Identifying Minors Online
June 10, 2024
Identifying Minors Online
Updated September 23, 2025
(R47884)
Jump to Main Text of Report
Summary
Concerns about potential harms to minors on the internet, particularly on social media platforms, Concerns about potential harms to minors on the internet, particularly on social media platforms,
have grown in recent years. Dating to the 1990s, policymakers have enacted legislation seeking have grown in recent years. Dating to the 1990s, policymakers have enacted legislation seeking
Clare Y. Cho
to protect minors online, some of which create requirements for entities that provide websites, to protect minors online, some of which create requirements for entities that provide websites,
Specialist in Industrial
mobile applications, and online platforms (collectively, website operators).mobile applications, and online platforms (collectively, website operators).
Organization and Business Policy
Website operators have developed various methods to determine usersWebsite operators have developed various methods to determine users
’' ages, often in response to ages, often in response to
federal or state legislation. Some commonly used methods include (1) relying on self-federal or state legislation. Some commonly used methods include (1) relying on self-
identification, such as requiring a user to provide their date of birth or check a box to indicate the identification, such as requiring a user to provide their date of birth or check a box to indicate the
user is of a certain age; (2) requesting documentation, such as a photo identification (ID) or a user is of a certain age; (2) requesting documentation, such as a photo identification (ID) or a
digitized driverdigitized driver
’'s license containing the users license containing the user
’'s name and age; and (3) using consumer data, such as analyzing user content s name and age; and (3) using consumer data, such as analyzing user content
posted on the website or an image of the userposted on the website or an image of the user
’'s face. Each of these age verification methods presents different advantages and s face. Each of these age verification methods presents different advantages and
challenges. For example, everyone can provide a date of birth, but a website operator cannot verify that information without challenges. For example, everyone can provide a date of birth, but a website operator cannot verify that information without
additional data or documentation. A website operator that receives a useradditional data or documentation. A website operator that receives a user
’'s government-issued photo ID might be assured that s government-issued photo ID might be assured that
the individual meets a minimum age requirement, but not everyone has a government-issued photo ID. This might also raise the individual meets a minimum age requirement, but not everyone has a government-issued photo ID. This might also raise
consumer data privacy concerns, depending on how the information is shared and stored.consumer data privacy concerns, depending on how the information is shared and stored.
Some Members of Congress have proposed increasing protections for minors online by implementing additional Some Members of Congress have proposed increasing protections for minors online by implementing additional
requirements for website operators. Website operators might respond by (1) implementing changes for all users; (2) requirements for website operators. Website operators might respond by (1) implementing changes for all users; (2)
implementing changes for individuals identified as minors, potentially using one of the methods mentioned above; (3) no implementing changes for individuals identified as minors, potentially using one of the methods mentioned above; (3) no
longer offering certain services; or (4) no longer offering the entire service in the United States.longer offering certain services; or (4) no longer offering the entire service in the United States.
If Congress chooses not to address age verification methods used by website operators in legislation, website operators might If Congress chooses not to address age verification methods used by website operators in legislation, website operators might
still develop and implement new age verification methods in response to public scrutiny, lawsuits, and laws enacted by states still develop and implement new age verification methods in response to public scrutiny, lawsuits, and laws enacted by states
and other countries. If Congress and other countries. If Congress
wishesseeks to address age verification in legislation, some potential options include the to address age verification in legislation, some potential options include the
following:following:
• SupportingSupporting research on age verification.. Congress could, for example, provide funding for or direct a Congress could, for example, provide funding for or direct a
federal agency to conduct research related to age verification. This might help inform Congress for future federal agency to conduct research related to age verification. This might help inform Congress for future
legislative action. Website operators would be able to continue using a wide range of age verification legislative action. Website operators would be able to continue using a wide range of age verification
methods. The Kids Online Safety Act (methods. The Kids Online Safety Act (
H.R. 7891, S. 1409), S. 1748), for example, would direct some federal for example, would direct some federal
agencies to conduct a study evaluating methods to verify age at the device or operating system level.agencies to conduct a study evaluating methods to verify age at the device or operating system level.
• Directing
Directing a federal agency to issue guidance or regulations. An agency could, for example, provide An agency could, for example, provide
criteria that are to be considered in the development of age verification methods. This could influence the criteria that are to be considered in the development of age verification methods. This could influence the
age verification methods that website operators develop and use. A consideration might include how much age verification methods that website operators develop and use. A consideration might include how much
authority to provide the agency. The authority to provide the agency. The
Kids PRIVACYSCREEN Act (H.R. Act (H.R.
28011623, S. 737), for example, would direct the ), for example, would direct the
Federal Trade Commission to Federal Trade Commission to
promulgate regulations requiring a risk-based approach to determine the age of a user.
• Requiring or prohibitingprovide guidance to the covered platform on complying with requirements to use a technology verification measure to verify a user's age.
Requiring or prohibiting certain age verification methods. Website operatorsWebsite operators
’' responses would likely responses would likely
depend on the number and type of options specified. Allowing operators to use various forms of age depend on the number and type of options specified. Allowing operators to use various forms of age
verification, for example, might not address Congressverification, for example, might not address Congress
’'s concerns or may raise new ones. Limiting the s concerns or may raise new ones. Limiting the
methods operators can use might increase the likelihood that they are unable or unwilling to determine a methods operators can use might increase the likelihood that they are unable or unwilling to determine a
user’s age. The Protecting Kids on Social Mediauser's age. The CHAT Act ( Act (
S. 2714) would require entities that operate AI chatbots to verify a user's age using a "commercially available method or process that is reasonably designed to ensure accuracy."
Implementing S. 1291), for example, would require social media platforms to take “reasonable steps beyond merely requiring attestation” and direct the Department of Commerce to establish a pilot program to provide secure digital identification credentials.
• Implementing or supporting a government age verification system. Legislative options could include Legislative options could include
directing a federal agency to develop a system to help confirm usersdirecting a federal agency to develop a system to help confirm users
’' ages or incentivize states to ages or incentivize states to
implement an age verification system. Some considerations might include which agency would be best implement an age verification system. Some considerations might include which agency would be best
suited to provide the system and what information would be provided to whom.suited to provide the system and what information would be provided to whom.
Some general considerations for Congress might include (1) who should be responsible for determining an individualSome general considerations for Congress might include (1) who should be responsible for determining an individual
’'s age s age
online, (2) how would legislation on age verification be implemented and what are the potential effects, and (3) how an entity online, (2) how would legislation on age verification be implemented and what are the potential effects, and (3) how an entity
conducting age verification online can confirm that individuals are who they claim to be.conducting age verification online can confirm that individuals are who they claim to be.
Congressional Research Service
link to page 5 link to page 6 link to page 7 link to page 8 link to page 11 link to page 13 link to page 14 link to page 16 link to page 17 link to page 18 link to page 20 link to page 9 link to page 12 link to page 22 Identifying Minors Online
Contents
Methods Used to Identify Minors Online ........................................................................................ 2
Self-Identification or User Attestation ...................................................................................... 3
Documentation .......................................................................................................................... 4
Digital ID ............................................................................................................................ 5
Consumer Data .......................................................................................................................... 8
Policy Considerations for Legislation ........................................................................................... 10
Support for Research ................................................................................................................ 11
Requirements for Federal Agencies to Issue Guidance or Regulations .................................. 13
Requiring or Prohibiting Certain Age Verification Methods ................................................... 14
Government Age Verification System ..................................................................................... 15
Concluding Observations .............................................................................................................. 17
Tables
Table 1. Selected Apps Providing Access to Digital IDs ................................................................. 6
Table 2. Comprehensive Data Privacy Laws, by State .................................................................... 9
Contacts
Author Information ........................................................................................................................ 19
Congressional Research Service
Identifying Minors Online
Concerns about potential harms to minors using the internet have grown over the last few oncerns about potential harms to minors using the internet have grown over the last few
years. Surveys conducted by the Centers for Disease Control and Prevention have found years. Surveys conducted by the Centers for Disease Control and Prevention have found
C that the percentage of high school students considering suicide and experiencing persistent that the percentage of high school students considering suicide and experiencing persistent
feelings of sadness increased over the last decade, particularly for females.feelings of sadness increased over the last decade, particularly for females.
1 Some1 Much of the concern has focused on social media. Several studies, studies,
including internal research conducted by website operators,including internal research conducted by website operators,
22 suggest that suggest that
although some minorssome minors
benefit' mental health is harmed from using social media, although these studies find that other minors might not experience harms or might benefit from using social media.3
from using social media, some minors are harmed.3 The Biden Administration created an interagency task force on kids’ online health and safety to “identify current and emerging risks of harm to minors associated with online platforms.”4
Congress has enacted legislation seeking to protect minors online. Some of the legislation creates Congress has enacted legislation seeking to protect minors online. Some of the legislation creates
requirements for website operatorsrequirements for website operators
:5
• ,4 including the following:The ChildrenThe Children
’'s Online Privacy Protection Act of 1998 (COPPA) requires s Online Privacy Protection Act of 1998 (COPPA) requires
operators of online services that collect personal information and operators of online services that collect personal information and
that are directed are directed
to, or knowingly collect data from, children under 13 years of age to notify users to, or knowingly collect data from, children under 13 years of age to notify users
about the data collection, obtain advance parental consent for the collection, and about the data collection, obtain advance parental consent for the collection, and
maintain maintain
“"reasonable proceduresreasonable procedures
”" to protect the data. to protect the data.
6
• 5
The PROTECT Our Children Act of 2008 requires providers of electronic The PROTECT Our Children Act of 2008 requires providers of electronic
communication services and remote computing services to report information communication services and remote computing services to report information
related to child sexual abuse material (CSAM) to the CyberTipline operated by related to child sexual abuse material (CSAM) to the CyberTipline operated by
the National Center for Missing and Exploited Children, which provides the the National Center for Missing and Exploited Children, which provides the
information to law enforcement.information to law enforcement.
76 Providers are not required to monitor users and Providers are not required to monitor users and
content or content or
“"affirmatively search, screen, or scanaffirmatively search, screen, or scan
”" for CSAM.7
The TAKE IT DOWN Act requires covered platforms to establish a process whereby minors and adults can notify the platform that an intimate visual depiction of themself has been published without that their consent and request the platform to remove it.8 The platform must remove it within 48 hours.Some federal laws seeking to protect minors online have been deemed unconstitutional under the First Amendment by federal courts.9
The 119th Congress has held hearings and Members have introduced bills seeking to increase protections for minors online by implementing additional requirements for website operators.10 Several states have enacted laws creating requirements for websites that provide material intended for or likely to be accessed by minors (e.g., social media platforms) and for websites that provide material that is deemed harmful to minors in the legislation (e.g., websites that provide pornographic content).11 Many of these laws have been challenged in court on free speech grounds. Although much of the litigation is ongoing, courts have temporarily blocked some of these requirements from going into effect after ruling that they likely violate the First Amendment,12 or courts have permanently barred a state from enforcing certain requirements determined to be unconstitutional.13 Other state laws have been allowed to go into effect while First Amendment rulings are on appeal, such as a Mississippi law requiring digital service providers to "make commercially reasonable efforts to verify the age of the person creating an account" and follow certain provisions for individuals under the age of 18 (e.g., obtain express consent from a parent or guardian).14
for CSAM.8
1 From 2011 to 2021, the percentage of high school students who seriously considered attempting suicide increased from 16% to 22% (19% to 30% for females, 13% to 14% for males), and the percentage who experienced persistent feelings of sadness or hopelessness increased from 28% to 42% (36% to 57% for females, 21% to 29% for males). See Centers for Disease Control and Prevention, Youth Risk Behavior Survey: Data Summary and Trends Report, 2011-
2021, pp. 58-70, https://www.cdc.gov/healthyyouth/data/yrbs/yrbs_data_summary_and_trends.htm.
2 This report uses the term website to refer to websites, online platforms, and mobile applications, and the term website
operator for the entities that provide these websites.
3 For example, see U.S. Surgeon General Vivek Murthy, Social Media and Youth Mental Health: The U.S. Surgeon
General’s Advisory, U.S. Department of Health and Human Services, 2023, https://www.hhs.gov/sites/default/files/sg-youth-mental-health-social-media-advisory.pdf; Department of Science, Innovation, and Technology and Department of Digital, Culture, Media, and Sport, “Online Harms Research Publications: December 2022,” U.K. Government, December 13, 2022, https://www.gov.uk/government/publications/online-harms-research-publications-december-2022; and Georgia Wells, Jeff Horwitz, and Deepa Seetharaman, “The Facebook Files: Facebook Knows Instagram Is Toxic for Teen girls, Company Documents Show,” Wall Street Journal, September 14, 2021, https://www.wsj.com/articles/facebook-knows-instagram-is-toxic-for-teen-girls-company-documents-show-11631620739.
4 White House, “Fact Sheet: Biden-Harris Administration Announces Actions to Protect Youth Mental Health, Safety, and Privacy Online,” May 23, 2023, https://www.whitehouse.gov/briefing-room/statements-releases/2023/05/23/fact-sheet-biden-harris-administration-announces-actions-to-protect-youth-mental-health-safety-privacy-online/. The National Telecommunications and Information Administration (NTIA) published a request for public comment on behalf of the task force. See NTIA, “Initiative to Protect Youth Mental Health, Safety, and Privacy Online,” 88 Federal
Register 67733, October 2, 2023, https://www.federalregister.gov/documents/2023/10/02/2023-21606/initiative-to-protect-youth-mental-health-safety-and-privacy-online.
5 An example of legislation Congress has enacted that does not create requirements for website operators is the Protecting Children in the 21st Century Act, which implemented a nationwide program to increase public awareness and provide education on strategies to promote safe use of the internet by children (P.L. 110-385, Title II, §§201-216; 15 U.S.C. §§6551-6555).
6 P.L. 105-277, Division C, Title XIII, §§1301-1308; 15 U.S.C. §§6501-6506. 7 P.L. 110-401, Title V, §§501-503 (has been amended twice: P.L. 115-395, P.L. 118-59); 18 U.S.C. §§2258A-2258E. 8 Legislation requiring website operators to actively search for content might raise constitutional concerns under the (continued...)
Congressional Research Service
1
Identifying Minors Online
Congress has held hearings and bills have been introduced proposing to increase protections for minors online by implementing additional requirements for website operators.9 Several states have enacted laws creating requirements for websites that provide material intended for or likely to be accessed by minors and for websites that provide material that is deemed harmful to minors in the legislation.10 Courts have ruled that some of these state laws likely violate the First Amendment.11 In addition, some federal laws seeking to protect minors online have been deemed unconstitutional under the First Amendment by federal courts.12
A consideration for implementing requirements for website operators might include whether A consideration for implementing requirements for website operators might include whether
operators are able to identify minors. Some bills introduced in the operators are able to identify minors. Some bills introduced in the
118th Congress and state laws 119th Congress require or would likely incentivize website operators to implement age verification methods.require or would likely incentivize website operators to implement age verification methods.
13 15 This report discusses some methods used by website operators to determine usersThis report discusses some methods used by website operators to determine users
’' ages and ages and
potential trade-offs associated with each method. It also analyzes selected legislative options to potential trade-offs associated with each method. It also analyzes selected legislative options to
address age verification and provides some considerations for Congress related to age verification address age verification and provides some considerations for Congress related to age verification
and protecting minors online.and protecting minors online.
Methods Used to Identify Minors Online
No federal statute explicitly requires website operators to determine the age of individuals who No federal statute explicitly requires website operators to determine the age of individuals who
use their websites. Nevertheless, some website operators have developed age verification use their websites. Nevertheless, some website operators have developed age verification
methods or use methods or use
methodsage verification services provided by third parties to prevent minors from accessing their websites.16 Laws enacted by Congress, state governments, and policymakers in other countries may incentivize operators to implement age verification methods.
