregonlegislature.gov/liz/2023R1/
Downloads/MeasureDocument/SB619/Enrol ed Downloads/MeasureDocument/SB619/Enrol ed
Tennessee Information Protection Act Tennessee Information Protection Act
July 1, 2025 July 1, 2025
http://www.capitol.tn.gov/Bil s/113/Bil /SB0073.pdf http://www.capitol.tn.gov/Bil s/113/Bil /SB0073.pdf
Texas Data Privacy and Security Act Texas Data Privacy and Security Act
July 1, 2024 July 1, 2024
https://capitol.texas.gov/Bil Lookup/Text.aspx? https://capitol.texas.gov/Bil Lookup/Text.aspx?
LegSess=88R&Bil =HB4 LegSess=88R&Bil =HB4
Utah Consumer Privacy Act Utah Consumer Privacy Act
December 31, 2023 December 31, 2023
https://le.utah.gov/~2022/bil s/static/SB0227.html https://le.utah.gov/~2022/bil s/static/SB0227.html
Virginia Consumer Data Protection Act January 1, 2023 Virginia Consumer Data Protection Act January 1, 2023
https://law.lis.virginia.gov/vacodeful /title59.1/ https://law.lis.virginia.gov/vacodeful /title59.1/
chapter53/chapter53/ Innovation, Data, and Commerce of the House Committee on Energy and Commerce on May 23, 2024 (markup available at https://docs.house.gov/Committee/Calendar/ByEvent.aspx?EventID=117372). For more information about APRA, see CRS Legal Sidebar LSB11161, The American Privacy Rights Act, by Chris D. Linebaugh et al. Congressional Research Service 9 link to page 5 link to page 5 Identifying Minors Online
Source: CRS using information compiled by the International Association of Privacy Professionals (IAPP). See CRS using information compiled by the International Association of Privacy Professionals (IAPP). See
Andrew Folks, “US State Privacy Legislation Tracker,” IAPP, last updated Andrew Folks, “US State Privacy Legislation Tracker,” IAPP, last updated ~~December 22, 2023~~May 28, 2024, https://iapp.org/, https://iapp.org/
resources/article/us-state-privacy-legislation-tracker/. resources/article/us-state-privacy-legislation-tracker/.
Notes: The state is listed if the state law does not provide a common title. IAPP’s U.S. State Privacy Legislation Tracker provides a chart identifying key provisions in the legislation. IAPP’s U.S. State Privacy Legislation Tracker provides a chart identifying key provisions in the legislation.
The list includes bil s intended to be comprehensive approaches to govern the use of personal information; it The list includes bil s intended to be comprehensive approaches to govern the use of personal information; it
does not include industry-specific, information-specific, or narrowly scoped bil s (e.g., data security bil s). does not include industry-specific, information-specific, or narrowly scoped bil s (e.g., data security bil s).
a. The California Consumer Privacy Act was amended by the California Privacy Rights Act, which was signed a. The California Consumer Privacy Act was amended by the California Privacy Rights Act, which was signed
into law in 2020 and became ful y operative on January 1, 2023. into law in 2020 and became ful y operative on January 1, 2023.
~~All~~The effect of data privacy laws might depend, in part, on how consumers respond. For example, all of the identified state comprehensive data privacy laws provide consumers with of the identified state comprehensive data privacy laws provide consumers with ~~rights~~the right to to
delete their personal data and opt out of having their personal data collected for certain purposes. delete their personal data and opt out of having their personal data collected for certain purposes.
If enough consumers request their data to be deleted or not collected, these state laws might If enough consumers request their data to be deleted or not collected, these state laws might
reduce the data that can be used for age verification. To reduce the burden on consumers, some reduce the data that can be used for age verification. To reduce the burden on consumers, some

~~and “data protection” on congress.gov. Comprehensive data privacy bills were introduced in the 116th and 117th~~
~~Congresses. The American Data Privacy and Protection Act (ADPPA) was passed by the House Energy and Commerce~~
~~Committee, but the full House of Representatives never voted on the bill. For more information about ADPPA and~~
~~comparisons to a selection of other data privacy bills, see CRS Legal Sidebar LSB10776,~~ ~~Overview of the American~~
~~Data Privacy and Protection Act, H.R. 8152, by Jonathan M. Gaffney, Eric N. Holmes, and Chris D. Linebaugh.~~
~~Congressional Research Service~~

9

~~link to page 5 link to page 5~~ ~~Identifying Minors Online~~

companies and nonprofits have started offering services to send requests to companies to delete companies and nonprofits have started offering services to send requests to companies to delete
data on behalf of the consumer.data on behalf of the consumer.4950 This, however, has raised concerns about the identity This, however, has raised concerns about the identity
verification process used to ensure the data belong to the individual submitting the request.verification process used to ensure the data belong to the individual submitting the request.5051
Additionally, some states that do not have a comprehensive data privacy law have enacted Additionally, some states that do not have a comprehensive data privacy law have enacted
legislation related to specific types of data, such as biometric data, that might affect the use of legislation related to specific types of data, such as biometric data, that might affect the use of
consumer data to conduct age verification (e.g., facial age estimation).consumer data to conduct age verification (e.g., facial age estimation).5152
Policy Considerations for Legislation
Multiple bills introduced in the 118th Congress seek to increase protections for minors online by Multiple bills introduced in the 118th Congress seek to increase protections for minors online by
creating requirements for website operators.creating requirements for website operators.5253 Some requirements for website operators, if Some requirements for website operators, if
included in enacted legislation, could be subject to constitutional challenges under the Free included in enacted legislation, could be subject to constitutional challenges under the Free
Speech Clause of the First Amendment.Speech Clause of the First Amendment.5354
If Congress were to enact legislation creating requirements for website operators that are specific If Congress were to enact legislation creating requirements for website operators that are specific
to minors, some operators might to minors, some operators might
• implement changes for all users; • implement changes for all users;
• implement changes for individuals that the operator identifies as minors using • implement changes for individuals that the operator identifies as minors using
one or more age verification methods, including those discussed in one or more age verification methods, including those discussed in “Methods
Used to Identify Minors Online”; ;
~~• stop offering certain services (e.g., if websites were required to prevent adults~~
~~from messaging minors, some websites might not allow any users or minors to~~
~~communicate with other users); or~~
~~• stop offering the website. For example, some websites that primarily consist of~~
~~pornographic content, including PornHub, have stopped offering their platform in~~
~~Mississippi, Virginia, and Utah in response to state laws that require these~~
~~websites to conduct age verification beyond self-declaration.54 Some website~~
~~operators might try to avoid this option, particularly if their revenue comes~~
~~primarily from the website.~~

