Identifying Minors Online
January 2, 2024
Concerns about potential harms to minors on the internet, particularly on social media platforms,
have grown in recent years. Since at least the 1990s, policymakers have enacted legislation
Clare Y. Cho
seeking to protect minors online, some of which create requirements for entities that provide
Analyst in Industrial
websites, mobile applications, and online platforms (collectively, website operators).
Organization and Business
Website operators have developed various methods to determine users’ ages, often in response to
federal or state legislation. Some commonly used methods include (1) relying on self-
identification, such as requiring a user to provide their date of birth or check a box to indicate the
user is of a certain age; (2) requesting documentation, such as a photo identification (ID) or a digitized driver’s license
containing the user’s name and age; and (3) using consumer data, such as analyzing user content posted on the website or an
image of the user’s face. Each of these age verification methods presents different advantages and challenges. For example,
everyone can provide a date of birth, but a website operator cannot verify that information without additional data or
documentation. A website operator that receives a user’s government-issued photo ID might be assured that the individual
meets a minimum age requirement, but not everyone has a government-issued photo ID. This might also raise consumer data
privacy concerns, depending on how the information is stored and shared.
Some Members of Congress have proposed increasing protections for minors online by implementing additional
requirements for website operators. Website operators might respond by (1) implementing changes for all users; (2)
implementing changes for individuals identified as minors, potentially using one of the methods mentioned above; (3) no
longer offering certain services; or (4) no longer offering the entire service in the United States.
If Congress chooses not to address age verification methods used by website operators in legislation, website operators might
still develop and implement new age verification methods in response to public scrutiny, lawsuits, and laws enacted by states
and other countries. If Congress wishes to address age verification in legislation, some potential options include the
following:
• Supporting research on age verification. Congress could, for example, provide funding for or direct a
federal agency to conduct research. This might help inform Congress for future legislative action. Website
operators would be able to continue using a wide range of age verification methods. Some bills, such as the
Kids Online Safety Act (S. 1409), would require federal agencies to conduct a study evaluating methods for
developing an age verification system, in addition to implementing requirements for online platforms.
• Directing a federal agency to issue guidance or regulations. An agency could, for example, provide
criteria that are to be considered in the development of age verification methods. This could influence the
age verification methods that website operators develop and use. A consideration might include how much
authority to provide the agency. Some bills, such as the Kids PRIVACY Act (H.R. 2801), would direct the
Federal Trade Commission to promulgate regulations requiring a risk-based approach to determine the age
of a user, in addition to implementing requirements for online platforms.
• Requiring or prohibiting certain age verification methods. Website operators’ responses would likely
depend on the number and type of options specified. Allowing operators to use various forms of age
verification might not address Congress’s concerns or may raise new ones. Limiting the methods operators
can use might increase the likelihood that they are unable or unwilling to determine a user’s age. Some
bills, such as the Protecting Kids on Social Media Act (S. 1291), would require social media platforms to
take “reasonable steps beyond merely requiring attestation,†in addition to other requirements.
• Implementing or supporting a government age verification system. Legislative options could include
directing a federal agency to develop a system to help confirm users’ ages or incentivize states to
implement an age verification system. Some considerations might include which agency would be best
suited to provide the system and what information would be provided to whom.
Some general considerations for Congress might include (1) who should be responsible for determining an individual’s age
online, (2) how would legislation on age verification be implemented and what are the potential effects, and (3) how an entity
conducting age verification online can confirm that individuals are who they claim to be.
Congressional Research Service
link to page 5 link to page 6 link to page 7 link to page 8 link to page 11 link to page 13 link to page 14 link to page 16 link to page 17 link to page 18 link to page 20 link to page 8 link to page 12 link to page 21 Identifying Minors Online
Contents
Methods Used to Identify Minors Online ........................................................................................ 2
Self-Identification or User Attestation ...................................................................................... 3
Documentation .......................................................................................................................... 4
Digital ID ............................................................................................................................ 5
Consumer Data .......................................................................................................................... 8
Policy Considerations for Legislation ........................................................................................... 10
Support for Research ................................................................................................................ 11
Requirements for Federal Agencies to Issue Guidance or Regulations .................................. 13
Requiring or Prohibiting Certain Age Verification Methods ................................................... 14
Government Age Verification System ..................................................................................... 15
Concluding Observations .............................................................................................................. 17
Tables
Table 1. Selected Apps Providing Access to Digital IDs ................................................................. 5
Table 2. Comprehensive Data Privacy Laws, by State .................................................................... 9
Contacts
Author Information ........................................................................................................................ 18
Congressional Research Service
Identifying Minors Online
oncerns about potential harms to minors using the internet have grown over the last few
years. Surveys conducted by the Centers for Disease Control and Prevention have found
C that the percentage of high school students considering suicide and experiencing persistent
feelings of sadness increased over the last decade, particularly for females.1 Some studies,
including internal research conducted by website operators,2 suggest that although some minors
benefit from using social media, some minors are harmed.3 The Biden Administration created an
interagency task force on kids’ online health and safety to “identify current and emerging risks of
harm to minors associated with online platforms.â€4
Congress has enacted legislation seeking to protect minors online. Some of the legislation creates
requirements for website operators:5
• The Children’s Online Privacy Protection Act of 1998 (COPPA) requires
operators of online services that collect personal information and that are directed
to, or knowingly collect data from, children under 13 years of age to notify users
about the data collection, obtain advance parental consent for the collection, and
maintain “reasonable procedures†to protect the data.6
• The PROTECT Our Children Act of 2008 requires providers of electronic
communication services and remote computing services to report information
related to child sexual abuse material (CSAM) to the CyberTipline operated by
the National Center for Missing and Exploited Children, which provides the
information to law enforcement.7 Providers are not required to monitor users and
content or “affirmatively search, screen, or scan†for CSAM.8
1 From 2011 to 2021, the percentage of high school students who seriously considered attempting suicide increased
from 16% to 22% (19% to 30% for females, 13% to 14% for males), and the percentage who experienced persistent
feelings of sadness or hopelessness increased from 28% to 42% (36% to 57% for females, 21% to 29% for males). See
Centers for Disease Control and Prevention, Youth Risk Behavior Survey: Data Summary and Trends Report, 2011-
2021, pp. 58-70, https://www.cdc.gov/healthyyouth/data/yrbs/yrbs_data_summary_and_trends.htm.
2 This report uses the term website to refer to websites, online platforms, and mobile applications, and the term website
operator for the entities that provide these websites.
3 For example, see U.S. Surgeon General Vivek Murthy, Social Media and Youth Mental Health: The U.S. Surgeon
General’s Advisory, U.S. Department of Health and Human Services, 2023, https://www.hhs.gov/sites/default/files/sg-
youth-mental-health-social-media-advisory.pdf; Department of Science, Innovation, and Technology and Department
of Digital, Culture, Media, and Sport, “Online Harms Research Publications: December 2022,†U.K. Government,
December 13, 2022, https://www.gov.uk/government/publications/online-harms-research-publications-december-2022;
and Georgia Wells, Jeff Horwitz, and Deepa Seetharaman, “The Facebook Files: Facebook Knows Instagram Is Toxic
for Teen girls, Company Documents Show,†Wall Street Journal, September 14, 2021, https://www.wsj.com/articles/
facebook-knows-instagram-is-toxic-for-teen-girls-company-documents-show-11631620739.