Some examples of age verification methods used by website operators include the following:
Some websites associated with alcoholic beverages—such as Guinness, Budweiser, and Patron Tequila—require users to enter their birthdates to indicate that they are at least 21 years old before accessing content.17
Instagram, a social media platform, requires users to enter their birthdate when creating an account to indicate that they are at least 13 years old.18 Instagram's parent company Meta reports that it also uses AI to help detect whether a user is a teen or adult.19 Some users in certain countries also need to verify their age by (1) recording a video selfie that is shared with Yoti,20 a company that uses AI to conduct facial estimations, or (2) uploading certain forms of identification (ID), including a driver's license, passport, or birth certificate.21
YouTube, a social media platform, requires users to sign in with a Google account to access certain features, such as commenting on or subscribing to videos. Users are required provided by third parties to prevent minors from accessing their websites,14 often in response to federal and state laws. Some examples of age verification methods include the following:
Fourth Amendment. For more information, see CRS Legal Sidebar LSB10713, The Fourth Amendment and the
Internet: Legal Limits on Digital Searches for Child Sexual Abuse Material (CSAM), by Michael A. Foster.
9 For example, see U.S. Congress, Senate Committee on the Judiciary, Protecting Our Children Online, hearing, 118th Cong., 1st sess., February 14, 2023, S. Hrg. 118-028 (Washington, DC: GPO, 2023), https://www.govinfo.gov/content/pkg/CHRG-118shrg52253/pdf/CHRG-118shrg52253.pdf.
10 For example, see California Age-Appropriate Design Code (California Civil Code, Division 3, Part 4, Title 1.81.47, https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&title=1.81.47.&part=4.&chapter=&article=); and Utah Social Media Regulation Act (Utah Code, Title 13, Chapter 63, https://le.utah.gov/xcode/Title13/Chapter63/13-63.html).
For an overview of some state laws seeking to protect minors online, see CRS Legal Sidebar LSB11020, Online Age
Verification (Part I): Current Context, by Eric N. Holmes.
11 For example, see CRS Legal Sidebar LSB11071, NetChoice v. Bonta and First Amendment Limits on Protecting
Children Online, by Peter J. Benson; and Skye Witley, “Online Age-Check State Law Run into Constitutional Headwinds,” Bloomberg Law, September 19, 2023, https://news.bloomberglaw.com/privacy-and-data-security/online-age-check-state-laws-run-into-constitutional-headwinds.
12 For example, the Child Online Protection Act (P.L. 105-277, Division C, Title XIV, §§1401-1406; 47 U.S.C. §231). For more information, see CRS Report R47049, Children and the Internet: Legal Considerations in Restricting Access
to Content, by Eric N. Holmes.
13 Throughout this report, the term age verification is used to discuss all methods used to determine the age of an individual. The term age assurance is used as an umbrella term that includes age verification and age estimation, which consist of different methods (for example, see Age Check Certification Scheme, “ISO Working Draft Age Assurance Systems Standard,” euCONSENT, November 2021, https://euconsent.eu/download/iso-working-draft-age-assurance-systems-standard/). This report does not make this distinction.
14 Examples of companies that offer age verification services include Onfido and Veratad. See Onfido, “Age Verification,” 2023, https://onfido.com/use-cases/age-verification/; and Veratad Technologies, “Flexible, Secure Age Verification,” 2023, https://veratad.com/solutions/age-verification/.
Congressional Research Service
2
Identifying Minors Online
• Some websites associated with alcoholic beverages—such as Guinness,
Budweiser, and Patron Tequila—require users to enter their birthdates to indicate that they are at least 21 years old before accessing content.15
• Instagram, a social media platform, requires users to enter their birthdate when
to enter their birthdate when creating an account to indicate creating an account to indicate
that they are at least 13 years old; it provides different default settings for individuals ages 13-17.16 Some users in certain countries also need to verify their age by (1) recording a video selfie that is shared with Yoti,17 a company that uses artificial intelligence (AI) to conduct facial estimations, or (2) uploading certain forms of identification (ID), including a driver’s license, passport, or birth certificate.18
• Tinder, a dating app, they are at least 13 years old; users under the age of 13 can use the platform if enabled by a parent or legal guardian.22 YouTube reports that it is also using AI to estimate whether users are over or under the age of 18 for a small set of users in the United States.23
Tinder, a dating app, says that it requires users to enter their birthdate when creating an requires users to enter their birthdate when creating an
account to indicate that they are at least 18 years old. It requires some users in account to indicate that they are at least 18 years old. It requires some users in
certain countries to verify their age by providing a copy of their drivercertain countries to verify their age by providing a copy of their driver
’'s license s license
or passport; it does not allow users to verify their age with a resident card, or passport; it does not allow users to verify their age with a resident card,
temporary drivertemporary driver
’'s license, or student ID.s license, or student ID.
19
• 24
Pornhub, a platform that hosts pornographic content, requires users in Louisiana Pornhub, a platform that hosts pornographic content, requires users in Louisiana
to verify that they are at least 18 years old using a digital ID through the LA to verify that they are at least 18 years old using a digital ID through the LA
Wallet app.Wallet app.
2025 Pornhub is Pornhub is
blocking access for users in certainno longer available in 21 states in response to states in response to
state laws.state laws.
21
26This section discusses potential trade-offs—such as level of assurance, feasibility for operators, This section discusses potential trade-offs—such as level of assurance, feasibility for operators,
accessibility for users, and user privacy—for some methods used accessibility for users, and user privacy—for some methods used
by operators to identify minors online. These to identify minors online. These
methods are grouped into three categories: (1) users self-report their age or date of birth, (2) users methods are grouped into three categories: (1) users self-report their age or date of birth, (2) users
provide documentation to verify their age, and (3) operators or third parties use data collected provide documentation to verify their age, and (3) operators or third parties use data collected
about individualsabout individuals
' online activity to determine their age. to determine their age.
Self-Identification or User Attestation
Some websites require users to self-attest that they meet a minimum age requirement—such as by Some websites require users to self-attest that they meet a minimum age requirement—such as by
checking a box or providing their age or date of birth—when creating an account or accessing the checking a box or providing their age or date of birth—when creating an account or accessing the
website. This age verification method can be accomplished by all individuals and generally website. This age verification method can be accomplished by all individuals and generally
requires relatively low effort and costs for operators. However, users can easily claim to meet the
15 Guinness, https://www.guinness.com/en-us; Budweiser, https://us.budweiser.com/; and Patron Tequila, https://www.patrontequila.com/.
16 Meta Platforms, “Introducing New Ways to Verify Age on Instagram,” June 23, 2022, https://about.instagram.com/blog/announcements/new-ways-to-verify-age-on-instagram.
17 Yoti, “Age Verification Should Be Just an Age,” https://www.yoti.com/business/age-verification/. 18 Instagram used to allow users to confirm their age with social vouching (i.e., other users confirm a user’s age) but stated the option was removed to make improvements on October 13, 2022. Meta Platforms, “Introducing New Ways to Verify Age on Instagram,” June 23, 2022, https://about.instagram.com/blog/announcements/new-ways-to-verify-age-on-instagram.
19 Tinder, “How Does Age Verification Work?,” https://www.help.tinder.com/hc/en-us/articles/360040592771-How-does-age-verification-work-.
20 Adi Robertson, “Louisiana Now Requires a Government ID to Access Pornhub,” Verge, January 3, 2023, https://www.theverge.com/2023/1/3/23537226/louisiana-pornhub-age-verification-law-government-id.
21 Pornhub has restricted access in Arkansas, Mississippi, Montana, North Carolina, Utah, and Virginia (see Jon Brodkin, “Supreme Court Decides Not to Block Texas Law that Age-Gates Porn Websites,” ArsTechnica, May 1, 2024, https://arstechnica.com/tech-policy/2024/05/supreme-court-lets-texas-keep-enforcing-age-verification-law-for-porn-sites/).
Congressional Research Service
3
Identifying Minors Online
requires relatively low effort and costs for operators. However, users can easily claim to meet the age requirement when they do not. A website operator cannot determine whether users are age requirement when they do not. A website operator cannot determine whether users are
providing their actual age without additional information.providing their actual age without additional information.
Documentation
Some websites require users to provide documentation to verify their age. These often include Some websites require users to provide documentation to verify their age. These often include
government-issued documents—such as a drivergovernment-issued documents—such as a driver
’'s license, passport, or birth certificate—or other s license, passport, or birth certificate—or other
documents that provide some combination of the individualdocuments that provide some combination of the individual
’'s full name, photo, age, and date of s full name, photo, age, and date of
birth, such as a medical record, school ID, or membership ID. A website operator has an incentive birth, such as a medical record, school ID, or membership ID. A website operator has an incentive
to accept a wide range of documents or documents that most individuals can access to increase to accept a wide range of documents or documents that most individuals can access to increase
the number of potential users. Some operators might choose not to accept certain documents to the number of potential users. Some operators might choose not to accept certain documents to
maintain a higher level of assurance.maintain a higher level of assurance.
The types of documents held by most individuals vary. For example, the number of valid The types of documents held by most individuals vary. For example, the number of valid
passports in circulation suggests thatpassports in circulation suggests that
the majority, at most, 51% of U.S. citizens of U.S. citizens
do not have a passport.have a passport.
2227 About About
71% of individuals residing in the United States had a driver71% of individuals residing in the United States had a driver
’'s license in s license in
2022,232023,28 with over 90% with over 90%
of those ages 30-79.of those ages 30-79.
2429 About 1. About 1.
34% of individuals ages 14 and 15 had a driver% of individuals ages 14 and 15 had a driver
’'s license,s license,
2530 and the and the
percentages of individuals ages 16, 17, and 18 that had a driverpercentages of individuals ages 16, 17, and 18 that had a driver
’'s license were about 25%, s license were about 25%,
4344%, %,
and 60%, respectively.and 60%, respectively.
2631 CRS could not find similar information for other state-issued IDs. CRS could not find similar information for other state-issued IDs.
A larger number of minors have access to other documents, such as birth certificates and school A larger number of minors have access to other documents, such as birth certificates and school
IDs, but accessibility might remain an issue for some individuals. For example, although most IDs, but accessibility might remain an issue for some individuals. For example, although most
individuals born in the United States have a birth certificate, about 14% of individuals in the individuals born in the United States have a birth certificate, about 14% of individuals in the
United States in 2022 were born in a foreign country, some of which might not offer birth United States in 2022 were born in a foreign country, some of which might not offer birth
certificates.certificates.
2732 While nearly all children under five in Western Europe and North America have a While nearly all children under five in Western Europe and North America have a
birth certificate, UNICEF estimates that 77% of children under five across the world have their
22 In 2022, 151,814,305 valid passports were in circulation, according to U.S. Department of State, Bureau of Consular Affairs, “Reports and Statistics,” https://travel.state.gov/content/travel/en/about-us/reports-and-statistics.html. That year, the number of U.S. citizens was 311,614,516, according to the Census Bureau’s American Community Survey one-year estimates at U.S. Census Bureau, Table K200501: Citizenship Status in the United States, https://data.census.gov/table/ACSSE2022.K200501. This means that if each valid passport belonged to a different individual, at most, 48.7% of U.S. citizens had a U.S. passport. The actual percentage may be lower; an individual can have both a passport book and card, which counts as two valid passports, and qualifying non-U.S. citizens can have a U.S. passport.
23 U.S. Department of Transportation (DOT), Federal Highway Administration (FHWA), Office of Highway Policy Information, Policy and Governmental Affairs, “6.3.1. Licensed Drivers—Ratio of Licensed Drivers to Population,” Highway Statistics Series 2022, last modified on February 5, 2024, https://www.fhwa.dot.gov/policyinformation/statistics/2022/dl1c.cfm.
24 DOT, FHWA, Office of Highway Policy Information, Policy and Governmental Affairs, “6.3.2. Licensed Drivers, by Sex and Percentage in Each Age Group (REVISED),” Highway Statistics Series 2022, last modified on May 6, 2024, https://www.fhwa.dot.gov/policyinformation/statistics/2022/dl20.cfm.
25 The “under 16” group is compared with 14- and 15-year-old population estimates (ibid.). Ten states are estimated to have individuals younger than 16 with a driver’s license in 2022 (see DOT, FHWA, Office of Highway Policy Information, Policy and Governmental Affairs, “6.3.3. Licensed Drivers, by State, Sex, and Age Group,” Highway
Statistics Series 2022, last modified on March 1, 2024, https://www.fhwa.dot.gov/policyinformation/statistics/2022/dl22.cfm).
26 Ibid. 27 In 2022, the number of foreign-born individuals (excluding U.S. citizens born abroad to American parent[s]) was 46,182,177, and the total U.S. population was 333,287,562, according to the Census Bureau’s American Community Service one-year estimate (https://data.census.gov/table/ACSSE2022.K200503).
Congressional Research Service
4
link to page 8 link to page 9 Identifying Minors Online
births registered, with 47% in the least developed countries.28birth certificate, UNICEF estimates that 77% of children under five across the world have their births registered.33 Similarly, some schools might not Similarly, some schools might not
offer a school ID, and some school IDs might not indicate the individualoffer a school ID, and some school IDs might not indicate the individual
’'s birthdate or age.s birthdate or age.
Some documents might be considered more reliable and harder to falsify than others. For Some documents might be considered more reliable and harder to falsify than others. For
example, the REAL ID Act prohibits federal agencies from accepting driversexample, the REAL ID Act prohibits federal agencies from accepting drivers
’' licenses and state- licenses and state-
issued IDs unless the cards meet certain standards;issued IDs unless the cards meet certain standards;
29 enforcement is scheduled to begin34 enforcement began on May 7, on May 7,
2025.2025.
3035 In contrast, schools do not have a uniform ID system; there were 98,577 public schools, In contrast, schools do not have a uniform ID system; there were 98,577 public schools,
including kindergarten through high school, in the 2020-2021 school year.including kindergarten through high school, in the 2020-2021 school year.
3136 Schools might Schools might
implement different security standards, if any, and use various designs, styles, and formats that implement different security standards, if any, and use various designs, styles, and formats that
could make it difficult to determine which school IDs are legitimate and which are fake.could make it difficult to determine which school IDs are legitimate and which are fake.
The ability to counterfeit or falsify documents would also depend on other factors, such as the The ability to counterfeit or falsify documents would also depend on other factors, such as the
systems used to share documents. For example, an image of a driversystems used to share documents. For example, an image of a driver
’'s license would likely be s license would likely be
easier to alter than a digital version of a drivereasier to alter than a digital version of a driver
’'s license that is verified by a state agency, s license that is verified by a state agency,
as which are discussed below in discussed below in
"“Digital ID.”." Government-issued documents are considered to be reliable, and Government-issued documents are considered to be reliable, and
often often
are used to verify an individualused to verify an individual
’'s identity. Sharing government-issued documents with other s identity. Sharing government-issued documents with other
entities might raise greater privacy and identity theft concerns than sharing other types of entities might raise greater privacy and identity theft concerns than sharing other types of
documents.documents.
Digital ID
Some states offer digital IDs in the form of a digitized driverSome states offer digital IDs in the form of a digitized driver
’'s license and state IDs license and state ID
(Table 1).32 .37 These digital IDs are accessible through an app operated by the state government or a company These digital IDs are accessible through an app operated by the state government or a company
partnering with the state government, often with the statepartnering with the state government, often with the state
’'s Department of Motor Vehicles s Department of Motor Vehicles
(DMV). Some states allow these digital IDs to be used only at Transportation Security (DMV). Some states allow these digital IDs to be used only at Transportation Security
Administration (TSA) PreCheck entrances at certain airports;Administration (TSA) PreCheck entrances at certain airports;
3338 others allow various others allow various
entities—such as restaurants, bars, credit unions, and websites—retail locations to accept digital IDs.to accept digital IDs.