49 50 Kaveh Waddell, “How ‘Authorized Agents’ Plan to Make It Easier to Delete Your Online Data,” Kaveh Waddell, “How ‘Authorized Agents’ Plan to Make It Easier to Delete Your Online Data,” Consumer Reports, ,
March 21, 2022, https://www.consumerreports.org/electronics/privacy/authorized-agents-plan-to-make-it-easier-to-March 21, 2022, https://www.consumerreports.org/electronics/privacy/authorized-agents-plan-to-make-it-easier-to-
delete-your-data-a8655835448/; delete-your-data-a8655835448/; Consumer Reports, “Permission Slip: FAQ,” https://permissionslipcr.com/faq.php; and , “Permission Slip: FAQ,” https://permissionslipcr.com/faq.php; and
Optery, “Removes Your Home Address, Phone and Other Private Info from Google and 270+ Sites,” Optery, “Removes Your Home Address, Phone and Other Private Info from Google and 270+ Sites,”
https://www.optery.com/. https://www.optery.com/.
5051 Kashmir Hill, “Want Your Personal Data? Hand Over More Please,” Kashmir Hill, “Want Your Personal Data? Hand Over More Please,” New York Times, updated October 27, 2021, , updated October 27, 2021,
https://www.nytimes.com/2020/01/15/technology/data-privacy-law-access.html. https://www.nytimes.com/2020/01/15/technology/data-privacy-law-access.html.
5152 For example, see Illinois General Assembly, Biometric Information Privacy Act, 740 ILCS 14/, For example, see Illinois General Assembly, Biometric Information Privacy Act, 740 ILCS 14/,
https://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=3004&ChapterID=57; and Washington State Legislature, https://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=3004&ChapterID=57; and Washington State Legislature,
Biometric Identifiers, Chapter 19.375, https://app.leg.wa.gov/RCW/default.aspx?cite=19.375. Biometric Identifiers, Chapter 19.375, https://app.leg.wa.gov/RCW/default.aspx?cite=19.375.
5253 Some examples include the Kids Online Safety Act (S. 1409), Children and Teens’ Online Privacy Protection Act (S. Some examples include the Kids Online Safety Act (S. 1409), Children and Teens’ Online Privacy Protection Act (S.
1418), Social Media Child Protection Act (H.R. 821), Sammy’s Law of 2023 (H.R. 5778), and EARN It Act of 2023 1418), Social Media Child Protection Act (H.R. 821), Sammy’s Law of 2023 (H.R. 5778), and EARN It Act of 2023
(H.R. 2732/S. 1207). (H.R. 2732/S. 1207).
5354 For more information on potential constitutional concerns, see CRS Legal Sidebar LSB11021, For more information on potential constitutional concerns, see CRS Legal Sidebar LSB11021, Online Age
Verification (Part II): Constitutional Background, by Eric N. Holmes; and CRS Legal Sidebar LSB11022, , by Eric N. Holmes; and CRS Legal Sidebar LSB11022, Online Age
Verification (Part III): Select Constitutional Issues, by Eric N. Holmes. , by Eric N. Holmes.
~~54 Amanda Silberling, “Pornhub Blocks Access in Mississippi, Virginia, and Utah Amid Changing Laws,” TechCrunch,~~
~~July 3, 2023, https://techcrunch.com/2023/07/03/pornhub-blocks-access-in-mississippi-virginia-and-utah-amid-~~
~~changing-laws/.~~
~~Congressional Research Service~~

10

~~Identifying Minors Online~~

~~The effectiveness of the~~ Congressional Research Service 10 link to page 6 Identifying Minors Online • stop offering certain services (e.g., if websites were required to prevent adults from messaging minors, some websites might not allow any users or minors to communicate with other users); or • stop offering the website. For example, some websites that primarily consist of pornographic content, including PornHub, have stopped offering their platform in certain states in response to state laws that require these websites to conduct age verification beyond self-declaration.55 Some operators might try to avoid this option, particularly if their revenue comes primarily from the website. The effectiveness of legislation might depend, in part, on the age verification methods used by legislation might depend, in part, on the age verification methods used by
the website operators. Although some website operators use various age verification methods, the website operators. Although some website operators use various age verification methods,
surveys and internal company data indicate that minors who are below the minimum age surveys and internal company data indicate that minors who are below the minimum age
requirement continue to access some of these websites.requirement continue to access some of these websites.~~55 Different methods of age verification~~
~~offer different levels~~56 Each age verification method offers a different level of assurance and of assurance and can raise various~~raise different~~ considerations, as discussed in the previous considerations, as discussed in the previous
section. If Congress were not to enact legislation to increase protections for minors online, some section. If Congress were not to enact legislation to increase protections for minors online, some
website operators might website operators might still explore various safety measures and age verification methods in response explore various safety measures and age verification methods in response
to public scrutiny, lawsuits,to public scrutiny, lawsuits,5657 and laws enacted by states and other countries. and laws enacted by states and other countries.5758
This section analyzes some legislative options for addressing age verification. Specifically, this This section analyzes some legislative options for addressing age verification. Specifically, this
section provides some potential considerations if Congress chooses to (1) support research on age section provides some potential considerations if Congress chooses to (1) support research on age
verification methods, (2) direct a federal agency to issue guidance or regulations specifying verification methods, (2) direct a federal agency to issue guidance or regulations specifying
requirements related to age verification methods, (3) prohibit or require certain age verification requirements related to age verification methods, (3) prohibit or require certain age verification
methods, and/or (4) implement or support a government age verification system. methods, and/or (4) implement or support a government age verification system.
Support for Research
Congress has directed federal agencies to conduct research related to verifying identities online. Congress has directed federal agencies to conduct research related to verifying identities online.
Examples include the following: Examples include the following:
• • ~~The National Institute of Standards and Technology (NIST) was directed by P.L.~~
~~117-167 to “carry out a program of research to support the development of~~
~~voluntary, consensus-based technical standards, best practices, benchmarks,~~
~~methodologies, metrology, testbeds, and conformance criteria for identity~~
~~management,” including providing commonly used definitions and voluntary~~
~~guidance for digital identity management systems.58 NIST publishes these~~
~~standards in its Digital Identity Guidelines, which is discussed in the following~~
~~section.~~
~~• The~~In 2019, the Government Accountability Office (GAO) analyzed Government Accountability Office (GAO) analyzed ~~the~~ online identity online identity
verification processes used by six federal agencies and whether they relied on verification processes used by six federal agencies and whether they relied on
information provided by consumer reporting agencies (e.g., Equifax, Experian, information provided by consumer reporting agencies (e.g., Equifax, Experian,

55 55 See footnote 21. 56 For example, 38% of survey respondents ages 8-12 years old stated that they had used a social media platform in For example, 38% of survey respondents ages 8-12 years old stated that they had used a social media platform in
2021 (see Common Sense, 2021 (see Common Sense, The Common Sense Census: Media Use by Tweens and Teens, March 9, 2022, , March 9, 2022,
https://www.commonsensemedia.org/research/the-common-sense-census-media-use-by-tweens-and-teens-2021). A https://www.commonsensemedia.org/research/the-common-sense-census-media-use-by-tweens-and-teens-2021). A
chart from an internal presentation at Meta Platforms indicates that the monthly active people penetration was between chart from an internal presentation at Meta Platforms indicates that the monthly active people penetration was between
20% and 60% for individuals ages 11-13 who were born between 2000 and 2004, and an internal report estimated that 20% and 60% for individuals ages 11-13 who were born between 2000 and 2004, and an internal report estimated that
4 million U.S. individuals under 13 were on Instagram in 2015 (see “Complaint for Injunctive and Other Relief,” 4 million U.S. individuals under 13 were on Instagram in 2015 (see “Complaint for Injunctive and Other Relief,” The
People of the State of California et al. v. Meta Platforms, Inc., case no. 4:23-cv-05448-YGR (N.D. Cal), November 22, , case no. 4:23-cv-05448-YGR (N.D. Cal), November 22,
2023, pp. 108-111). 2023, pp. 108-111).
5657 For example, multiple state attorneys general filed a lawsuit against Meta Platforms, Inc., for allegedly downplaying For example, multiple state attorneys general filed a lawsuit against Meta Platforms, Inc., for allegedly downplaying
and concealing harms to minors caused by Facebook and Instagram, manipulating minors to spend more time on the and concealing harms to minors caused by Facebook and Instagram, manipulating minors to spend more time on the
platforms, and violating the Children’s Online Privacy Protection Act of 1998 (COPPA). See “Complaint for Injunctive platforms, and violating the Children’s Online Privacy Protection Act of 1998 (COPPA). See “Complaint for Injunctive
and Other Relief,” and Other Relief,” The People of the State of California et al. v. Meta Platforms, Inc., case no. 4:23-cv-05448-YGR , case no. 4:23-cv-05448-YGR
(N.D. Cal), October 24, 2023, pp. 1-4. (N.D. Cal), October 24, 2023, pp. 1-4.
5758 For example, see the U.K. Online Safety Bill and European Union’s Digital Services Act at Department of Science, For example, see the U.K. Online Safety Bill and European Union’s Digital Services Act at Department of Science,
Innovation, and Technology and Department of Digital, Culture, Media, and Sport, “A Guide to the Online Safety Innovation, and Technology and Department of Digital, Culture, Media, and Sport, “A Guide to the Online Safety
Bill,” U.K. Government, last updated August 30, 2023, https://www.gov.uk/guidance/a-guide-to-the-online-safety-bill; Bill,” U.K. Government, last updated August 30, 2023, https://www.gov.uk/guidance/a-guide-to-the-online-safety-bill;
and European Union, “Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 and European Union, “Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022
on a Single Market For Digital Services and amending Directive 2000/31/EC (Digital Services Act),” October 27, on a Single Market For Digital Services and amending Directive 2000/31/EC (Digital Services Act),” October 27,
2022, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022R2065&qid=1666857835014. 2022, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022R2065&qid=1666857835014.
~~58 See 15 U.S.C. §7464; the Digital Identity Management Research section of the Chips and Science Act (P.L. 117-167,~~
~~§10225) amended the “Identity Management Research and Development” section of the Cybersecurity Enhancement~~
~~Act of 2014 (P.L. 113-274, §504).~~
Congressional Research Service Congressional Research Service