4 White House, “Fact Sheet: Biden-Harris Administration Announces Actions to Protect Youth Mental Health, Safety,
and Privacy Online,†May 23, 2023, https://www.whitehouse.gov/briefing-room/statements-releases/2023/05/23/fact-
sheet-biden-harris-administration-announces-actions-to-protect-youth-mental-health-safety-privacy-online/. The
National Telecommunications and Information Administration (NTIA) published a request for public comment on
behalf of the task force. See NTIA, “Initiative to Protect Youth Mental Health, Safety, and Privacy Online,†88 Federal
Register 67733, October 2, 2023, https://www.federalregister.gov/documents/2023/10/02/2023-21606/initiative-to-
protect-youth-mental-health-safety-and-privacy-online.
5 An example of legislation Congress has enacted that does not create requirements for website operators is the
Protecting Children in the 21st Century Act, which implemented a nationwide program to increase public awareness
and provide education on strategies to promote safe use of the internet by children (P.L. 110-385, Title II, §§201-216;
15 U.S.C. §§6551-6555).
6 P.L. 105-277, Division C, Title XIII, §§1301-1308; 15 U.S.C. §§6501-6506.
7 P.L. 110-401, Title V, §§501-503; 18 U.S.C. §§2258A-2258E.
8 Legislation requiring website operators to actively search for content might raise constitutional concerns under the
(continued...)
Congressional Research Service
1
Identifying Minors Online
Congress has held hearings and bills have been introduced proposing to increase protections for
minors online by implementing additional requirements for website operators.9 Several states
have enacted laws creating requirements for websites that provide material intended for or likely
to be accessed by minors and for websites that provide material that is deemed harmful to minors
in the legislation.10 Courts have ruled that some of these state laws likely violate the First
Amendment.11 In addition, some federal laws seeking to protect minors online have been deemed
unconstitutional under the First Amendment by federal courts.12
A consideration for implementing requirements for website operators might include whether
operators are able to identify minors. Some bills introduced in the 118th Congress and state laws
require or would likely incentivize website operators to implement age verification methods.13
This report discusses some methods used by website operators to determine users’ ages and
potential trade-offs associated with each method. It also analyzes selected legislative options to
address age verification and provides some considerations for Congress related to age verification
and protecting minors online.
Methods Used to Identify Minors Online
No federal statute explicitly requires website operators to determine the age of individuals who
use their websites. Nevertheless, some website operators have developed age verification
methods or use methods provided by third parties to prevent minors from accessing their
websites,14 often in response to federal and state laws. Some examples include the following:
Fourth Amendment. For more information, see CRS Legal Sidebar LSB10713, The Fourth Amendment and the
Internet: Legal Limits on Digital Searches for Child Sexual Abuse Material (CSAM), by Michael A. Foster.
9 For example, see U.S. Congress, Senate Committee on the Judiciary, Protecting Our Children Online, hearing, 118th
Cong., 1st sess., February 14, 2023, S. Hrg. 118-028 (Washington, DC: GPO, 2023), https://www.govinfo.gov/content/
pkg/CHRG-118shrg52253/pdf/CHRG-118shrg52253.pdf.
10 For example, see California Age-Appropriate Design Code (California Civil Code, Division 3, Part 4, Title 1.81.47,
https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&title=1.81.47.&part=4.&
chapter=&article=); and Utah Social Media Regulation Act (Utah Code, Title 13, Chapter 63, https://le.utah.gov/xcode/
Title13/Chapter63/13-63.html).
For an overview of some state laws seeking to protect minors online, see CRS Legal Sidebar LSB11020, Online Age
Verification (Part I): Current Context, by Eric N. Holmes.
11 For example, see CRS Legal Sidebar LSB11071, NetChoice v. Bonta and First Amendment Limits on Protecting
Children Online, by Peter J. Benson; and Skye Witley, “Online Age-Check State Law Run into Constitutional
Headwinds,†Bloomberg Law, September 19, 2023, https://news.bloomberglaw.com/privacy-and-data-security/online-
age-check-state-laws-run-into-constitutional-headwinds.
12 For example, the Child Online Protection Act (P.L. 105-277, Division C, Title XIV, §§1401-1406; 47 U.S.C. §231).
For more information, see CRS Report R47049, Children and the Internet: Legal Considerations in Restricting Access
to Content, by Eric N. Holmes.
13 Throughout this report, the term age verification is used to discuss all methods used to determine the age of an
individual. The term age assurance is used as an umbrella term that includes age verification and age estimation, which
consist of different methods (for example, see Age Check Certification Scheme, “ISO Working Draft Age Assurance
Systems Standard,†euCONSENT, November 2021, https://euconsent.eu/download/iso-working-draft-age-assurance-
systems-standard/). This report does not make this distinction.
14 Examples of companies that offer age verification services include Onfido and Veratad. See Onfido, “Age
Verification,†2023, https://onfido.com/use-cases/age-verification/; and Veratad Technologies, “Flexible, Secure Age
Verification,†2023, https://veratad.com/solutions/age-verification/.
Congressional Research Service
2
Identifying Minors Online
• Some websites associated with alcohol—such as Guinness, Budweiser, and
Patron Tequila—require users to enter their birthdates to indicate that they are at
least 21 years old before accessing content.15
• Instagram, a social media platform, requires users to enter their birthdate when
creating an account to indicate that they are at least 13 years old; it provides
different default settings for individuals ages 13-17.16 Some users in certain
countries also need to verify their age by (1) recording a video selfie that is
shared with Yoti,17 a company that uses artificial intelligence (AI) to conduct
facial estimations, or (2) uploading certain forms of identification (ID), including
a driver’s license, passport, or birth certificate.18
• Tinder, a dating app, requires users to enter their birthdate when creating an
account to indicate that they are at least 18 years old.19 It requires some users in
certain countries to provide a copy of their driver’s license or passport to verify
their age; it does not allow users to verify their age with a resident card,
temporary driver’s license, or student ID.
• Pornhub, a platform that hosts pornographic content, requires users in Louisiana
to verify that they are at least 18 years old using a digital ID through the LA
Wallet app. Pornhub is blocking access for users in Mississippi, Virginia, and
Utah in response to laws enacted in the respective states.20
This section discusses potential trade-offs—such as level of assurance, feasibility for operators,
accessibility for users, and user privacy—for some methods used to identify minors online. These
methods are grouped into three categories: (1) users self-report their age or date of birth, (2) users
provide documentation to verify their age, and (3) operators or third parties use data collected
about individuals to determine their age.
Self-Identification or User Attestation
Some websites require users to self-attest that they meet a minimum age requirement—such as by
checking a box or providing their age or date of birth—when creating an account or accessing the
website. This age verification method can be accomplished by all individuals and generally
requires relatively low effort and costs for operators. However, users can easily claim to meet the
age requirement when they do not. A website operator cannot determine whether users are
providing their actual age without additional information.