39
Most of the digital ID systems implemented by states thus far comply with standards set by two Most of the digital ID systems implemented by states thus far comply with standards set by two
international organizations: the International Organization of Standardization (ISO) and the international organizations: the International Organization of Standardization (ISO) and the
International Electrotechnical Commission (IEC).International Electrotechnical Commission (IEC).
3440 The ISO/IEC 18013-5 standards provide The ISO/IEC 18013-5 standards provide
technical and functional requirements to maintain security, privacy, and interoperability for technical and functional requirements to maintain security, privacy, and interoperability for
mobile driversmobile drivers
’' licenses. licenses.
3541 These standards differ from the REAL ID requirements, which were expanded to mobile drivers' licenses in 2019.42 The TSA published a final rule These standards differ from the REAL ID requirements, which were
28 UNICEF, “Birth Registration,” last updated June 2023, https://data.unicef.org/topic/child-protection/birth-registration/.
29 P.L. 109-13, Division B, Title II. For more information about REAL ID, see U.S. Department of Homeland Security (DHS), “About REAL ID,” last updated May 7, 2024, https://www.dhs.gov/real-id/about-real-id.
30 All states, the District of Columbia, and the five territories are REAL ID compliant. See DHS, “REAL ID Frequently Asked Questions,” last updated August 30, 2023, https://www.dhs.gov/real-id/real-id-faqs. 31 The number of private schools is reported every other year and was not reported for the 2020-2021 school year; there were 30,492 private schools in the 2019-2020 school year. See National Center for Education Statistics, “Educational Institutions,” https://nces.ed.gov/fastfacts/display.asp?id=84. 32 In this report, a digital ID refers to an electronic version of a government-issued document. It does not include other information individuals might use to identify themselves on the internet, such as usernames or sign-in information.
33 For more information about using digital IDs at TSA PreCheck, see TSA, “Facial Recognition and Digital Identity Solutions,” https://www.tsa.gov/digital-id.
34 For example, see Utah Department of Public Safety, “Utah mDL FAQs,” https://dld.utah.gov/mdlfaqs/; and Iowa Department of Transportation, “Iowa Mobile ID for Businesses, Organizations, and Agencies,” https://iowadot.gov/mvd/MID-businesses.
35 The International Organization of Standardization (ISO) and the International Electrotechnical Commission (IEC), Personal Identification – ISO-compliant Driving License – Part 5: Mobile Driving License Application, ISO/IEC 18013-5, September 2021.
Congressional Research Service
5
link to page 10 Identifying Minors Online
expanded to mobile drivers’ licenses in 2019.36 The TSA has proposed rulemaking to temporarily to temporarily
waive the requirement that mobile driverswaive the requirement that mobile drivers
’' licenses be compliant with REAL ID standards licenses be compliant with REAL ID standards
.37 to be accepted by federal agencies for official purposes.43 Digital IDs can be compliant with both ISO/IEC 18013-5 and REAL ID standards with some Digital IDs can be compliant with both ISO/IEC 18013-5 and REAL ID standards with some
minor adjustments.38
Table 1. Selected Apps Providing Access to Digital IDs
Operator of
Selected Places
State
Name of App
Appa
Accepting Digital ID
Website
Arizona
Apple Wallet
Apple
TSA
https://azdot.gov/apple-wallet
Google Wallet
Google
TSA
https://azdot.gov/google-wal et
Mobile ID
IDEMIA
N/A
https://azdot.gov/mvd/services/driver-services/mobile-id
Samsung Wallet
Samsung
TSA
https://azdot.gov/samsung-wallet
California
CA DMV
California DMV
TSA, certain retail
https://www.dmv.ca.gov/portal/ca-
Wallet App*
locations in Sacramento dmv-wallet/
Colorado
Apple Wallet
Apple
TSA
https://dmv.colorado.gov/applewallet
Google Wallet
Google
TSA
https://dmv.colorado.gov/colorado-id-in-google-wal et
myColorado
Colorado Office Certain restaurants,
https://mycolorado.gov/colorado-
of Information
bars, liquor stores
digital-id
and Technology
Delaware
Mobile ID
IDEMIA
N/A
https://www.dmv.de.gov/mobileID/
Florida
Smart ID*
Thales
N/A
https://www.flhsmv.gov/floridasmartid/
Georgia
Apple Wallet
Apple
TSA
https://dds.georgia.gov/ga-digital-drivers-license-and-id
Google Wallet
Google
N/A
https://dds.georgia.gov/digital-id-google-wal et
Iowa
Mobile ID
IDEMIA
TSA, certain retail
https://iowadot.gov/mvd/Mobile-ID
locations, restaurants, bars, credit unions
Louisiana
LA Wallet
Envoc
Certain retail locations,
https://lawallet.com/about/
restaurants, bars, websites
Maryland
Apple Wallet
Apple
TSA
https://mva.maryland.gov/Pages/MDMobileID_Apple.aspx
Google Wallet
Google
TSA
https://mva.maryland.gov/Pages/MDMobileID_Googlewal et.aspx
36 P.L. 116-260, Division U, Title X, §1001. 37 TSA, “Minimum Standards for Driver’s Licenses and Identification Cards Acceptable by Federal Agencies for Official Purposes; Waiver for Mobile Driver’s Licenses,” 88 Federal Register 60056, August 30, 2023, https://www.federalregister.gov/documents/2023/08/30/2023-18582/minimum-standards-for-drivers-licenses-and-identification-cards-acceptable-by-federal-agencies-for.
38 American Association of Motor Vehicle Administrators, Mobile Driver’s License (mDL) Implementation Guidelines, version 1.2, January 2023, https://aamva.org/getmedia/b801da7b-5584-466c-8aeb-f230cef6dda5/mDL-Implementation-Guidelines-Version-1-2_final.pdf.
Congressional Research Service
6
link to page 10 link to page 7 link to page 9 Identifying Minors Online
Operator of
Selected Places
State
Name of App
Appa
Accepting Digital ID
Website
Mississippi Mobile ID
IDEMIA
N/A
https://www.driverservicebureau.dps.ms.gov/mobile-id/
Utah
GET Mobile
GET North
TSA, certain credit
https://dld.utah.gov/utahmdl/
App
America
unions, grocery stores, liquor stores
Source: CRS using information provided by state DMV websites and other websites. Notes: TSA = Transportation Security Administration. An asterisk (*) indicates that the app is currently a pilot program with limited participants. N/A indicates that the website did not specify the places where the digital ID could be used. a. If a company provides support for or continues to remain involved with the app, the company is listed as
the operator. The company works with the state, which manages the program itself. The state’s department is listed as the operator if it provides support for the app and is the listed entity in the app’s terms of use.
minor adjustments.44
Some of the accessibility concerns discussed in Some of the accessibility concerns discussed in
“Documentation” may"Documentation" may be applicable to digital be applicable to digital
IDs. For example, because most individuals younger than 18 and nearly all individuals under 16 IDs. For example, because most individuals younger than 18 and nearly all individuals under 16
do not have a driverdo not have a driver
’'s license, a mobile drivers license, a mobile driver
’'s license would not be an option for most minors. s license would not be an option for most minors.
However, the percentage of minors with a driverHowever, the percentage of minors with a driver
’'s license or other state-issued IDs might increase s license or other state-issued IDs might increase
if these IDs can be used to access websites. Accessibility might remain an issue for some if these IDs can be used to access websites. Accessibility might remain an issue for some
individuals if the app is provided only on mobile devices, particularly for individuals who do not individuals if the app is provided only on mobile devices, particularly for individuals who do not
have access to a mobile device and access the internet using computers and laptops.have access to a mobile device and access the internet using computers and laptops.
A digital ID system might provide greater privacy protections than, for example, having A digital ID system might provide greater privacy protections than, for example, having
individuals send photos of government-issued documents to every website they wish to access. A individuals send photos of government-issued documents to every website they wish to access. A
digital ID system could allow a government agency verify an individualdigital ID system could allow a government agency verify an individual
’'s age without disclosing s age without disclosing
additional information to various website operators. Nevertheless, privacy concerns might depend additional information to various website operators. Nevertheless, privacy concerns might depend
on various factors, including the security of the system implemented and the amount and type of on various factors, including the security of the system implemented and the amount and type of
data the operator of a digital ID system would be able to access. There may be concern, for data the operator of a digital ID system would be able to access. There may be concern, for
example, that the operator of the system would be able to track an individualexample, that the operator of the system would be able to track an individual
’'s movements across s movements across
websites. The operators of websites. The operators of
the digital ID systems digital ID systems
mentioned in Table 1 state that they do not store state that they do not store
users’users' data. data.
39
45
A potential complication with relying on digital IDs for age verification is that most states A potential complication with relying on digital IDs for age verification is that most states
currently do not have a digital ID system that website operators can use to verify userscurrently do not have a digital ID system that website operators can use to verify users
’' ages. ages.
40 46 However, several states have implemented digital IDs for some entities, and other states might be However, several states have implemented digital IDs for some entities, and other states might be
implementing their own systems.implementing their own systems.
4147 If states rely on companies to provide their digital IDs, it If states rely on companies to provide their digital IDs, it
might raise concerns about potential unintended effects, such as whether consumers would be might raise concerns about potential unintended effects, such as whether consumers would be
encouraged to use the companiesencouraged to use the companies
’' mobile wallets and other adjacent products.48
Consumer Data
Consumer data can be used to estimate a user' mobile wallets and other adjacent products.42
39 For example, see IDEMIA, “Mobile ID: Frequently Asked Questions,” https://na.idemia.com/dmv-2/mobile-id/. 40 When this report was published, Louisiana was the only state that explicitly stated its digital ID system can be used for online identity verification (LA Wallet, “Bring Digital Verification to Your Business,” https://lawallet.com/digital-verification/).
41 For example, see Apple, “Apple Launches the First Driver’s License and State ID in Wallet with Arizona,” Apple Newsroom, last updated March 23, 2022, https://www.apple.com/newsroom/2022/03/apple-launches-the-first-drivers-license-and-state-id-in-wallet-with-arizona/; and Idemia, “Mobile ID: Everything Is on Your Phone. Now Your ID Is Too,” https://na.idemia.com/dmv-2/mobile-id/. 42 Grace Broadbent, “Samsung Wallet Adds State IDs to Compete Against Apple Pay and Google Pay,” eMarketer, October 11, 2023, https://content-na1.emarketer.com/samsung-wallets-adds-state-ids-compete-against-apple-pay-google-pay.
Congressional Research Service
7
Identifying Minors Online
Consumer Data
Consumer data can be used to estimate a user’s age on a website. Data that might be used include s age on a website. Data that might be used include
conversations users have with their peers (e.g., upcoming birthday, classes), biometric data (e.g., conversations users have with their peers (e.g., upcoming birthday, classes), biometric data (e.g.,
image of a userimage of a user
’'s face), and data provided by other entities (e.g., credit card number).s face), and data provided by other entities (e.g., credit card number).
4349 Operators Operators
of websites that host large amounts of user-generated content may be able to use information of websites that host large amounts of user-generated content may be able to use information
provided directly on the website, while others might need to rely on data provided by other provided directly on the website, while others might need to rely on data provided by other
entities, such as data brokers, or age verification services offered by third parties.entities, such as data brokers, or age verification services offered by third parties.
To estimate a userTo estimate a user
’'s age, consumer data are typically analyzed using algorithms, AI, and other s age, consumer data are typically analyzed using algorithms, AI, and other
technologies; the accuracy depends on the system used. For example, some studies suggest that technologies; the accuracy depends on the system used. For example, some studies suggest that
facial age estimation systems can estimate age within a range but have difficulty distinguishing facial age estimation systems can estimate age within a range but have difficulty distinguishing
between small differences in age (e.g., whether someone is 13 or 14 years old).between small differences in age (e.g., whether someone is 13 or 14 years old).
4450 Additionally, the Additionally, the
accuracy of these systems can be affected by factors such as facial expressions, makeup, color accuracy of these systems can be affected by factors such as facial expressions, makeup, color
mode, and the use of props (e.g., glasses).mode, and the use of props (e.g., glasses).
4551 These systems might perpetuate or amplify biases in These systems might perpetuate or amplify biases in
the datasets they are trained on.the datasets they are trained on.
46
52
Using consumer data to estimate a userUsing consumer data to estimate a user
’'s age might raise privacy concerns. Website operators and s age might raise privacy concerns. Website operators and
third parties offering age verification services might be compelled to collect greater amounts of third parties offering age verification services might be compelled to collect greater amounts of
consumer data to develop and improve the models and systems used to estimate a userconsumer data to develop and improve the models and systems used to estimate a user
’'s age. For s age. For
example, some methods of facial age estimation require large datasets.example, some methods of facial age estimation require large datasets.
4753 Data collection and Data collection and
tracking tools—such as cookies and pixels—have enabled various entities to collect consumer tracking tools—such as cookies and pixels—have enabled various entities to collect consumer
data on the internet, which has led some policymakers to introduce or enact comprehensive data on the internet, which has led some policymakers to introduce or enact comprehensive
consumer data privacy laws.consumer data privacy laws.
48
54
Consumer data privacy laws might affect the feasibility of using consumer data for age Consumer data privacy laws might affect the feasibility of using consumer data for age
verification. verification.
Comprehensive data privacy bills have been introduced in previous sessions of Congress,55 and 19 states have passed comprehensive consumer data privacy laws.56 Comprehensive data privacy bills have been introduced in Congress,49 and 18 states
43 For example, see Lubna Takuri, “Age Verification System: How to Verify Customer Ages,” Onfido, January 24, 2023, https://onfido.com/blog/age-verification-system/; Yoti, “Age Verification Should be Just an Age,” https://www.yoti.com/business/age-verification/; and Google, “Access Age-Restricted Content and Features,” Google Account Help, https://support.google.com/accounts/answer/10071085?hl=en.
44 For example, Yoti reported that the probability that its facial age estimation system correctly identified an individual age 6-11 as younger than 13 was 98.35%. The results separated by skin tone and gender indicate that, on average, the system estimated the ages of individuals 6-11 within a range of 2.2 years or less (based on mean absolute error for each year). Yoti, Yoti Facial Age Estimation, white paper, March 2023, pp. 2, 5, https://www.yoti.com/wp-content/uploads/Yoti-Age-Estimation-White-Paper-March-2023.pdf.
45 For example, see Prachi Punyani, Rashmi Gupta, and Ashwani Kumar, “Neural Networks for Facial Age Estimation: A Survey on Recent Advances,” Artificial Intelligence Review, vol. 53 (2020), pp. 3299-3347, https://doi.org/10.1007/s10462-019-09765-w; and Tzvi Ganel, Carmel Sofer, and Melvyn Goodale, “Biases in Human Perception of Facial Age Are Present and More Exaggerated in Current AI Technology,” Nature: Scientific Reports, vol. 12, no. 22519 (2022), https://www.nature.com/articles/s41598-022-27009-w.
46 CRS Report R47644, Artificial Intelligence: Overview, Recent Advances, and Considerations for the 118th
Congress, by Laurie A. Harris; and CRS Report R47569, Generative Artificial Intelligence and Data Privacy: A
Primer, by Kristen E. Busch.
47 For example, facial age estimation using convolutional neural network (CNN) frameworks require very large datasets for training; see Zichang Tan et al., “Efficient Group-n Encoding and Decoding for Facial Age Estimation,” IEEE
Transactions on Pattern Analysis and Machine Intelligence, vol. 40, no. 11 (2018), pp. 2610-2623, https://doi.org/10.1109/TPAMI.2017.2779808; and Oussama Guehairia et al., “Facial Age Estimation Using Tensor Based Subspace Learning and Deep Random Forests,” Information Sciences, vol. 609 (September 2022), pp. 1309-1317, https://doi.org/10.1016/j.ins.2022.07.135.