11 11

Identifying Minors Online

and TransUnion),59 as requested and TransUnion),59 as requested ~~from~~by Congress.60 Two of the federal agencies no Congress.60 Two of the federal agencies no
longer relied on longer relied on ~~this~~ information information ~~as of May 2019~~from consumer reporting agencies, and officials cited high costs , and officials cited high costs
and implementation challenges for not adopting alternative identify verification and implementation challenges for not adopting alternative identify verification
~~methods. In its study, GAO states that NIST’s guidance “does not discuss the~~
~~advantages and limitations of currently available technologies or make~~
~~recommendations to agencies on which technologies should be adopted.”61~~
methods. • In 2022, Congress directed the National Science Foundation (NSF), subject to the availability of appropriations, to provide awards to support research on distributed ledger technologies.61 One of the listed potential research areas is the application of distributed ledger technologies for digital identities.62 The legislation also allows the National Institute of Standards and Technology (NIST) to carry out a research project that would identify potential applications of distributed ledger technologies that could “improve the privacy and interoperability of digital identity and access management solutions.”63 In the 118th Congress, legislation has been introduced to support research specifically on age In the 118th Congress, legislation has been introduced to support research specifically on age
verification methods. For example, the Kids Online Safety Act (verification methods. For example, the Kids Online Safety Act (H.R. 7891; S. 1409) would S. 1409) would require certain federal agencies~~require the~~
~~director of NIST, in coordination with the Federal Communications Commission, the Federal~~
~~Trade Commission (FTC), and the Secretary of Commerce,~~ to “conduct a study evaluating the to “conduct a study evaluating the
most technologically feasible methods and options for developing systems to verify age at the most technologically feasible methods and options for developing systems to verify age at the
device or operating system level,” in addition to implementing requirements device or operating system level,” in addition to implementing requirements that are unrelated to age verification for online platforms. for online platforms.
Research on age verification methods might occur under broader proposals related to conducting Research on age verification methods might occur under broader proposals related to conducting
research on online platforms. For example, the Platform Accountability and Transparency Act (S. research on online platforms. For example, the Platform Accountability and Transparency Act (S.
1876) would establish a research program for qualified researchers to access qualified data from 1876) would establish a research program for qualified researchers to access qualified data from
certain online platforms if the research application is in the public interest, aims to study activity certain online platforms if the research application is in the public interest, aims to study activity
on a platform, and is used for noncommercial purposes. on a platform, and is used for noncommercial purposes.
Supporting research on age verification methods could help inform Congress, potentially for Supporting research on age verification methods could help inform Congress, potentially for
future legislative action. For example, a federal agency may be able to test the accuracy of some future legislative action. For example, a federal agency may be able to test the accuracy of some
age verification methods and provide an in-depth analysis of potential benefits, harms, and risks. age verification methods and provide an in-depth analysis of potential benefits, harms, and risks.
However, website operators would be able to continue using a wide range of age verification However, website operators would be able to continue using a wide range of age verification
methods. Additionally, some researchers and organizations have published reports that examine methods. Additionally, some researchers and organizations have published reports that examine
some age verification methods and provide potential trade-offs.some age verification methods and provide potential trade-offs.6264 Additional research might raise Additional research might raise
new considerations and legislative options. new considerations and legislative options.
Congressional considerations in this area might include who might need access to what types of Congressional considerations in this area might include who might need access to what types of
data to provide information that would be helpful in creating federal legislation. For example, to data to provide information that would be helpful in creating federal legislation. For example, to
create a comprehensive overview of potential age verification methods and their advantages and create a comprehensive overview of potential age verification methods and their advantages and
challenges, assembling a working group with researchers from industry, academia, and federal challenges, assembling a working group with researchers from industry, academia, and federal
~~agencies might be sufficient. However, to analyze the number of minors accessing websites that~~
~~rely on certain age verification methods, researchers may need access to these websites’ internal,~~
~~nonpublic data; this might raise additional considerations, such as how the internal data would be~~
~~accessed and what information could be disclosed.~~

59 The Government Accountability Office (GAO) examined six federal agencies: Centers for Medicare and Medicaid 59 The Government Accountability Office (GAO) examined six federal agencies: Centers for Medicare and Medicaid
Services, General Services Administration, Internal Revenue Service, Social Security Administration, U.S. Postal Services, General Services Administration, Internal Revenue Service, Social Security Administration, U.S. Postal
Service, and Department of Veterans Service, and Department of Veterans ~~Affair~~Affairs. GAO, . GAO, Data Protection: Federal Agencies Need to Strengthen Online
Identity Verification Processes, May 2019, https://www.gao.gov/assets/gao-19-288.pdf. , May 2019, https://www.gao.gov/assets/gao-19-288.pdf.
60 The report specifies that congressional requesters included Senators Ron Wyden and Elizabeth Warren and 60 The report specifies that congressional requesters included Senators Ron Wyden and Elizabeth Warren and
Representatives Elijah E. Cummings and Jim Jordan (ibid., p. 39). Congress also requested a GAO report on consumer Representatives Elijah E. Cummings and Jim Jordan (ibid., p. 39). Congress also requested a GAO report on consumer
reporting agencies in the Economic Growth, Regulatory Relief, and Consumer Protection Act (P.L. 115-174), §308. reporting agencies in the Economic Growth, Regulatory Relief, and Consumer Protection Act (P.L. 115-174), §308.
61 61 ~~GAO, Data Protection: Federal Agencies Need to Strengthen Online Identity Verification Processes, May 2019, p. ii,~~
~~https://www.gao.gov/assets/gao-19-288.pdf.~~
62P.L. 117-263, Division E, Title LIX, §5913; 42 U.S.C. §19222. 62 Ibid., §(c)(1)(H)(i). 63 Ibid., §(d)(2)(A)(i). 64 For example, see Scott Brennen and Matt Perault, For example, see Scott Brennen and Matt Perault, Keeping Kids Safe Online: How Should Policymakers Approach
Age Verification?, The Center for Growth and Opportunity, Utah State University, June 21, 2023, , The Center for Growth and Opportunity, Utah State University, June 21, 2023,
https://www.thecgo.org/research/keeping-kids-safe-online-how-should-policymakers-approach-age-verification/; and https://www.thecgo.org/research/keeping-kids-safe-online-how-should-policymakers-approach-age-verification/; and
Shoshana Weissmann, “The Fundamental Problems with Social Media Age-Verification Legislation,” R Street Shoshana Weissmann, “The Fundamental Problems with Social Media Age-Verification Legislation,” R Street
Institute, May 16, 2023, https://www.rstreet.org/commentary/the-fundamental-problems-with-social-media-age-Institute, May 16, 2023, https://www.rstreet.org/commentary/the-fundamental-problems-with-social-media-age-
verification-legislation/. verification-legislation/.
Congressional Research Service Congressional Research Service