15 Guinness, https://www.guinness.com/en-us; Budweiser, https://us.budweiser.com/; and Patron Tequila,
https://www.patrontequila.com/.
16 Meta Platforms, “Introducing New Ways to Verify Age on Instagram,†June 23, 2022, https://about.instagram.com/
blog/announcements/new-ways-to-verify-age-on-instagram.
17 Yoti, “Age Verification Should Be Just an Age,†https://www.yoti.com/business/age-verification/.
18 Instagram used to allow users to confirm their age with social vouching (i.e., other users confirm a user’s age) but
stated the option was removed to make improvements on October 13, 2022. Meta Platforms, “Introducing New Ways
to Verify Age on Instagram,†June 23, 2022, https://about.instagram.com/blog/announcements/new-ways-to-verify-
age-on-instagram.
19 Tinder, “How Does Age Verification Work?,†https://www.help.tinder.com/hc/en-us/articles/360040592771-How-
does-age-verification-work-.
20 Amanda Silberling, “Pornhub Blocks Access in Mississippi, Virginia, and Utah Amid Changing Laws,†TechCrunch,
July 3, 2023, https://techcrunch.com/2023/07/03/pornhub-blocks-access-in-mississippi-virginia-and-utah-amid-
changing-laws/.
Congressional Research Service
3
link to page 7 Identifying Minors Online
Documentation
Some websites require users to provide documentation to verify their age. These often include
government-issued documents—such as a driver’s license, passport, or birth certificate—or other
documents that provide some combination of the individual’s full name, photo, age, and date of
birth, such as a medical record, school ID, or membership ID. A website operator has an incentive
to accept a wide range of documents or documents that most individuals can access to increase
the number of potential users. Some operators might choose not to accept certain documents to
maintain a higher level of assurance.
The types of documents held by most individuals vary. For example, the number of valid
passports in circulation suggests that the majority of U.S. citizens do not have a passport.21 About
70% of individuals residing in the United States had a driver’s license in 2021,22 with over 90%
of those ages 30-79.23 About 2.6% of individuals ages 14 and 15 had a driver’s license,24 and the
percentage of individuals ages 16, 17, and 18 that had a driver’s license was about 25%, 42%, and
60%, respectively.25 CRS could not find similar information for other state-issued IDs.
A larger number of minors have access to other documents, such as birth certificates and school
IDs, but accessibility might remain an issue for some individuals. For example, although most
individuals born in the United States have a birth certificate, about 14% of individuals in the
United States in 2022 were born in a foreign country, some of which might not offer birth
certificates.26 While nearly all children under five in Western Europe and North America have a
birth certificate, UNICEF estimates that 77% of children under five across the world have their
births registered, with only 47% in the least developed countries.27 Similarly, some schools might
not offer a school ID, and those that do might not indicate the individual’s birthdate or age on the
school ID.
21 In 2022, 151,814,305 valid passports were in circulation, according to U.S. Department of State, Bureau of Consular
Affairs, “Reports and Statistics,†https://travel.state.gov/content/travel/en/about-us/reports-and-statistics.html. That
year, the number of U.S. citizens was 311,614,516, according to the Census Bureau’s American Community Survey
one-year estimates at U.S. Census Bureau, Table K200501: Citizenship Status in the United States,
https://data.census.gov/table/ACSSE2022.K200501. This means that if each valid passport belonged to a different
individual, at most, 48.7% of U.S. citizens had a U.S. passport. The actual percentage may be lower; an individual can
have both a passport book and card, which counts as two valid passports, and qualifying non-U.S. citizens can have a
U.S. passport.
22 U.S. Department of Transportation (DOT), Federal Highway Administration (FHWA), Office of Highway Policy
Information, Policy and Governmental Affairs, “6.2.1. Licensed Drivers, Vehicle Registrations, and Resident
Population,†Highway Statistics Series 2021, December 2022, https://www.fhwa.dot.gov/policyinformation/statistics/
2021/dv1c.cfm.
23 DOT, FHWA, Office of Highway Policy Information, Policy and Governmental Affairs, “6.3.2. Licensed Drivers, by
Sex and Percentage in Each Age Group, DL-20,†Highway Statistics Series 2021, December 2022,
https://www.fhwa.dot.gov/policyinformation/statistics/2021/dl20.cfm.
24 The “under 16†group is compared with 14- and 15-year-old population estimates (see footnote 23). In most states,
no individuals younger than 16 held a driver’s license in 2021 (see DOT, FHWA, Office of Highway Policy
Information, Policy and Governmental Affairs, “6.3.3. Licensed Drivers, by State, Sex, and Age Group, DL-22,â€
Highway Statistics Series 2021, December 2022, https://www.fhwa.dot.gov/policyinformation/statistics/2021/
dl22.cfm).
25 Ibid.
26 In 2022, the number of foreign-born individuals (excluding U.S. citizens born abroad to American parent[s]) was
46,182,177, and the total U.S. population was 333,287,562, according to the Census Bureau’s American Community
Service one-year estimate (https://data.census.gov/table/ACSSE2022.K200503).
27 UNICEF, “Birth Registration,†last updated June 2023, https://data.unicef.org/topic/child-protection/birth-
registration/.
Congressional Research Service
4
link to page 8 link to page 8 link to page 9 Identifying Minors Online
Some documents might be considered more reliable and harder to falsify than others. For
example, the REAL ID Act prohibits federal agencies from accepting drivers’ licenses and state-
issued IDs unless the cards meet certain standards;28 enforcement is scheduled to begin on May 7,
2025.29 In contrast, schools do not have a uniform ID system, and there were 98,577 public
schools, including kindergarten through high school, in the 2020-2021 school year.30 Schools
might implement different security standards, if any, and use various designs, styles, and formats
that could make it difficult to determine which school IDs are legitimate and which are fake.
The ability to counterfeit or falsify documents would also depend on other factors, such as the
systems used to share documents. For example, an image of a driver’s license would likely be
easier to alter than a digital version of a driver’s license that is verified by a state agency, as
discussed in the following section, “Digital ID.†Government-issued documents are considered to
be reliable, and often used to verify an individual’s identity. Thus, sharing government-issued
documents with other entities might raise greater privacy and identity theft concerns than sharing
other types of documents.
Digital ID
Some states offer digital IDs in the form of a digitized driver’s license and state ID (Table 1).31
These digital IDs are accessible through an app operated by the state government or a company
partnering with the state government, often with the state’s Department of Motor Vehicles
(DMV). Some states allow these digital IDs to be used only at Transportation Security
Administration (TSA) PreCheck entrances at certain airports;32 others allow various entities—
such as restaurants, bars, credit unions, and websites—to accept digital IDs.