48 For more information, see CRS Report R47298, Online Consumer Data Collection and Data Privacy, by Clare Y. Cho and Kristen E. Busch.
49 For example, a discussion draft of the American Privacy Rights Act (APRA) was passed by the Subcommittee on (continued...)
Congressional Research Service
8
link to page 12 link to page 13 Identifying Minors Online
have passed comprehensive consumer data privacy laws; state laws in California, Colorado, Connecticut, Utah, and Virginia are currently enforceable (Table 2).
Table 2. Comprehensive Data Privacy Laws, by State
Name of State Law
Effective Date
Law Web Page
California Consumer Privacy Acta
January 1, 2020
https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?division=3.&part=4.&lawCode=CIV&title=1.81.5
Colorado Privacy Act
July 1, 2023
https://leg.colorado.gov/bil s/sb21-190
Connecticut Data Privacy Act
July 1, 2023
https://www.cga.ct.gov/asp/cgabil status/cgabil status.asp?selBil Type=Bil &bil _num=SB00006&which_year=2022
Delaware Personal Data Privacy Act
January 1, 2025
https://legiscan.com/DE/text/HB154/id/2807502/Delaware-2023-HB154-Draft.html
Indiana Consumer Data Protection Act
January 1, 2026
https://iga.in.gov/legislative/2023/bil s/senate/5/details
Iowa Consumer Data Protection Act
January 1, 2025
https://www.legis.iowa.gov/docs/publications/LGE/90/SF262.pdf
Kentucky Consumer Data Protection
January 1, 2026
https://apps.legislature.ky.gov/record/24RS/
Act
hb15.html
Maryland Online Data Privacy Act
October 1, 2025
https://mgaleg.maryland.gov/mgawebsite/Legislation/Details/sb0541
Minnesota Consumer Data Privacy Act
July 31, 2025
https://www.revisor.mn.gov/bil s/bil .php?f=HF4757&b=house&y=2024&ssn=0
Montana Consumer Data Privacy Act
October 1, 2024
https://laws.leg.mt.gov/legprd/LAW0210W$BSIV.ActionQuery?P_BILL_NO1=384&P_BLTP_BILL_TYP_CD=SB&Z_ACTION=Find&P_SESS=20231
Nebraska Data Privacy Act
January 1, 2025
https://nebraskalegislature.gov/bil s/view_bil .php?DocumentID=54904
New Hampshire
January 1, 2025
https://gencourt.state.nh.us/bil _status/bil info.aspx?id=865&inflect=1
New Jersey
January 15, 2025
https://www.njleg.state.nj.us/bil -search/2022/S332
Oregon Consumer Privacy Act
July 1, 2024
https://olis.oregonlegislature.gov/liz/2023R1/Downloads/MeasureDocument/SB619/Enrol ed
Tennessee Information Protection Act
July 1, 2025
http://www.capitol.tn.gov/Bil s/113/Bil /SB0073.pdf
Texas Data Privacy and Security Act
July 1, 2024
https://capitol.texas.gov/Bil Lookup/Text.aspx?LegSess=88R&Bil =HB4
Utah Consumer Privacy Act
December 31, 2023
https://le.utah.gov/~2022/bil s/static/SB0227.html
Virginia Consumer Data Protection Act January 1, 2023
https://law.lis.virginia.gov/vacodeful /title59.1/chapter53/
Innovation, Data, and Commerce of the House Committee on Energy and Commerce on May 23, 2024 (markup available at https://docs.house.gov/Committee/Calendar/ByEvent.aspx?EventID=117372). For more information about APRA, see CRS Legal Sidebar LSB11161, The American Privacy Rights Act, by Chris D. Linebaugh et al.
Congressional Research Service
9
link to page 5 link to page 5 Identifying Minors Online
Source: CRS using information compiled by the International Association of Privacy Professionals (IAPP). See Andrew Folks, “US State Privacy Legislation Tracker,” IAPP, last updated May 28, 2024, https://iapp.org/resources/article/us-state-privacy-legislation-tracker/. Notes: The state is listed if the state law does not provide a common title. IAPP’s U.S. State Privacy Legislation Tracker provides a chart identifying key provisions in the legislation. The list includes bil s intended to be comprehensive approaches to govern the use of personal information; it does not include industry-specific, information-specific, or narrowly scoped bil s (e.g., data security bil s). a. The California Consumer Privacy Act was amended by the California Privacy Rights Act, which was signed
into law in 2020 and became ful y operative on January 1, 2023.
The effect of data privacy laws might depend, in part, on how consumers respond. For example, The effect of data privacy laws might depend, in part, on how consumers respond. For example,
all of the identified state comprehensive data privacy laws provide consumers with the right to all of the identified state comprehensive data privacy laws provide consumers with the right to
delete their personal data and opt out of having their personal data collected for certain purposes. delete their personal data and opt out of having their personal data collected for certain purposes.
If enough consumers request their data to be deleted or not collected, these state laws might If enough consumers request their data to be deleted or not collected, these state laws might
reduce the data that can be used for age verification.reduce the data that can be used for age verification.
To reduce the burden on consumers, some companies and nonprofits have started offering services to send requests to companies to delete data on behalf of the consumer.50 This, however, has raised concerns about the identity verification process used to ensure the data belong to the individual submitting the request.51 Additionally, some states that do not have a comprehensive data privacy law have enacted Additionally, some states that do not have a comprehensive data privacy law have enacted
legislation related to specific types of data, such as biometric data, that might affect the use of legislation related to specific types of data, such as biometric data, that might affect the use of
consumer data to conduct age verification (e.g., facial age estimation).consumer data to conduct age verification (e.g., facial age estimation).
52 57
Policy Considerations for Legislation
Multiple bills introduced in the Multiple bills introduced in the
118th119th Congress seek to increase protections for minors online by Congress seek to increase protections for minors online by
creating requirements for website operators.creating requirements for website operators.
5358 Some requirements for website operators, if Some requirements for website operators, if
included in enacted legislation, could be subject to constitutional challenges under the Free included in enacted legislation, could be subject to constitutional challenges under the Free
Speech Clause of the First Amendment.Speech Clause of the First Amendment.
54
59
If Congress were to enact legislation creating requirements for website operators that are specific If Congress were to enact legislation creating requirements for website operators that are specific
to minors, some operators mightto minors, some operators might
• implement changes for all users;implement changes for all users;
•
implement changes for individuals that the operator identifies as minors using implement changes for individuals that the operator identifies as minors using
one or more age verification methods, including those discussed in one or more age verification methods, including those discussed in
"“Methods
Used to Identify Minors Online”;
50 Kaveh Waddell, “How ‘Authorized Agents’ Plan to Make It Easier to Delete Your Online Data,” Consumer Reports, March 21, 2022, https://www.consumerreports.org/electronics/privacy/authorized-agents-plan-to-make-it-easier-to-delete-your-data-a8655835448/; Consumer Reports, “Permission Slip: FAQ,” https://permissionslipcr.com/faq.php; and Optery, “Removes Your Home Address, Phone and Other Private Info from Google and 270+ Sites,” https://www.optery.com/.
51 Kashmir Hill, “Want Your Personal Data? Hand Over More Please,” New York Times, updated October 27, 2021, https://www.nytimes.com/2020/01/15/technology/data-privacy-law-access.html.
52 For example, see Illinois General Assembly, Biometric Information Privacy Act, 740 ILCS 14/, https://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=3004&ChapterID=57; and Washington State Legislature, Biometric Identifiers, Chapter 19.375, https://app.leg.wa.gov/RCW/default.aspx?cite=19.375.
53 Some examples include the Kids Online Safety Act (S. 1409), Children and Teens’ Online Privacy Protection Act (S. 1418), Social Media Child Protection Act (H.R. 821), Sammy’s Law of 2023 (H.R. 5778), and EARN It Act of 2023 (H.R. 2732/S. 1207).
54 For more information on potential constitutional concerns, see CRS Legal Sidebar LSB11021, Online Age
Verification (Part II): Constitutional Background, by Eric N. Holmes; and CRS Legal Sidebar LSB11022, Online Age
Verification (Part III): Select Constitutional Issues, by Eric N. Holmes.
Congressional Research Service
10
link to page 6 Identifying Minors Online
• stop offering certain servicesUsed to Identify Minors Online";
stop offering certain services based on legislative requirements (e.g., if websites were required to prevent adults (e.g., if websites were required to prevent adults
from messaging minors, some websites might not allow any users from messaging minors, some websites might not allow any users
or minors to to communicate with communicate with
other users); or
• each other); or
stop offering the website. stop offering the website.
For example, someSome websites that primarily consist of websites that primarily consist of
pornographic contentpornographic content
, including PornHub, have stopped offering their platform in have stopped offering their platform in
certain states in response to state laws that require these websites to conduct age certain states in response to state laws that require these websites to conduct age
verification beyond self-declaration.verification beyond self-declaration.
5560 Similarly, the social media platform BlueSky stopped offering its service in Mississippi in response to the state law requiring digital service providers to verify their users' ages.61 Some operators might try to avoid this Some operators might try to avoid this
option, particularly if their revenue comes primarily from the website.option, particularly if their revenue comes primarily from the website.
The effectiveness of legislation might depend, in part, on the age verification methods used by the The effectiveness of legislation might depend, in part, on the age verification methods used by the
website operatorsoperator. Although some . Although some
website operators use various age verification methods, operators use various age verification methods,
surveys and internal company data indicate that minors who are below the minimum age surveys and internal company data indicate that minors who are below the minimum age
requirement continue to access some of these websites.requirement continue to access some of these websites.
5662 Each age verification method offers a Each age verification method offers a
different level of assurance and can raise various considerations, as discussed in the previous different level of assurance and can raise various considerations, as discussed in the previous
section. If Congress were not to enact legislation to increase protections for minors online, some section. If Congress were not to enact legislation to increase protections for minors online, some
website operators might still explore various safety measures and age verification methods in operators might still explore various safety measures and age verification methods in
response to public scrutiny, lawsuits,response to public scrutiny, lawsuits,
5763 and laws enacted by states and other countries. and laws enacted by states and other countries.
58
64
This section analyzes some legislative options This section analyzes some legislative options
for addressingto address age verification. Specifically, this age verification. Specifically, this
section provides some potential considerations if Congress chooses to (1) support research on age section provides some potential considerations if Congress chooses to (1) support research on age
verification methods, (2) direct a federal agency to issue guidance or regulations specifying verification methods, (2) direct a federal agency to issue guidance or regulations specifying
requirements related to age verification methods, (3) prohibit or require certain age verification requirements related to age verification methods, (3) prohibit or require certain age verification
methods, and/or (4) implement or support a government age verification system.methods, and/or (4) implement or support a government age verification system.
Support for Research
Congress has directed federal agencies to conduct research related to verifying identities online. Congress has directed federal agencies to conduct research related to verifying identities online.
Examples include the following:Examples include the following:
• In 2019, the Government Accountability Office (GAO) analyzed online identity In 2019, the Government Accountability Office (GAO) analyzed online identity
verification processes used by six federal agencies and whether they relied on verification processes used by six federal agencies and whether they relied on
information provided by consumer reporting agencies (e.g., Equifax, Experian,
55 See footnote 21.
56 For example, 38% of survey respondents ages 8-12 years old stated that they had used a social media platform in 2021 (see Common Sense, The Common Sense Census: Media Use by Tweens and Teens, March 9, 2022, https://www.commonsensemedia.org/research/the-common-sense-census-media-use-by-tweens-and-teens-2021). A chart from an internal presentation at Meta Platforms indicates that the monthly active people penetration was between 20% and 60% for individuals ages 11-13 who were born between 2000 and 2004, and an internal report estimated that 4 million U.S. individuals under 13 were on Instagram in 2015 (see “Complaint for Injunctive and Other Relief,” The
People of the State of California et al. v. Meta Platforms, Inc., case no. 4:23-cv-05448-YGR (N.D. Cal), November 22, 2023, pp. 108-111).
57 For example, multiple state attorneys general filed a lawsuit against Meta Platforms, Inc., for allegedly downplaying and concealing harms to minors caused by Facebook and Instagram, manipulating minors to spend more time on the platforms, and violating the Children’s Online Privacy Protection Act of 1998 (COPPA). See “Complaint for Injunctive and Other Relief,” The People of the State of California et al. v. Meta Platforms, Inc., case no. 4:23-cv-05448-YGR (N.D. Cal), October 24, 2023, pp. 1-4.
58 For example, see the U.K. Online Safety Bill and European Union’s Digital Services Act at Department of Science, Innovation, and Technology and Department of Digital, Culture, Media, and Sport, “A Guide to the Online Safety Bill,” U.K. Government, last updated August 30, 2023, https://www.gov.uk/guidance/a-guide-to-the-online-safety-bill; and European Union, “Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a Single Market For Digital Services and amending Directive 2000/31/EC (Digital Services Act),” October 27, 2022, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022R2065&qid=1666857835014.
Congressional Research Service
11
Identifying Minors Online
and TransUnion),59information provided by consumer reporting agencies (e.g., Equifax, Experian, and TransUnion),65 as requested by Congress. as requested by Congress.
6066 Two of the federal agencies no Two of the federal agencies no
longer relied on information from consumer reporting agencies, and officials longer relied on information from consumer reporting agencies, and officials
cited high costs and implementation challenges for not adopting alternative cited high costs and implementation challenges for not adopting alternative
identify verification methods.identify verification methods.
•
In 2022, Congress directed the National Science Foundation (NSF), subject to the In 2022, Congress directed the National Science Foundation (NSF), subject to the
availability of appropriations, to provide awards to support research on availability of appropriations, to provide awards to support research on
distributed ledger technologies.distributed ledger technologies.
6167 One of the listed potential research areas is the One of the listed potential research areas is the
application of distributed ledger technologies for digital identities.application of distributed ledger technologies for digital identities.
6268 The The
legislation also allows the National Institute of Standards and Technology (NIST) legislation also allows the National Institute of Standards and Technology (NIST)
to carry out a research project that would identify potential applications of to carry out a research project that would identify potential applications of
distributed ledger technologies that could distributed ledger technologies that could
“"improve the privacy and improve the privacy and
interoperability of digital identity and access management solutions.interoperability of digital identity and access management solutions.
”63
In the 118th Congress, legislation"69 Legislation has been introduced to support research specifically on age has been introduced to support research specifically on age
verification methods. For example, the Kids Online Safety Act (verification methods. For example, the Kids Online Safety Act (
H.R. 7891; S. 1409S. 1748; 119th Congress) would ) would
require certain federal agencies to require certain federal agencies to
“"conduct a study evaluating the most technologically feasible conduct a study evaluating the most technologically feasible
methods and options for developing systems to verify age at the device or operating system methods and options for developing systems to verify age at the device or operating system
level,level,
”" in addition to implementing in addition to implementing
requirements that are unrelated to age verificationother requirements for online for online
platforms. Research on age verification methods might occur under broader proposals related to conducting research on online platforms. For example, the Platform Accountability and Transparency Act (S. 1876) would establish a research program for qualified researchers to access qualified data from certain online platforms if the research application is in the public interest, aims to study activity on a platform, and is used for noncommercial purposes.
platforms.
Supporting research on age verification methods could help inform Congress, potentially for Supporting research on age verification methods could help inform Congress, potentially for
future legislative action. For example,future legislative action. For example,
a a federal agency may be able to test the accuracy of some federal agency may be able to test the accuracy of some
age verification methods and provide an in-depth analysis of potential benefits, harms, and risks. age verification methods and provide an in-depth analysis of potential benefits, harms, and risks.