12 12

Identifying Minors Online

agencies might be sufficient. To analyze the number of minors accessing websites that rely on certain age verification methods, researchers may need access to these websites’ internal, nonpublic data. This might raise additional considerations, such as how the internal data would be accessed and what information could be disclosed. Requirements for Federal Agencies to Issue Guidance or
Regulations
Congress has enacted legislation directing federal agencies to provide guidance or regulations Congress has enacted legislation directing federal agencies to provide guidance or regulations
related to verifying identities and protecting children’s privacy online. Examples include the related to verifying identities and protecting children’s privacy online. Examples include the
following: following:
• • ~~As required by P.L. 117-167,~~ NIST provides guidance on identity verification NIST provides guidance on identity verification
standards for federal agencies standards for federal agencies that offer online services, such as login.gov,that offer online services, such as login.gov,63
65 through its through its Digital Identity Guidelines~~.64~~,66 as required by the Federal Information Security Modernization Act of 2014.67 The guidelines provide three levels of The guidelines provide three levels of
assurance within three main components: (1) enrollment and identity proofing, assurance within three main components: (1) enrollment and identity proofing,
(2) authentication and lifecycle management, and (3) federation and assertions.(2) authentication and lifecycle management, and (3) federation and assertions.65
68 In May 2019, the Office of Management and Budget required federal agencies to In May 2019, the Office of Management and Budget required federal agencies to
implement NIST’s implement NIST’s Digital Identity Guidelines..6669
• The FTC was directed to promulgate regulations for website operators under • The FTC was directed to promulgate regulations for website operators under
COPPA. COPPA.6770 The FTC outlines steps companies can take to determine whether they The FTC outlines steps companies can take to determine whether they
are covered by COPPA,are covered by COPPA,6871 provides information on how companies can comply provides information on how companies can comply
with the law,with the law,6972 and has taken enforcement action against companies for violating and has taken enforcement action against companies for violating
the law.the law.~~70 On December 20, 2023, the FTC released~~73 On January 11, 2024, the FTC published a notice of proposed a notice of proposed
rulemaking to amend rulemaking to amend ~~the~~ COPPA regulationsCOPPA regulations ~~to “place new restrictions on the~~
~~use and disclosure of children’s personal information,” such as requiring a~~
~~separate opt-in for targeted advertising.71~~
~~In the 118th Congress, legislation has been introduced to direct a federal agency to provide~~
~~guidance or promulgate regulations. For example, the Kids PRIVACY Act (H.R. 2801) would~~
~~direct the FTC to promulgate regulations requiring a risk-based approach to determine the age of~~
~~a user, where higher privacy and security risks would require a higher certainty of the user’s age.~~

63. The notice seeks comments on various issues, including whether operators should be given an exception or other incentive to “conduct an analysis of their sites’ or services’ user bases” and 65 Login.gov is currently compliant with the first identity assurance level (see General Services Administration, “Our Login.gov is currently compliant with the first identity assurance level (see General Services Administration, “Our
Services,” Login.gov Partners, https://www.login.gov/partners/our-services/). For more information about login.gov, Services,” Login.gov Partners, https://www.login.gov/partners/our-services/). For more information about login.gov,
see CRS In Focus IF12395, see CRS In Focus IF12395, Login.gov: Administration and Identity Authentication, by Dominick A. Fiorentino, Natalie , by Dominick A. Fiorentino, Natalie
R. Ortiz, and Meghan M. Stuessy. R. Ortiz, and Meghan M. Stuessy.
6466 Paul Grassi, Michael Garcia, and James Fenton, Paul Grassi, Michael Garcia, and James Fenton, Digital Identity Guidelines, NIST Special Publication 800-63-3, last , NIST Special Publication 800-63-3, last
updated March 2, 2020, https://pages.nist.gov/800-63-3/. An initial public draft of the fourth revision is available at updated March 2, 2020, https://pages.nist.gov/800-63-3/. An initial public draft of the fourth revision is available at
https://pages.nist.gov/800-63-4/. https://pages.nist.gov/800-63-4/.
6567 P.L. 113-283; 44 U.S.C. §§3551-3559. 68 Federation and assertions refers to the protocol used in a federated environment to communicate authentication and refers to the protocol used in a federated environment to communicate authentication and
attribute information, when applicable, to the party relying on this information. After the entity conducting the attribute information, when applicable, to the party relying on this information. After the entity conducting the
verification completes the authentication process, it generates an assertion containing the results to the requesting party. verification completes the authentication process, it generates an assertion containing the results to the requesting party.
Ibid. Ibid.
6669 Office of Management and Budget, “Memorandum for Heads of Executive Department and Agencies,” May 21, Office of Management and Budget, “Memorandum for Heads of Executive Department and Agencies,” May 21,
2019, https://www.whitehouse.gov/wp-content/uploads/2019/05/M-19-17.pdf. 2019, https://www.whitehouse.gov/wp-content/uploads/2019/05/M-19-17.pdf.
6770 15 U.S.C. §6502. 15 U.S.C. §6502.
6871 FTC, “Children’s Online Privacy Protection Rule: A Six-Step Compliance Plan for Your Business,” FTC, “Children’s Online Privacy Protection Rule: A Six-Step Compliance Plan for Your Business,”
https://www.ftc.gov/business-guidance/resources/childrens-online-privacy-protection-rule-six-step-compliance-plan-https://www.ftc.gov/business-guidance/resources/childrens-online-privacy-protection-rule-six-step-compliance-plan-
your-business. your-business.
6972 Ibid. FTC, “Complying with COPPA: Frequently Asked Questions,” https://www.ftc.gov/business-guidance/ Ibid. FTC, “Complying with COPPA: Frequently Asked Questions,” https://www.ftc.gov/business-guidance/
resources/complying-coppa-frequently-asked-questions. resources/complying-coppa-frequently-asked-questions.
7073 For a list of enforcement actions taken by the FTC, see FTC, “Cases Tagged with Children’s Online Privacy For a list of enforcement actions taken by the FTC, see FTC, “Cases Tagged with Children’s Online Privacy
Protection Act (COPPA),” https://www.ftc.gov/enforcement/cases-proceedings/terms/875. Protection Act (COPPA),” https://www.ftc.gov/enforcement/cases-proceedings/terms/875.
~~71 FTC, “FTC Proposes Strengthening Children’s Privacy Rule to Further Limit Companies’ Ability to Monetize~~
~~Children’s Data,” press release, December 20, 2023, https://www.ftc.gov/news-events/news/press-releases/2023/12/ftc-~~
~~proposes-strengthening-childrens-privacy-rule-further-limit-companies-ability-monetize-childrens.~~
~~Congressional Research Service~~