Table 1. Selected Apps Providing Access to Digital IDs
Name of
Operator of
Selected Places
State
App
Appa
Accepting Digital ID
Website
Arizona
Apple Wallet
Apple
TSA
https://azdot.gov/apple-wallet
Mobile ID
IDEMIA
N/A
https://azdot.gov/mvd/services/
driver-services/mobile-id
California
CA DMV
California DMV
TSA, certain retail locations
https://www.dmv.ca.gov/portal/
Wallet App*
in Sacramento
ca-dmv-wallet/
Colorado
Apple Wallet
Apple
TSA
https://dmv.colorado.gov/
applewallet
28 P.L. 109-13, Division B, Title II. For more information about REAL ID, see U.S. Department of Homeland Security
(DHS), “About REAL ID,†last updated November 16, 2022, https://www.dhs.gov/real-id/about-real-id.
29 As of March 26, 2021, 55 states and territories were fully compliant with the REAL ID requirements, and all states
were on track to begin issuing compliant IDs by the time enforcement begins. See DHS, “REAL ID Frequently Asked
Questions,†last updated August 30, 2023, https://www.dhs.gov/real-id/real-id-faqs.
30 The number of private schools is reported every other year and was not reported for the 2020-2021 school year; there
were 30,492 private schools in the 2019-2020 school year. See National Center for Education Statistics, “Educational
Institutions,†https://nces.ed.gov/fastfacts/display.asp?id=84.
31 In this report, a digital ID refers to an electronic version of a government-issued document. It does not include other
information individuals might use to identify themselves on the internet, such as usernames or sign-in information.
32 American Airlines allows customers to use a mobile ID through the Digital Identity App at Transportation Security
Administration (TSA) checkpoints. For more information about using digital IDs at TSA PreCheck, see TSA, “Facial
Recognition and Digital Identity Solutions,†https://www.tsa.gov/digital-id.
Congressional Research Service
5
link to page 9 Identifying Minors Online
Name of
Operator of
Selected Places
State
App
Appa
Accepting Digital ID
Website
myColorado
Colorado Office Certain restaurants, bars,
https://mycolorado.gov/
of Information
liquor stores
colorado-digital-id
and Technology
Delaware
Mobile ID
IDEMIA
N/A
https://www.dmv.de.gov/
mobileID/
Florida
Smart ID*
Thales
N/A
https://www.flhsmv.gov/
floridasmartid/
Georgia
Apple Wallet
Apple
TSA
https://dds.georgia.gov/georgia-
licenseid/ga-digital-drivers-
license-apple
Iowa
Mobile ID
IDEMIA
TSA, Central Iowa Vapors,
https://iowadot.gov/mvd/
Dodge Family Farm
Mobile-ID
Louisiana
LA Wallet
Envoc
Certain restaurants, bars,
https://lawallet.com/about/
grocery stores, convenience
stores, and websites
Maryland
Apple Wallet
Apple
TSA
https://mva.maryland.gov/
Pages/
MDMobileID_Apple.aspx
Google Wallet
Google
TSA
https://mva.maryland.gov/
Pages/
MDMobileID_Googlewal et.as
px
Mississippi Mobile ID
IDEMIA
N/A
https://www.driverservicebure
au.dps.ms.gov/mobile-id/
Oklahoma Mobile ID
IDEMIA
N/A
https://oklahoma.gov/dps/real-
id/mobile-id.html
Utah
GET Mobile
GET North
TSA, certain credit union
https://dld.utah.gov/utahmdl/
App
America
branches, Harmons, various
state liquor stores
Source: Congressional Research Service (CRS).
Notes: TSA = Transportation Security Administration. * indicates that the app is currently a pilot program with
limited participants. N/A indicates that the website did not specify the places where the digital ID could be used.
a. If a company provides support for or continues to remain involved with the app, the company is listed as
the operator. The company works with the state, which manages the program itself. The state’s department
is listed as the operator if it provides support for the app and is the listed entity in the app’s terms of use.
Most of the digital ID systems implemented by states thus far comply with standards set by two
international organizations: the International Organization of Standardization (ISO) and the
International Electrotechnical Commission (IEC).33 The ISO/IEC 18013-5 standards provide
technical and functional requirements to maintain security, privacy, and interoperability for
mobile drivers’ licenses.34 These standards differ from the REAL ID requirements, which were
33 For example, see Utah Department of Public Safety, “Utah mDL FAQs,†https://dld.utah.gov/mdlfaqs/; and Iowa
Department of Transportation, “Iowa Mobile ID for Businesses, Organizations, and Agencies,†https://iowadot.gov/
mvd/MID-businesses.
34 The International Organization of Standardization (ISO) and the International Electrotechnical Commission (IEC),
Personal Identification – ISO-compliant Driving License – Part 5: Mobile Driving License Application, ISO/IEC
18013-5, September 2021.
Congressional Research Service
6
link to page 7 link to page 8 Identifying Minors Online
expanded to mobile drivers’ licenses in 2019.35 The TSA has proposed rulemaking to temporarily
waive the requirement that mobile drivers’ licenses be compliant with REAL ID standards.36
Digital IDs can be compliant with both ISO/IEC 18013-5 and REAL ID standards with relatively
minimal adjustments.37
Some of the accessibility concerns discussed in “Documentation†may be applicable to digital
IDs. For example, because most individuals younger than 18 and nearly all individuals under 16
do not have a driver’s license, a mobile driver’s license would not be an option for most minors.
However, the percentage of minors with a driver’s license or other state-issued IDs might increase
if it can be used to access websites. Accessibility might remain an issue for some individuals if
the app is provided only on mobile devices, particularly for individuals who do not have access to
a mobile device and access the internet using computers and laptops.
A digital ID system might provide greater privacy protections than, for example, having
individuals send photos of government-issued documents to every website they wish to access. A
digital ID system could allow a government agency verify an individual’s age without disclosing
additional information to various website operators. Nevertheless, privacy concerns might depend
on various factors, including the security of the system implemented and the amount and type of
data the operator of a digital ID system would be able to access. There may be concern, for
example, that the operator of the system would be able to track an individual’s movements across
websites. The operators of the digital ID systems mentioned in Table 1 state that they do not store
users’ data.38
A potential complication with relying on digital IDs for age verification is that most states
currently do not have a digital ID system that website operators can use to verify users’ ages.39
However, several states have implemented digital IDs for some entities, and other states might be
implementing their own systems.40 If states rely on companies to provide their digital IDs, it
might raise concerns about potential unintended effects, such as whether consumers would be
encouraged to use the companies’ mobile wallets and other adjacent products.41
35 P.L. 116-260, Division U, Title X, §1001.
36 TSA, “Minimum Standards for Driver’s Licenses and Identification Cards Acceptable by Federal Agencies for
Official Purposes; Waiver for Mobile Driver’s Licenses,†88 Federal Register 60056, August 30, 2023,
https://www.federalregister.gov/documents/2023/08/30/2023-18582/minimum-standards-for-drivers-licenses-and-
identification-cards-acceptable-by-federal-agencies-for.
37 American Association of Motor Vehicle Administrators, Mobile Driver’s License (mDL) Implementation Guidelines,
version 1.2, January 2023, https://aamva.org/getmedia/b801da7b-5584-466c-8aeb-f230cef6dda5/mDL-Implementation-
Guidelines-Version-1-2_final.pdf.