However, website operators would be able to continue using a wide range of age verification However, website operators would be able to continue using a wide range of age verification
methods. Additionally, methods. Additionally,
somesome researchers and organizations have published reports that examine researchers and organizations have published reports that examine
some age verification methods and provide potential tradesome age verification methods and provide potential trade
-offs.64 Additional-offs.70 NIST conducted a study of six facial age estimation systems and found that, on average, the systems estimated the ages of individuals within a range of 3.1 years.71 Additional research might raise research might raise
new considerations and legislative options.new considerations and legislative options.
Congressional
Congressional considerations in this area considerations in this area
mightmight include who include who
might need access to what might need access to what
typestypes of of
data to provide information that would be helpful in creating federal legislationdata to provide information that would be helpful in creating federal legislation
.. For example, to For example, to
create a comprehensive overview of potential age verification methods and their advantages and create a comprehensive overview of potential age verification methods and their advantages and
challenges, assembling challenges, assembling
a working group with researchers from industry, academia, and federal agencies might be sufficient. To analyze a working group with researchers from industry, academia, and federal
59 The Government Accountability Office (GAO) examined six federal agencies: Centers for Medicare and Medicaid Services, General Services Administration, Internal Revenue Service, Social Security Administration, U.S. Postal Service, and Department of Veterans Affairs. GAO, Data Protection: Federal Agencies Need to Strengthen Online
Identity Verification Processes, May 2019, https://www.gao.gov/assets/gao-19-288.pdf.
60 The report specifies that congressional requesters included Senators Ron Wyden and Elizabeth Warren and Representatives Elijah E. Cummings and Jim Jordan (ibid., p. 39). Congress also requested a GAO report on consumer reporting agencies in the Economic Growth, Regulatory Relief, and Consumer Protection Act (P.L. 115-174), §308.
61 P.L. 117-263, Division E, Title LIX, §5913; 42 U.S.C. §19222. 62 Ibid., §(c)(1)(H)(i). 63 Ibid., §(d)(2)(A)(i). 64 For example, see Scott Brennen and Matt Perault, Keeping Kids Safe Online: How Should Policymakers Approach
Age Verification?, The Center for Growth and Opportunity, Utah State University, June 21, 2023, https://www.thecgo.org/research/keeping-kids-safe-online-how-should-policymakers-approach-age-verification/; and Shoshana Weissmann, “The Fundamental Problems with Social Media Age-Verification Legislation,” R Street Institute, May 16, 2023, https://www.rstreet.org/commentary/the-fundamental-problems-with-social-media-age-verification-legislation/.
Congressional Research Service
12
Identifying Minors Online
agencies might be sufficient. To analyze the number of minors accessing websites that rely on the number of minors accessing websites that rely on
certain age verification methods, researchers may need access to these certain age verification methods, researchers may need access to these
websites’websites' internal, internal,
nonpublic datanonpublic data
. This. This might raise additional considerations, such as how the internal data would be might raise additional considerations, such as how the internal data would be
accessed and what information could accessed and what information could
be disclosed.be disclosed.
Requirements for Federal Agencies to Issue Guidance or
Regulations
Regulations
Congress has enacted legislation directing federal agencies to provide guidance or regulations Congress has enacted legislation directing federal agencies to provide guidance or regulations
related to verifying identities and protecting childrenrelated to verifying identities and protecting children
’'s privacy online. Examples include the s privacy online. Examples include the
following:following:
• NIST provides guidance on identity verification standards for federal agencies NIST provides guidance on identity verification standards for federal agencies
that offer online servicesthat offer online services
, such as login.gov,65 through its through its
Digital Identity
Guidelines,,
6672 as required by the Federal Information Security Modernization Act as required by the Federal Information Security Modernization Act
of 2014.of 2014.
6773 The guidelines provide three levels of assurance within three main The guidelines provide three levels of assurance within three main
components: (1) enrollment and identity proofing, (2) authentication and components: (1) enrollment and identity proofing, (2) authentication and
lifecycle management, and (3) federation and assertions.lifecycle management, and (3) federation and assertions.
6874 In May 2019, the In May 2019, the
Office of Management and Budget required federal agencies to implement Office of Management and Budget required federal agencies to implement
NIST’NIST's s
Digital Identity Guidelines..
69
• The FTC was directed75 Login.gov, a platform operated by the General Services Administration, came under scrutiny in 2023 for advertising and billing a higher level of identity assurance than it was able to offer.76
Congress directed the FTC to promulgate regulations for website operators under to promulgate regulations for website operators under
COPPA.70COPPA.77 The FTC outlines steps companies can take to determine whether they The FTC outlines steps companies can take to determine whether they
are covered by COPPA,are covered by COPPA,
7178 provides information on how companies can comply provides information on how companies can comply
with the law,with the law,
7279 and has taken enforcement action against companies for violating and has taken enforcement action against companies for violating
the law.the law.
73 On January 11, 202480 On April 22, 2025, the FTC published a , the FTC published a
notice of proposed rulemakingfinal rule to amend COPPA regulations.81Legislation has been introduced to direct a federal agency to provide guidance or promulgate regulations. For example, the SCREEN Act (H.R. 1623, S. 737; 119th Congress) would direct the FTC to provide guidance to covered platforms on complying with requirements to use a technology verification measure to verify a user's age. The to amend COPPA regulations. The notice seeks comments on various issues, including whether operators should be given an exception or other incentive to “conduct an analysis of their sites’ or services’ user bases” and
65 Login.gov is currently compliant with the first identity assurance level (see General Services Administration, “Our Services,” Login.gov Partners, https://www.login.gov/partners/our-services/). For more information about login.gov, see CRS In Focus IF12395, Login.gov: Administration and Identity Authentication, by Dominick A. Fiorentino, Natalie R. Ortiz, and Meghan M. Stuessy.
66 Paul Grassi, Michael Garcia, and James Fenton, Digital Identity Guidelines, NIST Special Publication 800-63-3, last updated March 2, 2020, https://pages.nist.gov/800-63-3/. An initial public draft of the fourth revision is available at https://pages.nist.gov/800-63-4/.
67 P.L. 113-283; 44 U.S.C. §§3551-3559. 68 Federation and assertions refers to the protocol used in a federated environment to communicate authentication and attribute information, when applicable, to the party relying on this information. After the entity conducting the verification completes the authentication process, it generates an assertion containing the results to the requesting party. Ibid.
69 Office of Management and Budget, “Memorandum for Heads of Executive Department and Agencies,” May 21, 2019, https://www.whitehouse.gov/wp-content/uploads/2019/05/M-19-17.pdf.
70 15 U.S.C. §6502. 71 FTC, “Children’s Online Privacy Protection Rule: A Six-Step Compliance Plan for Your Business,” https://www.ftc.gov/business-guidance/resources/childrens-online-privacy-protection-rule-six-step-compliance-plan-your-business.
72 Ibid. FTC, “Complying with COPPA: Frequently Asked Questions,” https://www.ftc.gov/business-guidance/resources/complying-coppa-frequently-asked-questions.
73 For a list of enforcement actions taken by the FTC, see FTC, “Cases Tagged with Children’s Online Privacy Protection Act (COPPA),” https://www.ftc.gov/enforcement/cases-proceedings/terms/875.
Congressional Research Service
13
Identifying Minors Online
examples of reliable methods operators can use to “determine the likely ages of a site’s or service’s users.”74 Operators are not required to determine users’ ages.75
In the 118th Congress, legislation has been introduced to direct a federal agency to provide guidance or promulgate regulations. For example, the Kids PRIVACY Act (H.R. 2801 Kids PRIVACY Act (H.R. 2801
, 118th Congress) would have directed) would direct the FTC to promulgate regulations requiring a risk-based approach to determine the age of the FTC to promulgate regulations requiring a risk-based approach to determine the age of
a user, where higher privacy and security risks would require a higher certainty of the usera user, where higher privacy and security risks would require a higher certainty of the user
’'s age. s age.
Some mandatory requirements could be subject to constitutional challengesSome mandatory requirements could be subject to constitutional challenges
.76, as mentioned above.82 Congress could Congress could
also also direct a federal agency to promulgate regulations or establish incentives for self-regulation by enabling industry groups and other entities to establish incentives for self-regulation by enabling industry groups and other entities to
provide guidelines to meet regulations prescribed by a federal agency, similar to COPPAprovide guidelines to meet regulations prescribed by a federal agency, similar to COPPA
’'s safe s safe
harbor program.harbor program.
77
83
Guidance or regulations from a federal agency may influence the age verification methods that Guidance or regulations from a federal agency may influence the age verification methods that
are developed and used by website operators. This could provide flexibility for website operators are developed and used by website operators. This could provide flexibility for website operators
and other entities to explore new age verification methods, particularly if new options become and other entities to explore new age verification methods, particularly if new options become
feasible with technological developments, while addressing concerns some of the methods might feasible with technological developments, while addressing concerns some of the methods might
raise. The effectiveness of agency guidelines or regulations would depend on the different criteria raise. The effectiveness of agency guidelines or regulations would depend on the different criteria
the guidelines or regulations would include and how feasible it would be for website operators to the guidelines or regulations would include and how feasible it would be for website operators to
address. For example, if the regulations required a high level of assurance while prohibiting the address. For example, if the regulations required a high level of assurance while prohibiting the
use of government-issued documentation and consumer data, it might be difficult for website use of government-issued documentation and consumer data, it might be difficult for website
operators to comply.operators to comply.
The scope of the regulations may also arise as a consideration when issuing regulatory authority. The scope of the regulations may also arise as a consideration when issuing regulatory authority.
For example, Congress could provide specific criteria that should be considered in the For example, Congress could provide specific criteria that should be considered in the
development of age verification methods and the importance of eachdevelopment of age verification methods and the importance of each
criterion, or it could allow an agency , or it could allow an agency
to determine what criteria should be considered. Providing more detail in legislation could to determine what criteria should be considered. Providing more detail in legislation could
provide greater clarity for companies, enforcers, and courts and help ensure the legislation is provide greater clarity for companies, enforcers, and courts and help ensure the legislation is
enforced as Congress intended. However, providing an agency with greater flexibility might enforced as Congress intended. However, providing an agency with greater flexibility might
allow the agency to respond to technological developments that make it feasible to implement allow the agency to respond to technological developments that make it feasible to implement
new methods. This might also create some uncertainty, depending on how frequently agency-new methods. This might also create some uncertainty, depending on how frequently agency-
promulgated definitions or regulations are altered.promulgated definitions or regulations are altered.
Requiring or Prohibiting Certain Age Verification Methods
Subject to the potential constitutional limitations mentioned above,
Congress could require or Congress could require or
prohibit website operators from using certain methods to determine a userprohibit website operators from using certain methods to determine a user
’s age. For example, the 's age, although this may be subject to the potential constitutional limitations mentioned above. For example, the CHAT Act (S. 2714; 119th Congress) would require entities that operate AI chatbots to verify a user's age using a "commercially available method or process that is reasonably designed to ensure accuracy." The Protecting Kids on Social Media Act (Protecting Kids on Social Media Act (
S. 1291; 118th CongressS. 1291) would ) would
requirehave required social media platforms to take social media platforms to take
“"reasonable steps beyond merely requiring attestationreasonable steps beyond merely requiring attestation
” and prohibit" and prohibited them from using or retaining them from using or retaining
“"any information collected as part of the platformany information collected as part of the platform
’'s age verification process.s age verification process.
” It would also direct " It also would have directed the Department of Commerce to establish a pilot program to provide a secure digital the Department of Commerce to establish a pilot program to provide a secure digital
identification credential for U.S. citizens and lawful residents. Legislation also could affect age identification credential for U.S. citizens and lawful residents. Legislation also could affect age
74 FTC, “Children’s Online Privacy Protection Rule,” 89 Federal Register 2034, January 11, 2024, p. 2036, https://www.federalregister.gov/documents/2024/01/11/2023-28569/childrens-online-privacy-protection-rule.
75 Ibid., p. 2037. 76 CRS Legal Sidebar LSB11022, Online Age Verification (Part III): Select Constitutional Issues, by Eric N. Holmes. 77 For more information about the safe harbor program, see FTC, “COPPA Safe Harbor Program,” at https://www.ftc.gov/enforcement/coppa-safe-harbor-program.
Congressional Research Service
14
link to page 5 link to page 5 Identifying Minors Online
verification methods indirectly. For example, legislation related to consumer data privacy or AI verification methods indirectly. For example, legislation related to consumer data privacy or AI
might incentivize operators to avoid certain age verification methods and rely on others.might incentivize operators to avoid certain age verification methods and rely on others.
78
Website operators
Website operators
’' responses to legislation prohibiting or requiring certain age verification responses to legislation prohibiting or requiring certain age verification
methods would likely depend on the number of options specified and the legislative language methods would likely depend on the number of options specified and the legislative language
used. For example, if legislation requires that operators use an age verification method other than used. For example, if legislation requires that operators use an age verification method other than
a usera user
’'s attestation, operators would have several methods to choose from. Similarly, certain s attestation, operators would have several methods to choose from. Similarly, certain
terminology—such as requiring a terminology—such as requiring a
“"reasonable method of verificationreasonable method of verification
”"—might be subject to —might be subject to
interpretation and potentially result in a wide range of methods used.interpretation and potentially result in a wide range of methods used.
Allowing website operators to use various age verification methods might result in different Allowing website operators to use various age verification methods might result in different
levels of assurance, privacy risks, and other trade-offs discussed in the section levels of assurance, privacy risks, and other trade-offs discussed in the section
"“Methods Used to
Identify Minors Online.” However." However, if legislation restricts operators to a limited number of age , if legislation restricts operators to a limited number of age
verification methods, it might increase the likelihood that operators are unable or unwilling to verification methods, it might increase the likelihood that operators are unable or unwilling to
determine usersdetermine users
’' ages, particularly if ages, particularly if
the operators see the types of age verification methods allowed the types of age verification methods allowed
areas costly and costly and
difficult to implement. It might increase the likelihood that website operators stop offering their difficult to implement. It might increase the likelihood that website operators stop offering their
services and might be more likely to raise constitutional concerns.services and might be more likely to raise constitutional concerns.
79
Government Age Verification System
84 In June 2025, the Supreme Court ruled that a Texas law requiring certain websites that provide sexually explicit material to conduct age verification using certain allowable methods—including using a third-party service to check government-issued IDs or transactional data—does not violate the First Amendment.85 This ruling suggests that age verification requirements may be a constitutional means of restricting minors' access to at least some kinds of content.86
Government Age Verification System
Congress has enacted legislation requiring federal agencies to use their records to confirm Congress has enacted legislation requiring federal agencies to use their records to confirm
information provided by certain entities. Examples are as follows:information provided by certain entities. Examples are as follows:
• In an effort to reduce fraud, Congress directed the Social Security Administration In an effort to reduce fraud, Congress directed the Social Security Administration
(SSA) to develop or modify a database to confirm the validity of certain personal (SSA) to develop or modify a database to confirm the validity of certain personal
information provided electronically by financial institutions if the individual information provided electronically by financial institutions if the individual
gives consent.gives consent.
8087 In response, SSA created the electronic Consent Based Social In response, SSA created the electronic Consent Based Social
Security Number Verification (eCBSV) service, which verifies that the Security Number Verification (eCBSV) service, which verifies that the
individual’individual's Social Security number (SSN), name, and date of birth combination s Social Security number (SSN), name, and date of birth combination
matches SSAmatches SSA
’'s records; it does not verify an individuals records; it does not verify an individual
’'s identity.s identity.
81
• 88
Congress directed the Attorney General to work with SSA and the Department of Congress directed the Attorney General to work with SSA and the Department of
Homeland Security (DHS) to create a voluntary pilot program to compare Homeland Security (DHS) to create a voluntary pilot program to compare
information on employeesinformation on employees
’' I-9 forms with government records to confirm each I-9 forms with government records to confirm each
employee’employee's identity and authorization to work in the United States.s identity and authorization to work in the United States.