13

~~Identifying Minors Online~~

~~Some mandatory requirements could be subject to constitutional challenges.72~~Congressional Research Service 13 Identifying Minors Online examples of reliable methods operators can use to “determine the likely ages of a site’s or service’s users.”74 Operators are not required to determine users’ ages.75 In the 118th Congress, legislation has been introduced to direct a federal agency to provide guidance or promulgate regulations. For example, the Kids PRIVACY Act (H.R. 2801) would direct the FTC to promulgate regulations requiring a risk-based approach to determine the age of a user, where higher privacy and security risks would require a higher certainty of the user’s age. Some mandatory requirements could be subject to constitutional challenges.76 Congress could Congress could
also establish incentives for self-regulation by enabling industry groups and other entities to also establish incentives for self-regulation by enabling industry groups and other entities to
provide guidelines to meet regulations prescribed by a federal agency, similar to COPPA’s safe provide guidelines to meet regulations prescribed by a federal agency, similar to COPPA’s safe
harbor program.harbor program.7377
Guidance or regulations from a federal agency may influence the age verification methods that Guidance or regulations from a federal agency may influence the age verification methods that
are developed and used by website operators. This could provide flexibility for website operators are developed and used by website operators. This could provide flexibility for website operators
and other entities to explore new age verification methods, particularly if new options become and other entities to explore new age verification methods, particularly if new options become
feasible with technological developments, while addressing concerns some of the methods might feasible with technological developments, while addressing concerns some of the methods might
raise. The effectiveness of agency guidelines or regulations would depend on the different criteria raise. The effectiveness of agency guidelines or regulations would depend on the different criteria
the guidelines or regulations would include and how feasible it would be for website operators to the guidelines or regulations would include and how feasible it would be for website operators to
address. For example, if the regulations required a highaddress. For example, if the regulations required a high- level of assurance while prohibiting the level of assurance while prohibiting the
use of government-issued documentation and consumer data, it might be difficult for website use of government-issued documentation and consumer data, it might be difficult for website
operators to comply. operators to comply.
The scope of the regulations may also arise as a consideration when issuing regulatory authority. The scope of the regulations may also arise as a consideration when issuing regulatory authority.
For example, Congress could provide specific criteria that should be considered in the For example, Congress could provide specific criteria that should be considered in the
development of age verification methods and the importance of each, or it could allow an agency development of age verification methods and the importance of each, or it could allow an agency
to determine what criteria should be considered. Providing more detail in legislation could to determine what criteria should be considered. Providing more detail in legislation could
provide greater clarity for companies, enforcers, and courts and help ensure the legislation is provide greater clarity for companies, enforcers, and courts and help ensure the legislation is
enforced as Congress intended. However, providing an agency with greater flexibility might enforced as Congress intended. However, providing an agency with greater flexibility might
allow the agency to respond to technological developments that make it feasible to implement allow the agency to respond to technological developments that make it feasible to implement
new methods. This might also create some uncertainty, depending on how frequently agency-new methods. This might also create some uncertainty, depending on how frequently agency-
promulgated definitions or regulations are altered. promulgated definitions or regulations are altered.
Requiring or Prohibiting Certain Age Verification Methods
Subject to the potential constitutional limitations mentioned above, Congress could require or Subject to the potential constitutional limitations mentioned above, Congress could require or
prohibit website operators from using certain methods to determine a user’s age. For example, the prohibit website operators from using certain methods to determine a user’s age. For example, the
Protecting Kids on Social Media Act (S. 1291) would require social media platforms to take Protecting Kids on Social Media Act (S. 1291) would require social media platforms to take
“reasonable steps beyond merely requiring attestation” and prohibit them from using or retaining “reasonable steps beyond merely requiring attestation” and prohibit them from using or retaining
“any information collected as part of the platform’s age verification process.” “any information collected as part of the platform’s age verification process.” ~~Legislation also~~
~~could affect age verification methods indirectly. For example, legislation related to consumer data~~
~~privacy or AI might incentivize operators to avoid certain age verification methods and rely on~~
~~others.74~~
~~Website operators’ responses to legislation prohibiting or requiring certain age verification~~
~~methods would likely depend on the number of options specified and the legislative language~~
~~used. For example, if legislation requires that operators use only a method that requires more than~~
~~a user’s attestation, operators would have several methods to choose from. Similarly, certain~~
~~terminology—such as requiring a “reasonable method of verification”—might be subject to~~
~~interpretation and potentially result in a wide range of methods used.~~

72It would also direct the Department of Commerce to establish a pilot program to provide a secure digital identification credential for U.S. citizens and lawful residents. Legislation also could affect age 74 FTC, “Children’s Online Privacy Protection Rule,” 89 Federal Register 2034, January 11, 2024, p. 2036, https://www.federalregister.gov/documents/2024/01/11/2023-28569/childrens-online-privacy-protection-rule. 75 Ibid., p. 2037. 76 CRS Legal Sidebar LSB11022, CRS Legal Sidebar LSB11022, Online Age Verification (Part III): Select Constitutional Issues, by Eric N. Holmes. , by Eric N. Holmes.
7377 For more information about the safe harbor program, see FTC, “COPPA Safe Harbor Program,” at For more information about the safe harbor program, see FTC, “COPPA Safe Harbor Program,” at
https://www.ftc.gov/enforcement/coppa-safe-harbor-program. https://www.ftc.gov/enforcement/coppa-safe-harbor-program.
~~74 For example, §6(a) of the Algorithmic Justice and Online Platform Transparency Act (H.R. 4624/S. 2325) would~~
~~prohibit an online platform from using any proprietary design features that process personal information in a manner~~
~~that makes certain goods or services unavailable based on biometric or other information. This might discourage~~
~~website operators from using facial age estimation technologies to determine whether an individual can access the~~
~~website.~~
~~Congressional Research Service~~

14

~~link to page 5 link to page 5~~ ~~Identifying Minors Online~~
Congressional Research Service 14 link to page 5 link to page 5 Identifying Minors Online verification methods indirectly. For example, legislation related to consumer data privacy or AI might incentivize operators to avoid certain age verification methods and rely on others.78 Website operators’ responses to legislation prohibiting or requiring certain age verification methods would likely depend on the number of options specified and the legislative language used. For example, if legislation requires that operators use an age verification method other than a user’s attestation, operators would have several methods to choose from. Similarly, certain terminology—such as requiring a “reasonable method of verification”—might be subject to interpretation and potentially result in a wide range of methods used.
Allowing website operators to use various age verification methods might result in different Allowing website operators to use various age verification methods might result in different
levels of assurance, privacy risks, and other trade-offs discussed in the section levels of assurance, privacy risks, and other trade-offs discussed in the section “Methods Used to
Identify Minors Online.” However, if legislation restricts operators to a limited number of age owever, if legislation restricts operators to a limited number of age
verification methods, it might increase the likelihood that operators are unable or unwilling to verification methods, it might increase the likelihood that operators are unable or unwilling to
determine users’ ages, particularly if the types of age verification methods allowed are costly and determine users’ ages, particularly if the types of age verification methods allowed are costly and
difficult to implement. It might increase the likelihood that website operators stop offering their difficult to implement. It might increase the likelihood that website operators stop offering their
services and might be more likely to raise constitutional concerns.services and might be more likely to raise constitutional concerns.7579
Government Age Verification System
Congress has enacted legislation requiring federal agencies to use their records to confirm Congress has enacted legislation requiring federal agencies to use their records to confirm
information provided by certain entities. Examples are as follows: information provided by certain entities. Examples are as follows:
• In an effort to reduce fraud, Congress directed the Social Security Administration • In an effort to reduce fraud, Congress directed the Social Security Administration
(SSA) to develop or modify a database to confirm the validity of certain personal (SSA) to develop or modify a database to confirm the validity of certain personal
information provided electronically by financial institutions if the individual information provided electronically by financial institutions if the individual
gives consent.gives consent.7680 In response, SSA created the electronic Consent Based Social In response, SSA created the electronic Consent Based Social
Security Number Verification (eCBSV) service, which verifies that the Security Number Verification (eCBSV) service, which verifies that the
individual’s Social Security number (SSN), name, and date of birth combination individual’s Social Security number (SSN), name, and date of birth combination
matches SSA’s records; it does not verify an individual’s identity.matches SSA’s records; it does not verify an individual’s identity.7781
• Congress directed the Attorney General to work with SSA and the Department of • Congress directed the Attorney General to work with SSA and the Department of
Homeland Security (DHS) to create a voluntary pilot program to compare Homeland Security (DHS) to create a voluntary pilot program to compare
information on employees’ I-9 forms with government records to confirm each information on employees’ I-9 forms with government records to confirm each
~~employees’~~employee’s identity and authorization to work in the United States. identity and authorization to work in the United States.7882 The The
legislation states, “Nothing in this subtitle shall be construed to authorize, legislation states, “Nothing in this subtitle shall be construed to authorize,
directly or indirectly, the issuance or use of national identification cards or the directly or indirectly, the issuance or use of national identification cards or the
establishment of a national identification card.”establishment of a national identification card.”7983 The pilot program became E- 78 For example, §6(a) of the Algorithmic Justice and Online Platform Transparency Act (H.R. 4624/S. 2325) would prohibit an online platform from using any proprietary design features that process personal information in a manner that makes certain goods or services unavailable based on biometric or other information. This might discourage website operators from using facial age estimation technologies to determine whether an individual can access the website. 79 ~~The pilot program became E-~~
~~Verify and is administered by DHS. Some states require some or all businesses to~~
~~use E-Verify through contracting or business licensing laws.80~~
~~Legislative options in this area could include expanding the entities that are able to use these~~
~~services to include website operators or directing a federal agency to develop a new system to~~
~~help confirm the age of users. Some considerations may include the following:~~
~~• The level of assurance necessary to access a website. Some websites might not~~
~~need the same level of assurance as opening an account with a financial~~
~~institution or confirming an employee’s authorization to work in the United~~
~~States. Congress might consider whether different websites need different levels~~
~~of assurance and which age verification methods might be appropriate.~~