38 For example, see IDEMIA, “Mobile ID: Frequently Asked Questions,†https://na.idemia.com/dmv-2/mobile-id/.
39 When this report was published, Louisiana was the only state that explicitly stated its digital ID system can be used
for online identity verification (LA Wallet, “Bring Digital Verification to Your Business,†https://lawallet.com/digital-
verification/).
40 For example, see Apple, “Apple Launches the First Driver’s License and State ID in Wallet with Arizona,†Apple
Newsroom, last updated March 23, 2022, https://www.apple.com/newsroom/2022/03/apple-launches-the-first-drivers-
license-and-state-id-in-wallet-with-arizona/; and Idemia, “Mobile ID: Everything Is on Your Phone. Now Your ID Is
Too,†https://na.idemia.com/dmv-2/mobile-id/.
41 Grace Broadbent, “Samsung Wallet Adds State IDs to Compete Against Apple Pay and Google Pay,†eMarketer,
October 11, 2023, https://content-na1.emarketer.com/samsung-wallets-adds-state-ids-compete-against-apple-pay-
google-pay.
Congressional Research Service
7
Identifying Minors Online
Consumer Data
Consumer data can be used to estimate a user’s age on a website. Data that might be used include
conversations users have with their peers (e.g., upcoming birthday, classes), biometric data (e.g.,
image of a user’s face), and data provided by other entities (e.g., credit card number).42 Operators
of websites that host large amounts of user-generated content may be able to use information
provided directly on the website, while others might need to rely on data provided by other
entities, such as data brokers, or age verification services offered by third parties.
To estimate a user’s age, consumer data are typically analyzed using algorithms, artificial
intelligence (AI), and other technologies; the accuracy depends on the system used. For example,
some studies suggest that facial age estimation systems can estimate age within a range but have
difficulty distinguishing between small differences in age (e.g., whether someone is 13 or 14
years old).43 Additionally, the accuracy of these systems can be affected by factors such as facial
expressions, makeup, color mode, and the use of props (e.g., glasses).44 These systems might
perpetuate or amplify biases in the datasets they are trained on.45
Using consumer data to estimate a user’s age might raise privacy concerns. Website operators and
third parties offering age verification services might be compelled to collect greater amounts of
consumer data to develop and improve the models and systems used to estimate a user’s age. For
example, some methods of facial age estimation require large datasets.46 Data collection and
tracking tools—such as cookies and pixels—have enabled various entities to collect consumer
data on the internet, which has led some policymakers to introduce or enact comprehensive
consumer data privacy laws.47
Consumer data privacy laws might affect the feasibility of using consumer data for age
verification. Comprehensive data privacy bills have been introduced in previous Congresses,48
42 For example, see Lubna Takuri, “Age Verification System: How to Verify Customer Ages,†Onfido, January 24,
2023, https://onfido.com/blog/age-verification-system/; Yoti, “Age Verification Should be Just an Age,â€
https://www.yoti.com/business/age-verification/; and Google, “Access Age-Restricted Content and Features,†Google
Account Help, https://support.google.com/accounts/answer/10071085?hl=en.
43 For example, Yoti reported that the probability that its facial age estimation system correctly identified an individual
age 6-11 as younger than 13 was 98.35%. The results separated by skin tone and gender indicate that, on average, the
system estimated the ages of individuals 6-11 within a range of 2.2 years or less (based on mean absolute error for each
year). Yoti, Yoti Facial Age Estimation, white paper, March 2023, pp. 2, 5, https://www.yoti.com/wp-content/uploads/
Yoti-Age-Estimation-White-Paper-March-2023.pdf.
44 For example, see Prachi Punyani, Rashmi Gupta, and Ashwani Kumar, “Neural Networks for Facial Age Estimation:
A Survey on Recent Advances,†Artificial Intelligence Review, vol. 53 (2020), pp. 3299-3347, https://doi.org/10.1007/
s10462-019-09765-w; and Tzvi Ganel, Carmel Sofer, and Melvyn Goodale, “Biases in Human Perception of Facial
Age Are Present and More Exaggerated in Current AI Technology,†Nature: Scientific Reports, vol. 12, no. 22519
(2022), https://www.nature.com/articles/s41598-022-27009-w.
45 CRS Report R47644, Artificial Intelligence: Overview, Recent Advances, and Considerations for the 118th
Congress, by Laurie A. Harris; and CRS Report R47569, Generative Artificial Intelligence and Data Privacy: A
Primer, by Kristen E. Busch.
46 For example, facial age estimation using convolutional neural network (CNN) frameworks require very large datasets
for training; see Zichang Tan et al., “Efficient Group-n Encoding and Decoding for Facial Age Estimation,†IEEE
Transactions on Pattern Analysis and Machine Intelligence, vol. 40, no. 11 (2018), pp. 2610-2623, https://doi.org/
10.1109/TPAMI.2017.2779808; and Oussama Guehairia et al., “Facial Age Estimation Using Tensor Based Subspace
Learning and Deep Random Forests,†Information Sciences, vol. 609 (September 2022), pp. 1309-1317, https://doi.org/
10.1016/j.ins.2022.07.135.
47 For more information, see CRS Report R47298, Online Consumer Data Collection and Data Privacy, by Clare Y.
Cho and Kristen E. Busch.
48 A comprehensive data privacy bill has not been introduced in the 118th Congress, based on a search of “data privacyâ€
(continued...)
Congressional Research Service
8
link to page 12 link to page 12 Identifying Minors Online
and 12 states have passed comprehensive consumer data privacy laws; state laws in California,
Colorado, Connecticut, Utah, and Virginia are currently enforceable (Table 2).
Table 2. Comprehensive Data Privacy Laws, by State
Name of State Law
Effective Date
Law Web Page
California Consumer Privacy Acta
January 1, 2020
https://leginfo.legislature.ca.gov/faces/
codes_displayText.xhtml?division=3.&part=4.&
lawCode=CIV&title=1.81.5
Colorado Privacy Act
July 1, 2023
https://leg.colorado.gov/bil s/sb21-190
Connecticut Data Privacy Act
July 1, 2023
https://www.cga.ct.gov/asp/cgabil status/
cgabil status.asp?selBil Type=Bil &bil _num=
SB00006&which_year=2022
Delaware Personal Data Privacy Act
January 1, 2025
https://legiscan.com/DE/text/HB154/id/2807502/
Delaware-2023-HB154-Draft.html
Indiana Consumer Data Protection Act
January 1, 2026
https://iga.in.gov/legislative/2023/bil s/senate/5/
details
Iowa Consumer Data Protection Act
January 1, 2025
https://www.legis.iowa.gov/docs/publications/
LGE/90/SF262.pdf
Montana Consumer Data Privacy Act
October 1, 2024
https://laws.leg.mt.gov/legprd/
LAW0210W$BSIV.ActionQuery?P_BILL_NO1=
384&P_BLTP_BILL_TYP_CD=SB&Z_ACTION=
Find&P_SESS=20231
Oregon Consumer Privacy Act
July 1, 2024
https://olis.oregonlegislature.gov/liz/2023R1/
Downloads/MeasureDocument/SB619/Enrol ed
Tennessee Information Protection Act
July 1, 2025
http://www.capitol.tn.gov/Bil s/113/Bil /SB0073.pdf
Texas Data Privacy and Security Act
July 1, 2024
https://capitol.texas.gov/Bil Lookup/Text.aspx?