8289 The The
legislation states, legislation states,
“"Nothing in this subtitle shall be construed to authorize, Nothing in this subtitle shall be construed to authorize,
directly or indirectly, the issuance or use of national identification cards or the directly or indirectly, the issuance or use of national identification cards or the
establishment of a national identification card.establishment of a national identification card.
”83"90 The pilot program became E- The pilot program became E-
78 For example, §6(a) of the Algorithmic Justice and Online Platform Transparency Act (H.R. 4624/S. 2325) would prohibit an online platform from using any proprietary design features that process personal information in a manner that makes certain goods or services unavailable based on biometric or other information. This might discourage website operators from using facial age estimation technologies to determine whether an individual can access the website.
79 See the “Speech Rights of Website Operators” section in CRS Legal Sidebar LSB11022, Online Age Verification
(Part III): Select Constitutional Issues, by Eric N. Holmes.
80 P.L. 115-174, Title II, §215; 42 U.S.C. §405b. 81 For more information, see Social Security Administration (SSA), “Information About eCBSV,” https://www.ssa.gov/dataexchange/eCBSV/.
82 P.L. 104-208, Title IV, Subtitle A, §§401-405; 8 U.S.C. §1324a note. 83 P.L. 104-208, Title IV, Subtitle A, §404(h)(2).
Congressional Research Service
15
Identifying Minors Online
Verify and is administered by DHS. Some states require some or all businesses to Verify and is administered by DHS. Some states require some or all businesses to
use E-Verify through contracting or business licensing laws.use E-Verify through contracting or business licensing laws.
84
91Legislative options could include expanding the entities that are able to use these services to Legislative options could include expanding the entities that are able to use these services to
include website operators or directing a federal agency to develop a new system to help confirm include website operators or directing a federal agency to develop a new system to help confirm
the age of users. Some considerations may include the following:the age of users. Some considerations may include the following:
• The level of assurance necessary to access a website. Some websites might not Some websites might not
need the same level of assurance as opening an account with a financial need the same level of assurance as opening an account with a financial
institution or confirming an employeeinstitution or confirming an employee
’'s authorization to work in the United s authorization to work in the United
States. Congress might consider whether different websites need different levels States. Congress might consider whether different websites need different levels
of assurance and which age verification methods might be appropriate.of assurance and which age verification methods might be appropriate.
•
The federal agency best suited to provide an age verification system. Some Some
considerations might include what information the agency has access to, the considerations might include what information the agency has access to, the
agency’agency's existing authorities, and whether the agency has the necessary resources s existing authorities, and whether the agency has the necessary resources
and systems to provide the service.and systems to provide the service.
•
What information would be provided and to whom.. Requiring individuals to Requiring individuals to
provide their SSN to website operators, for example, might raise consumer provide their SSN to website operators, for example, might raise consumer
privacy concerns, particularly as certain operators are not subject to the same privacy concerns, particularly as certain operators are not subject to the same
consumer data protection requirements as other entities, such as financial consumer data protection requirements as other entities, such as financial
institutions.institutions.
8592 Additionally, if every website operator had to provide SSNs to SSA Additionally, if every website operator had to provide SSNs to SSA
for verification, it might raise concerns about potential government surveillance.for verification, it might raise concerns about potential government surveillance.
Another option could be providing individuals access to an age verification Another option could be providing individuals access to an age verification
system, similar to how digital IDs are used to access certain websites in some system, similar to how digital IDs are used to access certain websites in some
states. Websites could direct individuals to log in to a system to obtain states. Websites could direct individuals to log in to a system to obtain
verification that the individual meets a certain age threshold without obtaining verification that the individual meets a certain age threshold without obtaining
additional personal information. This option might not fully address concerns additional personal information. This option might not fully address concerns
about government surveillance.about government surveillance.
•
Whether operators and consumers would use the age verification system.
For example, the Dot Kids Implementation and Efficiency Act of 2002 directed For example, the Dot Kids Implementation and Efficiency Act of 2002 directed
the National Telecommunications and Information Administration (NTIA) to the National Telecommunications and Information Administration (NTIA) to
establish and oversee a second-level internet domain that would only provide establish and oversee a second-level internet domain that would only provide
access to material suitable for minors.access to material suitable for minors.
8693 NTIA indefinitely suspended the second- NTIA indefinitely suspended the second-
level domain in 2012 because it was unable to gain public interest.level domain in 2012 because it was unable to gain public interest.
8794 The The
effectiveness of an age verification system might depend, in part, on whether effectiveness of an age verification system might depend, in part, on whether
operators of popular websites use the system.
84 For more information about E-Verify, see CRS Report R40446, Electronic Employment Eligibility Verification, by Andorra Bruno; DHS, “What Is E-Verify?,” last updated June 2, 2023, https://www.e-verify.gov/about-e-verify/what-is-e-verify; and DHS, “History and Milestones,” last updated May 4, 2023, https://www.e-verify.gov/about-e-verify/history-and-milestones.
85 Financial institutions and their affiliates are subject to consumer data protection requirements under the Gramm-Leach-Bliley Act (15 U.S.C. §§6801-6809). For an overview of the Gramm-Leach-Bliley Act and other data protection laws, see CRS Report R45631, Data Protection Law: An Overview, by Stephen P. Mulligan and Chris D. Linebaugh.
86 P.L. 107-317; 47 U.S.C. §941. 87 NTIA, “.us Domain Space,” https://www.ntia.gov/page/us-domain-space (see “2007 Contract – Modification 0012” on June 27, 2012). According to an industry publication, the number of domain name registrations was relatively low, the use of the extension was limited, and it was determined that “there are now numerous websites with high-quality content aimed at children and numerous tools available to create a safe internet space for children.” Hogan Lovells International LLP, “NTIA Suspends ‘.kids.us’ Extension,” World Trademark Review Daily, September 10, 2012, https://www.hoganlovells.com/-/media/hogan-lovells/pdf/publication/parlib011219512v1worldtrademarkreviewdailydtaylor100912_pdf.pdf.
Congressional Research Service
16
Identifying Minors Online
• operators of popular websites use the system.
Whether the legislation would raise concerns about federalism. Many records Many records
of individuals—such as birth, marriage, and death records and driversof individuals—such as birth, marriage, and death records and drivers
’' licenses— licenses—
are maintained by states, although some federal agencies and other entities are maintained by states, although some federal agencies and other entities
acquire this information from states.acquire this information from states.
8895 While Congress may be able to acquire or While Congress may be able to acquire or
regulate this information in some circumstances, federalism principles may regulate this information in some circumstances, federalism principles may
prevent Congress from mandating that states use the information to assist in prevent Congress from mandating that states use the information to assist in
federal age verification policies.federal age verification policies.
89
96Congress could also incentivize states to implement an age verification system, such as providing Congress could also incentivize states to implement an age verification system, such as providing
states with funding to assist with a systemstates with funding to assist with a system
’'s development and implementation. For example, s development and implementation. For example,
although states manage elections, the Help America Vote Act of 2002 implemented minimum although states manage elections, the Help America Vote Act of 2002 implemented minimum
standards for states and established the Election Assistance Commission to assist states with standards for states and established the Election Assistance Commission to assist states with
federal elections.federal elections.
9097 Congress could implement similar provisions for a digital ID system. Some Congress could implement similar provisions for a digital ID system. Some
states have implemented digital ID systems or are considering doing so, and providing incentives states have implemented digital ID systems or are considering doing so, and providing incentives
might encourage other states to implement systems that websites could use. It may be possible to might encourage other states to implement systems that websites could use. It may be possible to
implement similar systems with, for example, each stateimplement similar systems with, for example, each state
’'s division for vital records.s division for vital records.
91
98
Some states might not want to implement an age verification system, even if they are Some states might not want to implement an age verification system, even if they are
given offered incentives. A state digital ID system would raise some of the considerations mentioned above, incentives. A state digital ID system would raise some of the considerations mentioned above,
such as which division would be best suited to provide information for an age verification systemsuch as which division would be best suited to provide information for an age verification system
and concerns about government surveillance. . A state-run system might raise additional considerations, such as whether there would be A state-run system might raise additional considerations, such as whether there would be
minimum standards or security levels across states and who would set these standards.minimum standards or security levels across states and who would set these standards.
Concluding Observations
If Congress If Congress
wishesseeks to address age verification in legislation, some overarching considerations to address age verification in legislation, some overarching considerations
may include the following:may include the following:
• Who should be responsible for determining an individual’'s age online? ?
Requiring website operators to treat minors differently than adults without Requiring website operators to treat minors differently than adults without
addressing age verification in legislation might place the responsibility of addressing age verification in legislation might place the responsibility of
identifying usersidentifying users
’' ages on ages on
website operators. Some operators might be able to operators. Some operators might be able to
easily conduct age verification; others might not have the necessary resources to easily conduct age verification; others might not have the necessary resources to
do so.do so.
A consideration may be what requirements, if any, should be placed on devices, A consideration may be what requirements, if any, should be placed on devices,
intermediaries (e.g., app storesintermediaries (e.g., app stores
, web browsers), and state and federal agencies. ), and state and federal agencies.
For example, someSome devices and intermediaries offer parental controls, intermediaries offer parental controls,
99 and additional controls and additional controls
are offered by third-party subscription apps.92 However, this scenario places the
88 For example, the SSA acquires and maintains death data from states to administer some of its programs, and Naphsis, a nonprofit organization, provides access to birth and death data from most states. For more information, see CRS Report R46640, The Social Security Administration’s Death Data: In Brief, by Paul S. Davies; and Naphsis, “Get Fast, Secure Access to Birth and Death Information,” https://www.naphsis.org/get-vital-records/for-work/on-demand. 89 For more information on federalism, see CRS Report R45323, Federalism-Based Limitations on Congressional
Power: An Overview, coordinated by Kevin J. Hickey.
90 P.L. 107-252; 52 U.S.C. §§20901-21145. For more information, see CRS In Focus IF12033, The Help America Vote
Act of 2002 (HAVA): An Overview, by Karen L. Shanton.
91 The vital records division in each state has birth, death, marriage, and divorce records. Contact information for the vital records division for each state is available at Centers for Disease Control and Prevention, National Center for Health Statistics, “Where to Write for Vital Records,” https://www.cdc.gov/nchs/w2w/index.htm. 92 For example, see Google, “How to Set Up Parental Controls on Google Play,” Google Play Help, (continued...)
Congressional Research Service
17
Identifying Minors Online
are offered by third-party subscription apps.100 Apple developed an application programming interface (API) that informs app developers when a user is below a certain age if parents consented to sharing the information when creating the child's account.101 However, this scenario places the burden on guardians who might not be aware of the different parental controls burden on guardians who might not be aware of the different parental controls
available and their efficacy, as well as some of the risks associated with certain available and their efficacy, as well as some of the risks associated with certain
online platforms. Additionally, it might be difficult to implement these types of online platforms. Additionally, it might be difficult to implement these types of
controls on devices used by multiple individuals, such as at libraries and schoolscontrols on devices used by multiple individuals, such as at libraries and schools
.
• , or if children are using a parent's mobile device.
How would legislation on age verification be implemented,, and what are the potential effectsare the
potential effects? For example, it would be less burdensome if users needed to For example, it would be less burdensome if users needed to
verify their age once while creating an account with a website, rather than verify their age once while creating an account with a website, rather than
requiring users to verify their age every time they access a website. However, requiring users to verify their age every time they access a website. However,
some websites currently do not require users to create an account. If legislation some websites currently do not require users to create an account. If legislation
were to encourage users to create accounts with each website, it might increase were to encourage users to create accounts with each website, it might increase
the burden on users and potentially have indirect effects on the industry. For the burden on users and potentially have indirect effects on the industry. For
example, if individuals use the account information of popular platforms—such example, if individuals use the account information of popular platforms—such
as Facebook, Google, and Apple—to access other websites, it might allow these as Facebook, Google, and Apple—to access other websites, it might allow these
companies to gather data that are not available for other operators.companies to gather data that are not available for other operators.
93
• 102
How can an entity conducting age verification online confirm that
individuals are who they claim to be? In person, a photo ID can be compared to In person, a photo ID can be compared to
the individual, which is not an option on the internet. Some websites use the individual, which is not an option on the internet. Some websites use
additional authentication methods—such as a security key, authentication app, or additional authentication methods—such as a security key, authentication app, or
a link sent to a connected email address—to confirm individualsa link sent to a connected email address—to confirm individuals
’' identities when identities when
they create an account or access a website.they create an account or access a website.
94103 Some websites ask users to provide Some websites ask users to provide
a selfie with specific requirements in the image so that the user needs to take a a selfie with specific requirements in the image so that the user needs to take a
new photo at that moment.new photo at that moment.
95104 Some minors may be able to bypass these security Some minors may be able to bypass these security
measures if, for example, they have access to their guardianmeasures if, for example, they have access to their guardian
’'s email address.s email address.
If Congress If Congress
wishesseeks to increase protections for minors online in legislation, some general to increase protections for minors online in legislation, some general
considerations may include the following:considerations may include the following:
• Whether requirements for website operators should address only minors.
minors. Some content that may be considered harmful, such as online bullying and Some content that may be considered harmful, such as online bullying and
harassment, can affect all users.harassment, can affect all users.
•
Whether the legislation would apply to all websites or a subset. Some Some
policymakers have focused on websites that primarily host pornographic content policymakers have focused on websites that primarily host pornographic content
and social media platforms. If certain types of content or services are associated and social media platforms. If certain types of content or services are associated
with a greater risk of users being harmed, considerations may include how to with a greater risk of users being harmed, considerations may include how to
define the platforms Congress wishes to address.define the platforms Congress wishes to address.
96
https://support.google.com/googleplay/answer/1075738; Apple, “Use Parental Controls on Your Child’s iPhone, iPad, and iPod Touch,” November 1, 2023, https://support.apple.com/en-us/HT201304; Qustodio, https://www.qustodio.com/en/, and Net Nanny, https://www.netnanny.com/.
93 For example, Pinterest allows users to sign in using Facebook and Google (see Pinterest, https://www.pinterest.com/), and Airbnb allows users to sign in using their Facebook, Google, and Apple account, as well as their email address or phone number (see Airbnb, https://www.airbnb.com/).
94 For example, Login.gov requires additional authentication methods to create an account. See General Services Administration, “Create an Account,” Login.gov, https://www.login.gov/create-an-account/. Using multiple authentication methods to access a website is also known as multifactor authentication or two-step verification; for more information, see Cybersecurity and Infrastructure Security Agency, “Multi-Factor Authentication,” January 5, 2022, https://www.cisa.gov/resources-tools/resources/multi-factor-authentication-mfa.
95 Kashmir Hill, “Want Your Personal Data? Hand Over More Please,” New York Times, updated October 27, 2021, https://www.nytimes.com/2020/01/15/technology/data-privacy-law-access.html.
96 For more information, see CRS Report R47662, Defining and Regulating Online Platforms, coordinated by Clare Y. Cho.
Congressional Research Service
18
Identifying Minors Online
• The feasibility of enforcing legislation. For example, searches for virtual
private networks (VPNs) reportedly spiked after some websites that primarily provide pornographic content stopped being offered in certain states in response to state age verification laws.97
• Potential unintended effects. For example, if legislation were to create
requirements that are burdensome for platforms to implement, it might be difficult for nascent companies to enter and compete with incumbents that have more resources.
Author Information
Clare Y. Cho
Specialist in Industrial Organization and Business Policy
Acknowledgments
Lena Maman, Research Librarian, provided research assistance for this report.