75 See the “Speech Rights of Website Operators” section in CRS Legal Sidebar LSB11022, See the “Speech Rights of Website Operators” section in CRS Legal Sidebar LSB11022, Online Age Verification
(Part III): Select Constitutional Issues, by Eric N. Holmes. , by Eric N. Holmes.
7680 P.L. 115-174, Title II, §215; 42 U.S.C. §405b. P.L. 115-174, Title II, §215; 42 U.S.C. §405b.
7781 For more information, see Social Security Administration (SSA), “Information About eCBSV,” https://www.ssa.gov/ For more information, see Social Security Administration (SSA), “Information About eCBSV,” https://www.ssa.gov/
dataexchange/eCBSV/. dataexchange/eCBSV/.
7882 P.L. 104-208, Title IV, Subtitle A, §§401-405; 8 U.S.C. §1324a note. P.L. 104-208, Title IV, Subtitle A, §§401-405; 8 U.S.C. §1324a note.
7983 P.L. 104-208, Title IV, Subtitle A, §404(h)(2). Congressional Research Service 15 Identifying Minors Online Verify and is administered by DHS. Some states require some or all businesses to use E-Verify through contracting or business licensing laws.84 Legislative options could include expanding the entities that are able to use these services to include website operators or directing a federal agency to develop a new system to help confirm the age of users. Some considerations may include the following: • The level of assurance necessary to access a website. Some websites might not need the same level of assurance as opening an account with a financial institution or confirming an employee’s authorization to work in the United States. Congress might consider whether different websites need different levels of assurance and which age verification methods might be appropriate. ~~P.L. 104-208, Title IV, Subtitle A, §404(h)(2).~~
~~80 For more information about E-Verify, see CRS Report R40446, Electronic Employment Eligibility Verification, by~~
~~Andorra Bruno; DHS, “What Is E-Verify?,” last updated June 2, 2023, https://www.e-verify.gov/about-e-verify/what-~~
~~is-e-verify; and DHS, “History and Milestones,” last updated May 4, 2023, https://www.e-verify.gov/about-e-verify/~~
~~history-and-milestones.~~
~~Congressional Research Service~~

15

~~Identifying Minors Online~~

• • The federal agency best suited to provide an age verification system. Some Some
considerations might include what information the agency has access to, the considerations might include what information the agency has access to, the
agency’s existing authorities, and whether the agency has the necessary resources agency’s existing authorities, and whether the agency has the necessary resources
and systems to provide the service. and systems to provide the service.
• • What information would be provided and to whom. Requiring individuals to Requiring individuals to
provide their SSN to website operators, for example, might raise consumer provide their SSN to website operators, for example, might raise consumer
privacy concerns, particularly as certain operators are not subject to the same privacy concerns, particularly as certain operators are not subject to the same
consumer data protection requirements as other entities, such as financial consumer data protection requirements as other entities, such as financial
institutions.institutions.8185 Additionally, if every website operator had to provide SSNs to SSA Additionally, if every website operator had to provide SSNs to SSA
for verification, it might raise concerns about potential government surveillance. for verification, it might raise concerns about potential government surveillance.
Another option could be providing individuals access to an age verification Another option could be providing individuals access to an age verification
system, similar to how digital IDs are used to access certain websites in some system, similar to how digital IDs are used to access certain websites in some
states. Websites could direct individuals to log in to a system to obtain states. Websites could direct individuals to log in to a system to obtain
verification that the individual meets a certain age threshold without obtaining verification that the individual meets a certain age threshold without obtaining
additional personal information. This option might not fully address concerns additional personal information. This option might not fully address concerns
about government surveillance. about government surveillance.
• • Whether operators and consumers would use the age verification system. For example, the Dot Kids Implementation and Efficiency Act of 2002 directed the National Telecommunications and Information Administration (NTIA) to establish and oversee a second-level internet domain that would only provide access to material suitable for minors.86 NTIA indefinitely suspended the second-level domain in 2012 because it was unable to gain public interest.87 The effectiveness of an age verification system might depend, in part, on whether operators of popular websites use the system. 84 For more information about E-Verify, see CRS Report R40446, Electronic Employment Eligibility Verification, by Andorra Bruno; DHS, “What Is E-Verify?,” last updated June 2, 2023, https://www.e-verify.gov/about-e-verify/what-is-e-verify; and DHS, “History and Milestones,” last updated May 4, 2023, https://www.e-verify.gov/about-e-verify/history-and-milestones. 85 Financial institutions and their affiliates are subject to consumer data protection requirements under the Gramm-Leach-Bliley Act (15 U.S.C. §§6801-6809). For an overview of the Gramm-Leach-Bliley Act and other data protection laws, see CRS Report R45631, Data Protection Law: An Overview, by Stephen P. Mulligan and Chris D. Linebaugh. 86 P.L. 107-317; 47 U.S.C. §941. 87 NTIA, “.us Domain Space,” https://www.ntia.gov/page/us-domain-space (see “2007 Contract – Modification 0012” on June 27, 2012). According to an industry publication, the number of domain name registrations was relatively low, the use of the extension was limited, and it was determined that “there are now numerous websites with high-quality content aimed at children and numerous tools available to create a safe internet space for children.” Hogan Lovells International LLP, “NTIA Suspends ‘.kids.us’ Extension,” World Trademark Review Daily, September 10, 2012, https://www.hoganlovells.com/-/media/hogan-lovells/pdf/publication/parlib011219512v1worldtrademarkreviewdailydtaylor100912_pdf.pdf. Congressional Research Service 16 Identifying Minors Online • Whether the legislation would raise concerns about federalism. Many records Many records
of individuals—such as birth, marriage, and death records and drivers’ licenses— of individuals—such as birth, marriage, and death records and drivers’ licenses—
are maintained by states, although some federal agencies and other entities are maintained by states, although some federal agencies and other entities
acquire this information from states.acquire this information from states.8288 While Congress may be able to acquire or While Congress may be able to acquire or
regulate this information in some circumstances, federalism principles may regulate this information in some circumstances, federalism principles may
prevent Congress from mandating that states use the information to assist in prevent Congress from mandating that states use the information to assist in
federal age verification policies.federal age verification policies.8389
Congress could also incentivize states to implement an age verification system, such as providing Congress could also incentivize states to implement an age verification system, such as providing
states with funding to assist with a system’s development and implementation. For example, states with funding to assist with a system’s development and implementation. For example,
although states manage elections, although states manage elections, ~~Congress enacted~~ the Help America Vote Act of 2002 the Help America Vote Act of 2002 to
~~implement~~implemented minimum standards for states and minimum standards for states and ~~establish~~established the Election Assistance Commission to the Election Assistance Commission to
assist states with federal elections.assist states with federal elections.8490 Congress could implement similar provisions for a digital ID Congress could implement similar provisions for a digital ID
system. Some states have implemented digital ID systems or are considering doing so, and system. Some states have implemented digital ID systems or are considering doing so, and
providing incentives might encourage other states to implement systems that websites could use. providing incentives might encourage other states to implement systems that websites could use.
It may be possible to implement similar systems with, for example, each state’s division for vital It may be possible to implement similar systems with, for example, each state’s division for vital
records.records.85