LegSess=88R&Bil =HB4
Utah Consumer Privacy Act
December 31, 2023
https://le.utah.gov/~2022/bil s/static/SB0227.html
Virginia Consumer Data Protection Act January 1, 2023
https://law.lis.virginia.gov/vacodeful /title59.1/
chapter53/
Source: CRS using information compiled by the International Association of Privacy Professionals (IAPP). See
Andrew Folks, “US State Privacy Legislation Tracker,†IAPP, last updated December 22, 2023, https://iapp.org/
resources/article/us-state-privacy-legislation-tracker/.
Notes: IAPP’s U.S. State Privacy Legislation Tracker provides a chart identifying key provisions in the legislation.
The list includes bil s intended to be comprehensive approaches to govern the use of personal information; it
does not include industry-specific, information-specific, or narrowly scoped bil s (e.g., data security bil s).
a. The California Consumer Privacy Act was amended by the California Privacy Rights Act, which was signed
into law in 2020 and became ful y operative on January 1, 2023.
All of the identified state comprehensive data privacy laws provide consumers with rights to
delete their personal data and opt out of having their personal data collected for certain purposes.
If enough consumers request their data to be deleted or not collected, these state laws might
reduce the data that can be used for age verification. To reduce the burden on consumers, some
and “data protection†on congress.gov. Comprehensive data privacy bills were introduced in the 116th and 117th
Congresses. The American Data Privacy and Protection Act (ADPPA) was passed by the House Energy and Commerce
Committee, but the full House of Representatives never voted on the bill. For more information about ADPPA and
comparisons to a selection of other data privacy bills, see CRS Legal Sidebar LSB10776, Overview of the American
Data Privacy and Protection Act, H.R. 8152, by Jonathan M. Gaffney, Eric N. Holmes, and Chris D. Linebaugh.
Congressional Research Service
9
link to page 5 link to page 5 Identifying Minors Online
companies and nonprofits have started offering services to send requests to companies to delete
data on behalf of the consumer.49 This, however, has raised concerns about the identity
verification process used to ensure the data belong to the individual submitting the request.50
Additionally, some states that do not have a comprehensive data privacy law have enacted
legislation related to specific types of data, such as biometric data, that might affect the use of
consumer data to conduct age verification (e.g., facial age estimation).51
Policy Considerations for Legislation
Multiple bills introduced in the 118th Congress seek to increase protections for minors online by
creating requirements for website operators.52 Some requirements for website operators, if
included in enacted legislation, could be subject to constitutional challenges under the Free
Speech Clause of the First Amendment.53
If Congress were to enact legislation creating requirements for website operators that are specific
to minors, some operators might
• implement changes for all users;
• implement changes for individuals that the operator identifies as minors using
one or more age verification methods, including those discussed in “Methods
Used to Identify Minors Onlineâ€;
• stop offering certain services (e.g., if websites were required to prevent adults
from messaging minors, some websites might not allow any users or minors to
communicate with other users); or
• stop offering the website. For example, some websites that primarily consist of
pornographic content, including PornHub, have stopped offering their platform in
Mississippi, Virginia, and Utah in response to state laws that require these
websites to conduct age verification beyond self-declaration.54 Some website
operators might try to avoid this option, particularly if their revenue comes
primarily from the website.
49 Kaveh Waddell, “How ‘Authorized Agents’ Plan to Make It Easier to Delete Your Online Data,†Consumer Reports,
March 21, 2022, https://www.consumerreports.org/electronics/privacy/authorized-agents-plan-to-make-it-easier-to-
delete-your-data-a8655835448/; Consumer Reports, “Permission Slip: FAQ,†https://permissionslipcr.com/faq.php; and
Optery, “Removes Your Home Address, Phone and Other Private Info from Google and 270+ Sites,â€
https://www.optery.com/.
50 Kashmir Hill, “Want Your Personal Data? Hand Over More Please,†New York Times, updated October 27, 2021,
https://www.nytimes.com/2020/01/15/technology/data-privacy-law-access.html.
51 For example, see Illinois General Assembly, Biometric Information Privacy Act, 740 ILCS 14/,
https://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=3004&ChapterID=57; and Washington State Legislature,
Biometric Identifiers, Chapter 19.375, https://app.leg.wa.gov/RCW/default.aspx?cite=19.375.
52 Some examples include the Kids Online Safety Act (S. 1409), Children and Teens’ Online Privacy Protection Act (S.
1418), Social Media Child Protection Act (H.R. 821), Sammy’s Law of 2023 (H.R. 5778), and EARN It Act of 2023
(H.R. 2732/S. 1207).
53 For more information on potential constitutional concerns, see CRS Legal Sidebar LSB11021, Online Age
Verification (Part II): Constitutional Background, by Eric N. Holmes; and CRS Legal Sidebar LSB11022, Online Age
Verification (Part III): Select Constitutional Issues, by Eric N. Holmes.
54 Amanda Silberling, “Pornhub Blocks Access in Mississippi, Virginia, and Utah Amid Changing Laws,†TechCrunch,
July 3, 2023, https://techcrunch.com/2023/07/03/pornhub-blocks-access-in-mississippi-virginia-and-utah-amid-
changing-laws/.
Congressional Research Service
10
Identifying Minors Online
The effectiveness of the legislation might depend, in part, on the age verification methods used by
the website operators. Although some website operators use various age verification methods,
surveys and internal company data indicate that minors who are below the minimum age
requirement continue to access some of these websites.55 Different methods of age verification
offer different levels of assurance and raise different considerations, as discussed in the previous
section. If Congress were not to enact legislation to increase protections for minors online, some
website operators might explore various safety measures and age verification methods in response
to public scrutiny, lawsuits,56 and laws enacted by states and other countries.57
This section analyzes some legislative options for addressing age verification. Specifically, this
section provides some potential considerations if Congress chooses to (1) support research on age
verification methods, (2) direct a federal agency to issue guidance or regulations specifying
requirements related to age verification methods, (3) prohibit or require certain age verification
methods, and/or (4) implement or support a government age verification system.
Support for Research
Congress has directed federal agencies to conduct research related to verifying identities online.
Examples include the following:
• The National Institute of Standards and Technology (NIST) was directed by P.L.
117-167 to “carry out a program of research to support the development of
voluntary, consensus-based technical standards, best practices, benchmarks,
methodologies, metrology, testbeds, and conformance criteria for identity
management,†including providing commonly used definitions and voluntary
guidance for digital identity management systems.58 NIST publishes these
standards in its Digital Identity Guidelines, which is discussed in the following
section.