Disclaimer
This document was prepared by the Congressional Research Service (CRS). CRS serves as nonpartisan shared staff to congressional committees and Members of Congress. It operates solely at the behest of and under the direction of Congress. Information in a CRS Report should not be relied upon for purposes other than public understanding of information that has been provided by CRS to Members of Congress in connection with CRS’s institutional role. CRS Reports, as a work of the United States Government, are not subject to copyright protection in the United States. Any CRS Report may be reproduced and distributed in its entirety without permission from CRS. However, as a CRS Report may include copyrighted images or material from a third party, you may need to obtain the permission of the copyright holder if you wish to copy or otherwise use copyrighted material.
97 Ned Oliver, “Virginia Leads Nation in VPN Searches After PornHub Block,”105
The feasibility of enforcing legislation. For example, searches for virtual private networks (VPNs) reportedly spiked after some websites that primarily provide pornographic content stopped being offered in certain states in response to state age verification laws.106
Potential unintended effects. For example, if legislation were to create requirements that are burdensome for platforms to implement, nascent companies may find it difficult to enter and compete with more resourced incumbents.
Lena Maman, Senior Research Librarian, provided research assistance for this report.
Footnotes
| 1.
|
From 2013 to 2023, the percentage who experienced persistent feelings of sadness or hopelessness increased from 30% to 40% (39% to 53% for females, 21% to 28% for males), and the percentage of high school students who seriously considered attempting suicide increased from 17% to 20% (22% to 27% for females, 12% to 14% for males). See Centers for Disease Control and Prevention, Youth Risk Behavior Survey: Data Summary and Trends Report, 2013-2023, pp. 54-61, https://www.cdc.gov/healthyyouth/data/yrbs/yrbs_data_summary_and_trends.htm.
|
| 2.
|
This report uses the term website to refer to websites, online platforms, and mobile applications, and the term website operator for the entities that provide these websites.
|
| 3.
|
For example, see National Academies of Sciences, Engineering, and Medicine, Social Media and Adolescent Health, (The National Academies Press, 2024), https://doi.org/10.17226/27396; and U.S. Surgeon General Vivek Murthy, Social Media and Youth Mental Health: The U.S. Surgeon General's Advisory, U.S. Department of Health and Human Services, 2023, https://www.hhs.gov/sites/default/files/sg-youth-mental-health-social-media-advisory.pdf.
|
| 4.
|
An example of legislation Congress has enacted that does not create requirements for website operators is the Protecting Children in the 21st Century Act, which implemented a nationwide program to increase public awareness and provide education on strategies to promote safe use of the internet by children (P.L. 110-385, Title II, §§201-216; 15 U.S.C. §§6551-6555).
|
| 5.
|
P.L. 105-277, Division C, Title XIII, §§1301-1308; 15 U.S.C. §§6501-6506.
|
| 6.
|
P.L. 110-401, Title V, §§501-503 (has been amended twice: P.L. 115-395, P.L. 118-59); 18 U.S.C. §§2258A-2258E.
|
| 7.
|
Legislation requiring website operators to actively search for content might raise constitutional concerns under the Fourth Amendment. For more information, see CRS Legal Sidebar LSB10713, The Fourth Amendment and the Internet: Legal Limits on Digital Searches for Child Sexual Abuse Material (CSAM), by Michael A. Foster.
|
| 8.
|
P.L. 119-12; 47 U.S.C. §§223, 223a.
|
| 9.
|
For example, the Child Online Protection Act (P.L. 105-277, Division C, Title XIV, §§1401-1406; 47 U.S.C. §231). For more information, see CRS Report R47049, Children and the Internet: Legal Considerations in Restricting Access to Content, by Eric N. Holmes.
|
| 10.
|
For example, see U.S. Congress, House Committee on Energy and Commerce, Subcommittee on Commerce, Manufacturing, and Trade, The World Wide Web: Examining Harms Online, hearing, 119th Cong., 1st sess., March 26, 2025, https://docs.house.gov/Committee/Calendar/ByEvent.aspx?EventID=118066; and Kids Online Safety Act (S. 1748).
|
11.
|
For example, see California Age-Appropriate Design Code (California Civil Code, Division 3, Part 4, Title 1.81.47, https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&title=1.81.47.&part=4.&chapter=&article=); and Utah Social Media Regulation Act (Utah Code, Title 13, Chapter 63, https://le.utah.gov/~2023/bills/static/SB0152.html).
For an overview of some state laws seeking to protect minors online, see CRS Legal Sidebar LSB11020, Online Age Verification (Part I): Current Context, by Eric N. Holmes.
| 12.
|
For example, see CRS Legal Sidebar LSB11071, NetChoice v. Bonta and First Amendment Limits on Protecting Children Online, by Peter J. Benson.
|
| 13.
|
For example, see NetChoice, LLC v. Griffin, No. 5:23-CV-5105, 2025 WL 978607, at *14 (W.D. Ark. Mar. 31, 2025) (holding that Arkansas Act 689 "is a content-based restriction on speech that is not narrowly tailored to serve a compelling government interest" and "therefore violates the First Amendment"), appeal filed, No. 25-1889 (8th Cir. 2025); NetChoice, LLC v. Yost, 778 F. Supp. 3d 923, 959 (S.D. Ohio 2025) (permanently enjoining enforcement of Ohio's Parental Notification by Social Media Operators Act), appeal filed, No. 25-3371 (6th Cir. 2025).
|
| 14.
|
Walker Montgomery Protecting Children Online Act (Mississippi Legislature, H.B. 1126, https://billstatus.ls.state.ms.us/2024/pdf/history/HB/HB1126.xml); Supreme Court of the United States, NetChoice, LLC v. Lynn Fitch, Attorney General of Mississippi, August 14, 2025, https://www.supremecourt.gov/opinions/24pdf/25a97_5h25.pdf; Amy Howe, "Supreme Court Allows Restrictions on Children's Access to Social Media to Remain in Place," SCOTUSblog, August 14, 2025, https://www.scotusblog.com/2025/08/supreme-court-allows-mississippi-restrictions-on-childrens-social-media-access-to-remain-in-place/.
|
15.
|
Throughout this report, the term age verification is used to discuss all methods used to determine the age of an individual. The term age assurance is used as an umbrella term that includes age verification and age estimation, which consist of different methods (for example, see Age Check Certification Scheme, "ISO Working Draft Age Assurance Systems Standard," euCONSENT, November 2021, https://euconsent.eu/download/iso-working-draft-age-assurance-systems-standard/). This report does not make this distinction.
16.
|
Examples of companies that offer age verification services include Entrust and Veratad. See Entrust, "Age Verification," 2025, https://www.entrust.com/use-case/age-verification; and Veratad Technologies, "Flexible, Secure Age Verification," 2025, https://veratad.com/solutions/age-verification/.
17.
|
Guinness, https://www.guinness.com/en-us; Budweiser, https://us.budweiser.com/; and Patron Tequila, https://www.patrontequila.com/.
| 18.
|
Meta Platforms, "Introducing New Ways to Verify Age on Instagram," June 23, 2022, https://about.instagram.com/blog/announcements/new-ways-to-verify-age-on-instagram.
|
19.
|
Erica Finkle et al., "How Meta Uses AI to Better Understand People's Ages on Our Platforms," Tech at Meta, Meta Platforms, June 22, 2022, https://tech.facebook.com/artificial-intelligence/2022/06/adult-classifier/.
20.
|
Yoti, "Age Verification Should Be Just an Age," https://www.yoti.com/business/age-verification/.
| 21.
|
Instagram used to allow users to confirm their age with social vouching (i.e., other users confirm a user's age) but stated the option was removed to make improvements on October 13, 2022. Meta Platforms, "Introducing New Ways to Verify Age on Instagram," June 23, 2022, https://about.instagram.com/blog/announcements/new-ways-to-verify-age-on-instagram.
|
| 22.
|
YouTube, "Who May Use the Service?," last updated December 15, 2023, https://www.youtube.com/t/terms#eb887a967c.
|
| 23.
|
James Beser, "Extending Our Built-in Protections to More Teens on YouTube," YouTube Official Blog, July 29, 2025, https://blog.youtube/news-and-events/extending-our-built-in-protections-to-more-teens-on-youtube/.
|
| 24.
|
Tinder, "How Does Age Verification Work?," https://www.help.tinder.com/hc/en-us/articles/360040592771-How-does-age-verification-work-.
|
| 25.
|
Adi Robertson, "Louisiana Now Requires a Government ID to Access Pornhub," Verge, January 3, 2023, https://www.theverge.com/2023/1/3/23537226/louisiana-pornhub-age-verification-law-government-id.
|
26.
|
The 21 states are Alabama, Arkansas, Florida, Georgia, Idaho, Indiana, Kansas, Kentucky, Mississippi, Montana, Nebraska, North Carolina, North Dakota, Oklahoma, South Carolina, South Dakota, Tennessee, Texas, Utah, Virginia, and Wyoming (see Pornhub, "Age Verification in the U.S.," July 31, 2025, https://www.pornhub.com/blog/age-verification-in-the-news).
| 27.
|
In 2023, 160,668,889 valid passports were in circulation (see U.S. Department of State, Bureau of Consular Affairs, "Reports and Statistics," https://travel.state.gov/content/travel/en/about-us/reports-and-statistics.html). That year, the number of U.S. citizens was estimated to be 312,053,551 (see Census Bureau's American Community Survey one-year estimate at https://data.census.gov/table/ACSSE2023.K200501). This means that if each valid passport belonged to a different individual, at most, 51% of U.S. citizens had a U.S. passport. The actual percentage may be lower; an individual can have both a passport book and card, which counts as two valid passports, and qualifying non-U.S. citizens can have a U.S. passport.
|
| 28.
|
U.S. Department of Transportation (DOT), Federal Highway Administration (FHWA), Office of Highway Policy Information, Policy and Governmental Affairs, "6.3.1. Licensed Drivers—Ratio of Licensed Drivers to Population," Highway Statistics Series 2023, January 2025, https://www.fhwa.dot.gov/policyinformation/statistics/2023/dl1c.cfm.
|
| 29.
|
DOT, FHWA, Office of Highway Policy Information, Policy and Governmental Affairs, "6.3.2. Licensed Drivers, by Sex and Percentage in Each Age Group," Highway Statistics Series 2023, January 2025, https://www.fhwa.dot.gov/policyinformation/statistics/2023/dl20.cfm.
|
| 30.
|
Ibid. The "under 16" group is compared with 14- and 15-year-old population estimates. Ten states are estimated to have individuals younger than sixteen with a driver's license in 2023 (see DOT, FHWA, Office of Highway Policy Information, Policy and Governmental Affairs, "6.3.3. Licensed Drivers, by State, Sex, and Age Group," Highway Statistics Series 2023, January 2025, https://www.fhwa.dot.gov/policyinformation/statistics/2023/dl22.cfm).
|
| 31.
|
Ibid.
|
| 32.
|
In 2023, the number of foreign-born individuals (excluding U.S. citizens born abroad to American parent[s]) was estimated to be 47,831,411, and the total U.S. population was estimated to be 334,914,896 (see Census Bureau's American Community Service one-year estimate at https://data.census.gov/table/ACSSE2023.K200503).
|
33.
|
UNICEF, "Birth Registration," last updated June 2025, https://data.unicef.org/topic/child-protection/birth-registration/.
| 34.
|
P.L. 109-13, Division B, Title II. For more information about REAL ID, see U.S. Department of Homeland Security (DHS), "About REAL ID," https://www.dhs.gov/real-id/about-real-id.
|
| 35.
|
DHS, "REAL ID Frequently Asked Questions," https://www.dhs.gov/real-id/real-id-faqs.
|
| 36.
|
The number of private schools is reported every other year and was not reported for the 2020-2021 school year; there were 30,492 private schools in the 2019-2020 school year. See National Center for Education Statistics, "Educational Institutions," https://nces.ed.gov/fastfacts/display.asp?id=84.
|
| 37.
|
In this report, a digital ID refers to an electronic version of a government-issued document. It does not include other information individuals might use to identify themselves on the internet, such as usernames or sign-in information.
|
| 38.
|
For more information on which states allow digital IDs to be used at TSA PreCheck, see TSA, "Participating States and Eligible Digital IDs," accessed on September 10, 2025, https://www.tsa.gov/digital-id/participating-states.
|
| 39.
|
For example, the California DMV Wallet can be used in certain retail locations in Sacramento (see State of California DMV, "Download California's First Mobile Driver's License Today," https://www.dmv.ca.gov/portal/ca-dmv-wallet/) and LA Wallet (see LA Wallet, "LA Wallet Origins," https://lawallet.com/about/).
|
40.
|
For example, see Utah Department of Public Safety, "Utah mDL FAQs," https://dld.utah.gov/mdlfaqs/; and Iowa Department of Transportation, "Iowa Mobile ID for Businesses, Organizations, and Agencies," https://iowadot.gov/mvd/MID-businesses.
| 41.
|
The International Organization of Standardization (ISO) and the International Electrotechnical Commission (IEC), Personal Identification – ISO-compliant Driving License – Part 5: Mobile Driving License Application, ISO/IEC 18013-5, September 2021.
|
| 42.
|
P.L. 116-260, Division U, Title X, §1001.
|
| 43.
|
TSA, "Minimum Standards for Driver's Licenses and Identification Cards Acceptable by Federal Agencies for Official Purposes; Waiver for Mobile Driver's Licenses," 89 Federal Register 85340, October 25, 2024, https://www.federalregister.gov/documents/2024/10/25/2024-23881/minimum-standards-for-drivers-licenses-and-identification-cards-acceptable-by-federal-agencies-for.
|
| 44.
|
American Association of Motor Vehicle Administrators, Mobile Driver's License (mDL) Implementation Guidelines, version 1.2, January 2023, https://aamva.org/getmedia/b801da7b-5584-466c-8aeb-f230cef6dda5/mDL-Implementation-Guidelines-Version-1-2_final.pdf.
|
| 45.
|
For example, see IDEMIA, "Mobile ID: Frequently Asked Questions," https://na.idemia.com/dmv-2/mobile-id/.
|
| 46.
|
When this report was published, Louisiana was the only state that explicitly stated its digital ID system can be used for online identity verification (LA Wallet, "Bring Digital Verification to Your Business," https://lawallet.com/digital-verification/).
|
| 47.
|
For example, see Apple, "Apple Launches the First Driver's License and State ID in Wallet with Arizona," Apple Newsroom, last updated March 23, 2022, https://www.apple.com/newsroom/2022/03/apple-launches-the-first-drivers-license-and-state-id-in-wallet-with-arizona/; and Idemia, "Mobile ID: Everything Is on Your Phone. Now Your ID Is Too," https://na.idemia.com/dmv-2/mobile-id/.
|
| 48.
|
Grace Broadbent, "Samsung Wallet Adds State IDs to Compete Against Apple Pay and Google Pay," eMarketer, October 11, 2023, https://content-na1.emarketer.com/samsung-wallets-adds-state-ids-compete-against-apple-pay-google-pay.
|
| 49.
|
For example, see Lubna Takuri, "Age Verification System: How to Verify Customer Ages," Onfido, January 24, 2023, https://onfido.com/blog/age-verification-system/; Yoti, "Age Verification Should be Just an Age," https://www.yoti.com/business/age-verification/; and Google, "Access Age-Restricted Content and Features," Google Account Help, https://support.google.com/accounts/answer/10071085?hl=en.
|
| 50.
|
For example, Yoti reported that the probability that its facial age estimation system correctly identified an individual age 6-11 as younger than 13 was 98.35%. The results separated by skin tone and gender indicate that, on average, the system estimated the ages of individuals 6-11 within a range of 2.2 years or less (based on mean absolute error for each year). Yoti, Yoti Facial Age Estimation, white paper, March 2023, pp. 2, 5, https://www.yoti.com/wp-content/uploads/Yoti-Age-Estimation-White-Paper-March-2023.pdf.
|
| 51.