~~81 Financial institutions and their affiliates are subject to consumer data protection requirements under the Gramm-~~
~~Leach-Bliley Act (15 U.S.C. §§6801-6809). For an overview of the Gramm-Leach-Bliley Act and other data protection~~
~~laws, see CRS Report R45631, Data Protection Law: An Overview, by Stephen P. Mulligan and Chris D. Linebaugh.~~
8291 Some states might not want to implement an age verification system, even if they are given incentives. A state digital ID system would raise some of the considerations mentioned above, such as which division would be best suited to provide information for an age verification system. A state-run system might raise additional considerations, such as whether there would be minimum standards or security levels across states and who would set these standards. Concluding Observations If Congress wishes to address age verification in legislation, some overarching considerations may include the following: • Who should be responsible for determining an individual’s age online? Requiring website operators to treat minors differently than adults without addressing age verification in legislation might place the responsibility of identifying users’ ages on website operators. Some operators might be able to easily conduct age verification; others might not have the necessary resources to do so. A consideration may be what requirements, if any, should be placed on devices, intermediaries (e.g., app stores, web browsers), and state and federal agencies. For example, some intermediaries offer parental controls, and additional controls are offered by third-party subscription apps.92 However, this scenario places the 88 For example, the SSA acquires and maintains death data from states to administer some of its programs, and Naphsis, For example, the SSA acquires and maintains death data from states to administer some of its programs, and Naphsis,
a nonprofit organization, provides access to birth and death data from most states. For more information, see CRS a nonprofit organization, provides access to birth and death data from most states. For more information, see CRS
Report R46640, Report R46640, The Social Security Administration’s Death Data: In Brief, by Paul S. Davies; and Naphsis, “Get Fast, , by Paul S. Davies; and Naphsis, “Get Fast,
Secure Access to Birth and Death Information,” https://www.naphsis.org/get-vital-records/for-work/on-demand. Secure Access to Birth and Death Information,” https://www.naphsis.org/get-vital-records/for-work/on-demand.
8389 For more information on federalism, see CRS Report R45323, For more information on federalism, see CRS Report R45323, Federalism-Based Limitations on Congressional
Power: An Overview, coordinated by Kevin J. Hickey. , coordinated by Kevin J. Hickey.
8490 P.L. 107-252; 52 U.S.C. §§20901-21145. For more information, see CRS In Focus IF12033, P.L. 107-252; 52 U.S.C. §§20901-21145. For more information, see CRS In Focus IF12033, The Help America Vote
Act of 2002 (HAVA): An Overview, by Karen L. Shanton. , by Karen L. Shanton.
8591 The vital records division in each state has birth, death, marriage, and divorce records. Contact information for the The vital records division in each state has birth, death, marriage, and divorce records. Contact information for the
vital records division for each state is available at Centers for Disease Control and Prevention, National Center for vital records division for each state is available at Centers for Disease Control and Prevention, National Center for
Health Statistics, “Where to Write for Vital Records,” https://www.cdc.gov/nchs/w2w/index.htm. Health Statistics, “Where to Write for Vital Records,” https://www.cdc.gov/nchs/w2w/index.htm.
~~Congressional Research Service~~

16

~~Identifying Minors Online~~

~~A state digital ID system would raise some of the considerations mentioned above, such as which~~
~~division would be best suited to provide information for an age verification system. A state-run~~
~~system might raise additional considerations, such as whether there would be minimum standards~~
~~or security levels across states and who would set these standards. Furthermore, some states~~
~~might not want to implement an age verification system, even if they are given incentives.~~
~~Concluding Observations~~
~~If Congress wishes to address age verification in legislation, some overarching considerations~~
~~may include the following:~~
• Who should be responsible for determining an individual’s age online?
~~Requiring website operators to treat minors differently than adults without~~
~~addressing age verification in legislation might place the responsibility of~~
~~identifying users’ ages on website operators. Some operators might be able to~~
~~easily conduct age verification; others might not have the necessary resources to~~
~~do so.~~
~~A consideration may be what requirements, if any, should be placed on devices,~~
~~intermediaries (e.g., app stores, web browsers), and state and federal agencies.~~
~~For example, some intermediaries offer parental controls, and additional controls~~
~~are offered by third-party subscription apps.86 However, this scenario places the~~
92 For example, see Google, “How to Set Up Parental Controls on Google Play,” Google Play Help, (continued...) Congressional Research Service 17 Identifying Minors Online burden on guardians who might not be aware of the different parental controls burden on guardians who might not be aware of the different parental controls
available and their efficacy, as well as some of the risks associated with certain available and their efficacy, as well as some of the risks associated with certain
online platforms. Additionally, it might be difficult to implement these types of online platforms. Additionally, it might be difficult to implement these types of
controls on devices used by multiple individuals, such as at libraries and schools. controls on devices used by multiple individuals, such as at libraries and schools.
• • How would legislation on age verification be implemented, and what are the
potential effects? For example, it would be less burdensome if users needed to For example, it would be less burdensome if users needed to
verify their age once while creating an account with a website, rather than verify their age once while creating an account with a website, rather than
requiring users to verify their age every time they access a website. However, requiring users to verify their age every time they access a website. However,
some websites currently do not require users to create an account. If legislation some websites currently do not require users to create an account. If legislation
were to encourage users to create accounts with each website, it might increase were to encourage users to create accounts with each website, it might increase
the burden on users and potentially have indirect effects on the industry. For the burden on users and potentially have indirect effects on the industry. For
example, if individuals use the account information of popular platforms—such example, if individuals use the account information of popular platforms—such
as Facebook, Google, and Apple—to access other websites, it might allow these as Facebook, Google, and Apple—to access other websites, it might allow these
companies to gather data that are not available for other operators.companies to gather data that are not available for other operators.8793
• • How can an entity conducting age verification online confirm that
individuals are who they claim to be? In person, a photo ID can be compared to In person, a photo ID can be compared to
the individual, which is not an option on the internet. Some websites use the individual, which is not an option on the internet. Some websites use
additional authentication methods—such as a security key, authentication app, or additional authentication methods—such as a security key, authentication app, or
a link sent to a connected a link sent to a connected ~~e-mail~~email address—to confirm individuals’ identities when they create an account or access a website.94 ~~address—to confirm individuals’ identities when~~