• The Government Accountability Office (GAO) analyzed the online identity
verification processes used by six federal agencies and whether they relied on
information provided by consumer reporting agencies (e.g., Equifax, Experian,
55 For example, 38% of survey respondents ages 8-12 years old stated that they had used a social media platform in
2021 (see Common Sense, The Common Sense Census: Media Use by Tweens and Teens, March 9, 2022,
https://www.commonsensemedia.org/research/the-common-sense-census-media-use-by-tweens-and-teens-2021). A
chart from an internal presentation at Meta Platforms indicates that the monthly active people penetration was between
20% and 60% for individuals ages 11-13 who were born between 2000 and 2004, and an internal report estimated that
4 million U.S. individuals under 13 were on Instagram in 2015 (see “Complaint for Injunctive and Other Relief,†The
People of the State of California et al. v. Meta Platforms, Inc., case no. 4:23-cv-05448-YGR (N.D. Cal), November 22,
2023, pp. 108-111).
56 For example, multiple state attorneys general filed a lawsuit against Meta Platforms, Inc., for allegedly downplaying
and concealing harms to minors caused by Facebook and Instagram, manipulating minors to spend more time on the
platforms, and violating the Children’s Online Privacy Protection Act of 1998 (COPPA). See “Complaint for Injunctive
and Other Relief,†The People of the State of California et al. v. Meta Platforms, Inc., case no. 4:23-cv-05448-YGR
(N.D. Cal), October 24, 2023, pp. 1-4.
57 For example, see the U.K. Online Safety Bill and European Union’s Digital Services Act at Department of Science,
Innovation, and Technology and Department of Digital, Culture, Media, and Sport, “A Guide to the Online Safety
Bill,†U.K. Government, last updated August 30, 2023, https://www.gov.uk/guidance/a-guide-to-the-online-safety-bill;
and European Union, “Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022
on a Single Market For Digital Services and amending Directive 2000/31/EC (Digital Services Act),†October 27,
2022, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022R2065&qid=1666857835014.
58 See 15 U.S.C. §7464; the Digital Identity Management Research section of the Chips and Science Act (P.L. 117-167,
§10225) amended the “Identity Management Research and Development†section of the Cybersecurity Enhancement
Act of 2014 (P.L. 113-274, §504).
Congressional Research Service
11
Identifying Minors Online
and TransUnion),59 as requested from Congress.60 Two of the federal agencies no
longer relied on this information as of May 2019, and officials cited high costs
and implementation challenges for not adopting alternative identify verification
methods. In its study, GAO states that NIST’s guidance “does not discuss the
advantages and limitations of currently available technologies or make
recommendations to agencies on which technologies should be adopted.â€61
In the 118th Congress, legislation has been introduced to support research specifically on age
verification methods. For example, the Kids Online Safety Act (S. 1409) would require the
director of NIST, in coordination with the Federal Communications Commission, the Federal
Trade Commission (FTC), and the Secretary of Commerce, to “conduct a study evaluating the
most technologically feasible methods and options for developing systems to verify age at the
device or operating system level,†in addition to implementing requirements for online platforms.
Research on age verification methods might occur under broader proposals related to conducting
research on online platforms. For example, the Platform Accountability and Transparency Act (S.
1876) would establish a research program for qualified researchers to access qualified data from
certain online platforms if the research application is in the public interest, aims to study activity
on a platform, and is used for noncommercial purposes.
Supporting research on age verification methods could help inform Congress, potentially for
future legislative action. For example, a federal agency may be able to test the accuracy of some
age verification methods and provide an in-depth analysis of potential benefits, harms, and risks.
However, website operators would be able to continue using a wide range of age verification
methods. Additionally, some researchers and organizations have published reports that examine
some age verification methods and provide potential trade-offs.62 Additional research might raise
new considerations and legislative options.
Congressional considerations in this area might include who might need access to what types of
data to provide information that would be helpful in creating federal legislation. For example, to
create a comprehensive overview of potential age verification methods and their advantages and
challenges, assembling a working group with researchers from industry, academia, and federal
agencies might be sufficient. However, to analyze the number of minors accessing websites that
rely on certain age verification methods, researchers may need access to these websites’ internal,
nonpublic data; this might raise additional considerations, such as how the internal data would be
accessed and what information could be disclosed.
59 The Government Accountability Office (GAO) examined six federal agencies: Centers for Medicare and Medicaid
Services, General Services Administration, Internal Revenue Service, Social Security Administration, U.S. Postal
Service, and Department of Veterans Affair. GAO, Data Protection: Federal Agencies Need to Strengthen Online
Identity Verification Processes, May 2019, https://www.gao.gov/assets/gao-19-288.pdf.
60 The report specifies that congressional requesters included Senators Ron Wyden and Elizabeth Warren and
Representatives Elijah E. Cummings and Jim Jordan (ibid., p. 39). Congress also requested a GAO report on consumer
reporting agencies in the Economic Growth, Regulatory Relief, and Consumer Protection Act (P.L. 115-174), §308.
61 GAO, Data Protection: Federal Agencies Need to Strengthen Online Identity Verification Processes, May 2019, p. ii,
https://www.gao.gov/assets/gao-19-288.pdf.
62 For example, see Scott Brennen and Matt Perault, Keeping Kids Safe Online: How Should Policymakers Approach
Age Verification?, The Center for Growth and Opportunity, Utah State University, June 21, 2023,
https://www.thecgo.org/research/keeping-kids-safe-online-how-should-policymakers-approach-age-verification/; and
Shoshana Weissmann, “The Fundamental Problems with Social Media Age-Verification Legislation,†R Street
Institute, May 16, 2023, https://www.rstreet.org/commentary/the-fundamental-problems-with-social-media-age-
verification-legislation/.
Congressional Research Service
12
Identifying Minors Online
Requirements for Federal Agencies to Issue Guidance or
Regulations
Congress has enacted legislation directing federal agencies to provide guidance or regulations
related to verifying identities and protecting children’s privacy online. Examples include the
following:
• As required by P.L. 117-167, NIST provides guidance on identity verification
standards for federal agencies that offer online services, such as login.gov,63
through its Digital Identity Guidelines.64 The guidelines provide three levels of
assurance within three main components: (1) enrollment and identity proofing,
(2) authentication and lifecycle management, and (3) federation and assertions.65
In May 2019, the Office of Management and Budget required federal agencies to
implement NIST’s Digital Identity Guidelines.66
• The FTC was directed to promulgate regulations for website operators under
COPPA.67 The FTC outlines steps companies can take to determine whether they
are covered by COPPA,68 provides information on how companies can comply
with the law,69 and has taken enforcement action against companies for violating
the law.70 On December 20, 2023, the FTC released a notice of proposed
rulemaking to amend the COPPA regulations to “place new restrictions on the
use and disclosure of children’s personal information,†such as requiring a
separate opt-in for targeted advertising.71
In the 118th Congress, legislation has been introduced to direct a federal agency to provide
guidance or promulgate regulations. For example, the Kids PRIVACY Act (H.R. 2801) would
direct the FTC to promulgate regulations requiring a risk-based approach to determine the age of
a user, where higher privacy and security risks would require a higher certainty of the user’s age.