|
For example, see Prachi Punyani, Rashmi Gupta, and Ashwani Kumar, "Neural Networks for Facial Age Estimation: A Survey on Recent Advances," Artificial Intelligence Review, vol. 53 (2020), pp. 3299-3347, https://doi.org/10.1007/s10462-019-09765-w; and Tzvi Ganel, Carmel Sofer, and Melvyn Goodale, "Biases in Human Perception of Facial Age Are Present and More Exaggerated in Current AI Technology," Nature: Scientific Reports, vol. 12, no. 22519 (2022), https://www.nature.com/articles/s41598-022-27009-w.
|
| 52.
|
CRS Report R47644, Artificial Intelligence: Overview, Recent Advances, and Considerations for the 118th Congress, by Laurie A. Harris; and CRS Report R47569, Generative Artificial Intelligence and Data Privacy: A Primer, by Ling Zhu and Laurie Harris.
|
| 53.
|
For example, facial age estimation using convolutional neural network (CNN) frameworks require very large datasets for training; see Zichang Tan et al., "Efficient Group-n Encoding and Decoding for Facial Age Estimation," IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 40, no. 11 (2018), pp. 2610-2623, https://doi.org/10.1109/TPAMI.2017.2779808; and Oussama Guehairia et al., "Facial Age Estimation Using Tensor Based Subspace Learning and Deep Random Forests," Information Sciences, vol. 609 (September 2022), pp. 1309-1317, https://doi.org/10.1016/j.ins.2022.07.135.
|
| 54.
|
For more information, see CRS Report R47298, Online Consumer Data Collection and Data Privacy, by Clare Y. Cho and Ling Zhu.
|
| 55.
|
For example, a discussion draft of the American Privacy Rights Act (APRA) was passed by the Subcommittee on Innovation, Data, and Commerce of the House Committee on Energy and Commerce on May 23, 2024 (markup available at https://docs.house.gov/Committee/Calendar/ByEvent.aspx?EventID=117372). For more information about APRA, see CRS Legal Sidebar LSB11161, The American Privacy Rights Act, by Chris D. Linebaugh et al.
|
56.
|
Caroline Kibby, "US State Privacy Legislation Tracker," IAPP, last updated July 7, 2025, https://iapp.org/resources/article/us-state-privacy-legislation-tracker/.
| 57.
|
For example, see Illinois General Assembly, Biometric Information Privacy Act, 740 ILCS 14/, https://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=3004&ChapterID=57; and Washington State Legislature, Biometric Identifiers, Chapter 19.375, https://app.leg.wa.gov/RCW/default.aspx?cite=19.375.
|
| 58.
|
Some examples include the Kids Online Safety Act (S. 1409), Children and Teens' Online Privacy Protection Act (S. 1418), Social Media Child Protection Act (H.R. 821), Sammy's Law of 2023 (H.R. 5778), and EARN It Act of 2023 (H.R. 2732/S. 1207).
|
| 59.
|
For more information on potential constitutional concerns, see CRS Legal Sidebar LSB11021, Online Age Verification (Part II): Constitutional Background, by Eric N. Holmes; and CRS Legal Sidebar LSB11022, Online Age Verification (Part III): Select Constitutional Issues, by Eric N. Holmes.
|
| 60.
|
For example, Pornhub is no longer available in 21 states (see footnote 26).
|
| 61.
|
Bluesky Team, "Our Response to Mississippi's Age Assurance Law" (blog), August 22, 2025, https://bsky.social/about/blog/08-22-2025-mississippi-hb1126. For more information about the Mississippi law, see footnote 14).
|
| 62.
|
For example, 38% of survey respondents ages 8-12 years old stated that they had used a social media platform in 2021 (see Common Sense, The Common Sense Census: Media Use by Tweens and Teens, March 9, 2022, https://www.commonsensemedia.org/research/the-common-sense-census-media-use-by-tweens-and-teens-2021). A chart from an internal presentation at Meta Platforms indicates that the monthly active people penetration was between 20% and 60% for individuals ages 11-13 who were born between 2000 and 2004, and an internal report estimated that 4 million U.S. individuals under 13 were on Instagram in 2015 (see "Complaint for Injunctive and Other Relief," The People of the State of California et al. v. Meta Platforms, Inc., case no. 4:23-cv-05448-YGR (N.D. Cal), November 22, 2023, pp. 108-111).
|
| 63.
|
For example, multiple state attorneys general filed a lawsuit against Meta Platforms, Inc., for allegedly downplaying and concealing harms to minors caused by Facebook and Instagram, manipulating minors to spend more time on the platforms, and violating the Children's Online Privacy Protection Act of 1998 (COPPA). See "Complaint for Injunctive and Other Relief," The People of the State of California et al. v. Meta Platforms, Inc., case no. 4:23-cv-05448-YGR (N.D. Cal), October 24, 2023, pp. 1-4.
|
| 64.
|
For examples of state laws, see footnote 11. Examples of laws enacted in other countries include the U.K. Online Safety Act (Department of Science, Innovation, and Technology, "Online Safety Act: Explainer," Guidance, U.K. Government, last updated April 24, 2025, https://www.gov.uk/government/publications/online-safety-act-explainer/online-safety-act-explainer) and European Union's Digital Services Act (European Union, "Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a Single Market For Digital Services and amending Directive 2000/31/EC (Digital Services Act)," October 27, 2022, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022R2065&qid=1666857835014).
|
| 65.
|
The Government Accountability Office (GAO) examined six federal agencies: Centers for Medicare and Medicaid Services, General Services Administration, Internal Revenue Service, Social Security Administration, U.S. Postal Service, and Department of Veterans Affairs. GAO, Data Protection: Federal Agencies Need to Strengthen Online Identity Verification Processes, May 2019, https://www.gao.gov/assets/gao-19-288.pdf.
|
| 66.
|
The report specifies that congressional requesters included Senators Ron Wyden and Elizabeth Warren and Representatives Elijah E. Cummings and Jim Jordan (ibid., p. 39). Congress also requested a GAO report on consumer reporting agencies in the Economic Growth, Regulatory Relief, and Consumer Protection Act (P.L. 115-174), §308.
|
| 67.
|
P.L. 117-263, Division E, Title LIX, §5913; 42 U.S.C. §19222.
|
| 68.
|
Ibid., §(c)(1)(H)(i).
|
| 69.
|
Ibid., §(d)(2)(A)(i).
|
70.
|
For example, see Scott Brennen and Matt Perault, Keeping Kids Safe Online: How Should Policymakers Approach Age Verification?, The Center for Growth and Opportunity, Utah State University, June 21, 2023, https://www.thecgo.org/research/keeping-kids-safe-online-how-should-policymakers-approach-age-verification/; and Shoshana Weissmann, "The Fundamental Problems with Social Media Age-Verification Legislation," R Street Institute, May 16, 2023, https://www.rstreet.org/commentary/the-fundamental-problems-with-social-media-age-verification-legislation/.
| 71.
|
Kayee Hanaoka et al., Face Analysis Technology Evaluation: Age Estimation and Verification, National Institute of Standards and Technology Internal Report 8525, U.S. Department of Commerce, May 2024, https://doi.org/10.6028/NIST.IR.8525.
|
72.
|
Paul Grassi, Michael Garcia, and James Fenton, Digital Identity Guidelines, NIST Special Publication 800-63-3, last updated March 2, 2020, https://pages.nist.gov/800-63-3/. An initial public draft of the fourth revision is available at https://pages.nist.gov/800-63-4/.
| 73.
|
P.L. 113-283; 44 U.S.C. §§3551-3559.
|
| 74.
|
Federation and assertions refers to the protocol used in a federated environment to communicate authentication and attribute information, when applicable, to the party relying on this information. After the entity conducting the verification completes the authentication process, it generates an assertion containing the results to the requesting party. Ibid.
|
| 75.
|
Office of Management and Budget, "Memorandum for Heads of Executive Department and Agencies," May 21, 2019, https://www.whitehouse.gov/wp-content/uploads/2019/05/M-19-17.pdf.
|
| 76.
|
For more information about login.gov and the scrutiny it received, see CRS In Focus IF12395, Login.gov: Administration and Identity Authentication, by Dominick A. Fiorentino, Natalie R. Ortiz, and Meghan M. Stuessy.
|
| 77.
|
15 U.S.C. §6502.
|
| 78.
|
FTC, "Children's Online Privacy Protection Rule: A Six-Step Compliance Plan for Your Business," https://www.ftc.gov/business-guidance/resources/childrens-online-privacy-protection-rule-six-step-compliance-plan-your-business.
|
| 79.
|
Ibid. FTC, "Complying with COPPA: Frequently Asked Questions," https://www.ftc.gov/business-guidance/resources/complying-coppa-frequently-asked-questions.
|
| 80.
|
For a list of enforcement actions taken by the FTC, see FTC, "Cases Tagged with Children's Online Privacy Protection Act (COPPA)," https://www.ftc.gov/enforcement/cases-proceedings/terms/875.
|
| 81.
|
FTC, "Children's Online Privacy Protection Rule," 90 Federal Register 16918, April 22, 2025, https://www.federalregister.gov/documents/2025/04/22/2025-05904/childrens-online-privacy-protection-rule.
|
| 82.
|
CRS Legal Sidebar LSB11022, Online Age Verification (Part III): Select Constitutional Issues, by Eric N. Holmes.
|
| 83.
|
For more information about the safe harbor program, see FTC, "COPPA Safe Harbor Program," at https://www.ftc.gov/enforcement/coppa-safe-harbor-program.
|
| 84.
|
See the "Speech Rights of Website Operators" section in CRS Legal Sidebar LSB11022, Online Age Verification (Part III): Select Constitutional Issues, by Eric N. Holmes.
|
| 85.
|
Texas Legislature Online, H.B. 1181, https://capitol.texas.gov/billlookup/History.aspx?LegSess=88R&Bill=HB1181; Supreme Court of the United States, Free Speech Coalition, Inc., et al. v. Paxton, Attorney General of Texas, July 27, 2025, https://www.supremecourt.gov/opinions/24pdf/23-1122_3e04.pdf.
|
| 86.
|
For more information about the ruling, see CRS Legal Sidebar LSB11354, Supreme Court Upholds State Age-Verification Requirement for Certain Websites, by Victoria L. Killion.
|
| 87.
|
P.L. 115-174, Title II, §215; 42 U.S.C. §405b.
|
88.
|
For more information, see Social Security Administration (SSA), "Information About eCBSV," https://www.ssa.gov/dataexchange/eCBSV/.
| 89.
|
P.L. 104-208, Title IV, Subtitle A, §§401-405; 8 U.S.C. §1324a note.
|
| 90.
|
P.L. 104-208, Title IV, Subtitle A, §404(h)(2).
|
| 91.
|
For more information about E-Verify, see CRS Report R40446, Electronic Employment Eligibility Verification, by Andorra Bruno; DHS, "What Is E-Verify?," last updated June 2, 2023, https://www.e-verify.gov/about-e-verify/what-is-e-verify; and DHS, "History and Milestones," last updated May 4, 2023, https://www.e-verify.gov/about-e-verify/history-and-milestones.
|
| 92.
|
Financial institutions and their affiliates are subject to consumer data protection requirements under the Gramm-Leach-Bliley Act (15 U.S.C. §§6801-6809). For an overview of the Gramm-Leach-Bliley Act and other data protection laws, see CRS Report R45631, Data Protection Law: An Overview, by Stephen P. Mulligan and Chris D. Linebaugh.
|
| 93.
|
P.L. 107-317; 47 U.S.C. §941.
|
| 94.
|
NTIA, ".us Domain Space," https://www.ntia.gov/page/us-domain-space (see "2007 Contract – Modification 0012" on June 27, 2012). According to an industry publication, the number of domain name registrations was relatively low, the use of the extension was limited, and it was determined that "there are now numerous websites with high-quality content aimed at children and numerous tools available to create a safe internet space for children." Hogan Lovells International LLP, "NTIA Suspends '.kids.us' Extension," World Trademark Review Daily, September 10, 2012, https://www.hoganlovells.com/-/media/hogan-lovells/pdf/publication/parlib011219512v1worldtrademarkreviewdailydtaylor100912_pdf.pdf.
|
| 95.
|
For example, the SSA acquires and maintains death data from states to administer some of its programs, and Naphsis, a nonprofit organization, provides access to birth and death data from most states. For more information, see CRS Report R46640, The Social Security Administration's Death Data: In Brief, by Paul S. Davies; and Naphsis, "About Us," https://www.naphsis.org/about-us/.
|
| 96.
|
For more information on federalism, see CRS Report R45323, Federalism-Based Limitations on Congressional Power: An Overview, coordinated by Kevin J. Hickey.
|
| 97.
|
P.L. 107-252; 52 U.S.C. §§20901-21145. For more information, see CRS In Focus IF12033, The Help America Vote Act of 2002 (HAVA): An Overview, by Karen L. Shanton.
|
| 98.
|
The vital records division in each state has birth, death, marriage, and divorce records. Contact information for the vital records division for each state is available at Centers for Disease Control and Prevention, National Center for Health Statistics, "Where to Write for Vital Records," https://www.cdc.gov/nchs/w2w/index.htm.
|
| 99.
|
For example, see Google Play Help, "How to Set Up Parental Controls on Google Play," Google, https://support.google.com/googleplay/answer/1075738; and Apple, "Use Parental controls on Your Child's iPhone or iPad," May 5, 2025, https://support.apple.com/en-us/105121.
|
100.
|
Qustodio, https://www.qustodio.com/en/; and Net Nanny, https://www.netnanny.com/.
| 101.
|
Apple, Helping Protect Kids Online, February 2025, https://developer.apple.com/support/downloads/Helping-Protect-Kids-Online-2025.pdf.
|
| 102.
|
For example, Pinterest allows users to sign in using Facebook and Google (see Pinterest, https://www.pinterest.com/), and Airbnb allows users to sign in using their Facebook, Google, and Apple account, as well as their email address or phone number (see Airbnb, https://www.airbnb.com/).
|
| 103.
|
For example, Login.gov requires additional authentication methods to create an account. See General Services Administration, "Create an Account," Login.gov, https://www.login.gov/create-an-account/. Using multiple authentication methods to access a website is also known as multifactor authentication or two-step verification; for more information, see Cybersecurity and Infrastructure Security Agency, "Multi-Factor Authentication," January 5, 2022, https://www.cisa.gov/resources-tools/resources/multi-factor-authentication-mfa.
|
| 104.
|
Kashmir Hill, "Want Your Personal Data? Hand Over More Please," New York Times, updated October 27, 2021, https://www.nytimes.com/2020/01/15/technology/data-privacy-law-access.html.
|
| 105.
|
For more information, see CRS Report R47662, Defining and Regulating Online Platforms, coordinated by Clare Y. Cho.
|
106.
|
Ned Oliver, "Virginia Leads Nation in VPN Searches After PornHub Block," Axios, July 7, 2023, , July 7, 2023,
https://www.axios.com/local/richmond/2023/07/07/pornhub-ban-virginia-vpn. A virtual private network (VPN) is a https://www.axios.com/local/richmond/2023/07/07/pornhub-ban-virginia-vpn. A virtual private network (VPN) is a
private network that can provide users with increased privacy, such as masking the IP address of their device so that the private network that can provide users with increased privacy, such as masking the IP address of their device so that the
location of the device cannot be identified. For more information, see Sheila Frankel et al., location of the device cannot be identified. For more information, see Sheila Frankel et al.,
Guide to SSL VPNs:
Recommendations of the National Institute of Standards and Technology, Special Publication 800-113, NIST, U.S. , Special Publication 800-113, NIST, U.S.
Department of Commerce, July 2008 pp. 6-36 and 6-37.Department of Commerce, July 2008 pp. 6-36 and 6-37.
Congressional Research Service
R47884 · VERSION 7 · UPDATED
19