~~86 For example, see Google, “How to Set Up Parental Controls on Google Play,” Google Play Help,~~
~~https://support.google.com/googleplay/answer/1075738; Apple, “Use Parental Controls on Your Child’s iPhone, iPad,~~
~~and iPod Touch,” November 1, 2023, https://support.apple.com/en-us/HT201304; Qustodio,~~
~~https://www.qustodio.com/en/ , and Net Nanny, https://www.netnanny.com/.~~
~~87 For example, Pinterest allows users to sign in using Facebook and Google (see Pinterest, https://www.pinterest.com/~~
~~), and Airbnb allows users to sign in using their Facebook, Google, and Apple account, as well as their email address or~~
~~phone number (see Airbnb, https://www.airbnb.com/).~~
~~Congressional Research Service~~

17

~~Identifying Minors Online~~

~~they create an account or access a website.88~~ Some websites ask users to provide Some websites ask users to provide
a selfie with specific requirements in the image so that the user needs to take a a selfie with specific requirements in the image so that the user needs to take a
new photo at that moment.new photo at that moment.8995 Some minors may be able to bypass these security Some minors may be able to bypass these security
measures if, for example, they have access to their guardian’s measures if, for example, they have access to their guardian’s ~~e-mail~~email address. address.
If Congress wishes to increase protections for minors online in legislation, some general If Congress wishes to increase protections for minors online in legislation, some general
considerations may include the following: considerations may include the following:
• • Whether requirements for website operators should address only minors.
Some content that may be considered harmful, such as online bullying and Some content that may be considered harmful, such as online bullying and
harassment, can affect all users. harassment, can affect all users.
• • Whether the legislation would apply to all websites or a subset. Some Some
policymakers have focused on websites that primarily host pornographic content policymakers have focused on websites that primarily host pornographic content
and social media platforms. If certain types of content or services are associated and social media platforms. If certain types of content or services are associated
with a greater risk of users being harmed, considerations may include how to with a greater risk of users being harmed, considerations may include how to
define the platforms Congress wishes to address.define the platforms Congress wishes to address.90
~~• The feasibility of enforcing legislation. For example, searches for virtual~~
~~private networks (VPNs) reportedly spiked after some websites that primarily~~
~~provide pornographic content stopped being offered in certain states in response~~
~~to state age verification laws.91~~
~~• Potential unintended effects. For example, if legislation were to create~~
~~requirements that are burdensome for platforms to implement, it might be~~
~~difficult for nascent companies to enter and compete with incumbents that have~~
~~more resources.~~

~~Author Information~~

~~Clare Y. Cho~~

~~Analyst in Industrial Organization and Business~~

8896 https://support.google.com/googleplay/answer/1075738; Apple, “Use Parental Controls on Your Child’s iPhone, iPad, and iPod Touch,” November 1, 2023, https://support.apple.com/en-us/HT201304; Qustodio, https://www.qustodio.com/en/, and Net Nanny, https://www.netnanny.com/. 93 For example, Pinterest allows users to sign in using Facebook and Google (see Pinterest, https://www.pinterest.com/), and Airbnb allows users to sign in using their Facebook, Google, and Apple account, as well as their email address or phone number (see Airbnb, https://www.airbnb.com/). 94 For example, Login.gov requires additional authentication methods to create an account. See General Services For example, Login.gov requires additional authentication methods to create an account. See General Services
Administration, “Create an Account,” Login.gov, https://www.login.gov/create-an-account/. Using multiple Administration, “Create an Account,” Login.gov, https://www.login.gov/create-an-account/. Using multiple
authentication methods to access a website is also known as multifactor authentication or two-step verification; for authentication methods to access a website is also known as multifactor authentication or two-step verification; for
more information, see Cybersecurity and Infrastructure Security Agency, “Multi-Factor Authentication,” January 5, more information, see Cybersecurity and Infrastructure Security Agency, “Multi-Factor Authentication,” January 5,
2022, https://www.cisa.gov/resources-tools/resources/multi-factor-authentication-mfa. 2022, https://www.cisa.gov/resources-tools/resources/multi-factor-authentication-mfa.
8995 Kashmir Hill, “Want Your Personal Data? Hand Over More Please,” Kashmir Hill, “Want Your Personal Data? Hand Over More Please,” New York Times, updated October 27, 2021, , updated October 27, 2021,
https://www.nytimes.com/2020/01/15/technology/data-privacy-law-access.html. https://www.nytimes.com/2020/01/15/technology/data-privacy-law-access.html.
9096 For more information, see CRS Report R47662, For more information, see CRS Report R47662, Defining and Regulating Online Platforms, coordinated by Clare Y. , coordinated by Clare Y.
Cho. Cho.
~~91 Ned Oliver, “Virginia Leads Nation in VPN Searches After PornHub Block,” Axios, July 7, 2023,~~
~~https://www.axios.com/local/richmond/2023/07/07/pornhub-ban-virginia-vpn. A~~Congressional Research Service 18 Identifying Minors Online • The feasibility of enforcing legislation. For example, searches for virtual ~~virtual~~ private private ~~network (VPN) is a~~
~~private network that can provide users with increased privacy, such as masking the IP address of their device so that the~~
~~location of the device cannot be identified. For more information, see Sheila Frankel et al.,~~ ~~Guide to SSL VPNs:~~
~~Recommendations of the National Institute of Standards and Technology, Special Publication 800-113, NIST, U.S.~~
~~Department of Commerce, July 2008 pp. 6-36 and 6-37.~~
~~Congressional Research Service~~

18

~~Identifying Minors Online~~

networks (VPNs) reportedly spiked after some websites that primarily provide pornographic content stopped being offered in certain states in response to state age verification laws.97 • Potential unintended effects. For example, if legislation were to create requirements that are burdensome for platforms to implement, it might be difficult for nascent companies to enter and compete with incumbents that have more resources. Author Information Clare Y. Cho Specialist in Industrial Organization and Business Policy
Acknowledgments
Lena Maman, Research Librarian, provided research assistance for this report. Lena Maman, Research Librarian, provided research assistance for this report.

Disclaimer
This document was prepared by the Congressional Research Service (CRS). CRS serves as nonpartisan This document was prepared by the Congressional Research Service (CRS). CRS serves as nonpartisan
shared staff to congressional committees and Members of Congress. It operates solely at the behest of and shared staff to congressional committees and Members of Congress. It operates solely at the behest of and
under the direction of Congress. Information in a CRS Report should not be relied upon for purposes other under the direction of Congress. Information in a CRS Report should not be relied upon for purposes other
than public understanding of information that has been provided by CRS to Members of Congress in than public understanding of information that has been provided by CRS to Members of Congress in
connection with CRS’s institutional role. CRS Reports, as a work of the United States Government, are not connection with CRS’s institutional role. CRS Reports, as a work of the United States Government, are not
subject to copyright protection in the United States. Any CRS Report may be reproduced and distributed in subject to copyright protection in the United States. Any CRS Report may be reproduced and distributed in
its entirety without permission from CRS. However, as a CRS Report may include copyrighted images or its entirety without permission from CRS. However, as a CRS Report may include copyrighted images or
material from a third party, you may need to obtain the permission of the copyright holder if you wish to material from a third party, you may need to obtain the permission of the copyright holder if you wish to
copy or otherwise use copyrighted material. copy or otherwise use copyrighted material.

97 Ned Oliver, “Virginia Leads Nation in VPN Searches After PornHub Block,” Axios, July 7, 2023, https://www.axios.com/local/richmond/2023/07/07/pornhub-ban-virginia-vpn. A virtual private network (VPN) is a private network that can provide users with increased privacy, such as masking the IP address of their device so that the location of the device cannot be identified. For more information, see Sheila Frankel et al., Guide to SSL VPNs: Recommendations of the National Institute of Standards and Technology, Special Publication 800-113, NIST, U.S. Department of Commerce, July 2008 pp. 6-36 and 6-37. Congressional Research Service R47884 · VERSION 7 · UPDATED ~~Congressional Research Service~~
~~R47884 · VERSION 1 · NEW~~
19 19