63 Login.gov is currently compliant with the first identity assurance level (see General Services Administration, “Our
Services,†Login.gov Partners, https://www.login.gov/partners/our-services/). For more information about login.gov,
see CRS In Focus IF12395, Login.gov: Administration and Identity Authentication, by Dominick A. Fiorentino, Natalie
R. Ortiz, and Meghan M. Stuessy.
64 Paul Grassi, Michael Garcia, and James Fenton, Digital Identity Guidelines, NIST Special Publication 800-63-3, last
updated March 2, 2020, https://pages.nist.gov/800-63-3/. An initial public draft of the fourth revision is available at
https://pages.nist.gov/800-63-4/.
65 Federation and assertions refers to the protocol used in a federated environment to communicate authentication and
attribute information, when applicable, to the party relying on this information. After the entity conducting the
verification completes the authentication process, it generates an assertion containing the results to the requesting party.
Ibid.
66 Office of Management and Budget, “Memorandum for Heads of Executive Department and Agencies,†May 21,
2019, https://www.whitehouse.gov/wp-content/uploads/2019/05/M-19-17.pdf.
67 15 U.S.C. §6502.
68 FTC, “Children’s Online Privacy Protection Rule: A Six-Step Compliance Plan for Your Business,â€
https://www.ftc.gov/business-guidance/resources/childrens-online-privacy-protection-rule-six-step-compliance-plan-
your-business.
69 Ibid. FTC, “Complying with COPPA: Frequently Asked Questions,†https://www.ftc.gov/business-guidance/
resources/complying-coppa-frequently-asked-questions.
70 For a list of enforcement actions taken by the FTC, see FTC, “Cases Tagged with Children’s Online Privacy
Protection Act (COPPA),†https://www.ftc.gov/enforcement/cases-proceedings/terms/875.
71 FTC, “FTC Proposes Strengthening Children’s Privacy Rule to Further Limit Companies’ Ability to Monetize
Children’s Data,†press release, December 20, 2023, https://www.ftc.gov/news-events/news/press-releases/2023/12/ftc-
proposes-strengthening-childrens-privacy-rule-further-limit-companies-ability-monetize-childrens.
Congressional Research Service
13
Identifying Minors Online
Some mandatory requirements could be subject to constitutional challenges.72 Congress could
also establish incentives for self-regulation by enabling industry groups and other entities to
provide guidelines to meet regulations prescribed by a federal agency, similar to COPPA’s safe
harbor program.73
Guidance or regulations from a federal agency may influence the age verification methods that
are developed and used by website operators. This could provide flexibility for website operators
and other entities to explore new age verification methods, particularly if new options become
feasible with technological developments, while addressing concerns some of the methods might
raise. The effectiveness of agency guidelines or regulations would depend on the different criteria
the guidelines or regulations would include and how feasible it would be for website operators to
address. For example, if the regulations required a high-level of assurance while prohibiting the
use of government-issued documentation and consumer data, it might be difficult for website
operators to comply.
The scope of the regulations may also arise as a consideration when issuing regulatory authority.
For example, Congress could provide specific criteria that should be considered in the
development of age verification methods and the importance of each, or it could allow an agency
to determine what criteria should be considered. Providing more detail in legislation could
provide greater clarity for companies, enforcers, and courts and help ensure the legislation is
enforced as Congress intended. However, providing an agency with greater flexibility might
allow the agency to respond to technological developments that make it feasible to implement
new methods. This might also create some uncertainty, depending on how frequently agency-
promulgated definitions or regulations are altered.
Requiring or Prohibiting Certain Age Verification Methods
Subject to the potential constitutional limitations mentioned above, Congress could require or
prohibit website operators from using certain methods to determine a user’s age. For example, the
Protecting Kids on Social Media Act (S. 1291) would require social media platforms to take
“reasonable steps beyond merely requiring attestation†and prohibit them from using or retaining
“any information collected as part of the platform’s age verification process.†Legislation also
could affect age verification methods indirectly. For example, legislation related to consumer data
privacy or AI might incentivize operators to avoid certain age verification methods and rely on
others.74
Website operators’ responses to legislation prohibiting or requiring certain age verification
methods would likely depend on the number of options specified and the legislative language
used. For example, if legislation requires that operators use only a method that requires more than
a user’s attestation, operators would have several methods to choose from. Similarly, certain
terminology—such as requiring a “reasonable method of verificationâ€â€”might be subject to
interpretation and potentially result in a wide range of methods used.
72 CRS Legal Sidebar LSB11022, Online Age Verification (Part III): Select Constitutional Issues, by Eric N. Holmes.
73 For more information about the safe harbor program, see FTC, “COPPA Safe Harbor Program,†at
https://www.ftc.gov/enforcement/coppa-safe-harbor-program.
74 For example, §6(a) of the Algorithmic Justice and Online Platform Transparency Act (H.R. 4624/S. 2325) would
prohibit an online platform from using any proprietary design features that process personal information in a manner
that makes certain goods or services unavailable based on biometric or other information. This might discourage
website operators from using facial age estimation technologies to determine whether an individual can access the
website.
Congressional Research Service
14
link to page 5 link to page 5 Identifying Minors Online
Allowing website operators to use various age verification methods might result in different
levels of assurance, privacy risks, and other trade-offs discussed in the section “Methods Used to
Identify Minors Online.†However, if legislation restricts operators to a limited number of age
verification methods, it might increase the likelihood that operators are unable or unwilling to
determine users’ ages, particularly if the types of age verification methods allowed are costly and
difficult to implement. It might increase the likelihood that website operators stop offering their
services and might be more likely to raise constitutional concerns.75
Government Age Verification System
Congress has enacted legislation requiring federal agencies to use their records to confirm
information provided by certain entities. Examples are as follows:
• In an effort to reduce fraud, Congress directed the Social Security Administration
(SSA) to develop or modify a database to confirm the validity of certain personal
information provided electronically by financial institutions if the individual
gives consent.76 In response, SSA created the electronic Consent Based Social
Security Number Verification (eCBSV) service, which verifies that the
individual’s Social Security number (SSN), name, and date of birth combination
matches SSA’s records; it does not verify an individual’s identity.77
• Congress directed the Attorney General to work with SSA and the Department of
Homeland Security (DHS) to create a voluntary pilot program to compare
information on employees’ I-9 forms with government records to confirm each
employees’ identity and authorization to work in the United States.78 The
legislation states, “Nothing in this subtitle shall be construed to authorize,
directly or indirectly, the issuance or use of national identification cards or the
establishment of a national identification card.â€79 The pilot program became E-
Verify and is administered by DHS. Some states require some or all businesses to
use E-Verify through contracting or business licensing laws.80
Legislative options in this area could include expanding the entities that are able to use these
services to include website operators or directing a federal agency to develop a new system to
help confirm the age of users. Some considerations may include the following:
• The level of assurance necessary to access a website. Some websites might not
need the same level of assurance as opening an account with a financial
institution or confirming an employee’s authorization to work in the United
States. Congress might consider whether different websites need different levels
of assurance and which age verification methods might be appropriate.
75 See the “Speech Rights of Website Operators†section in CRS Legal Sidebar LSB11022, Online Age Verification
(Part III): Select Constitutional Issues, by Eric N. Holmes.
76 P.L. 115-174, Title II, §215; 42 U.S.C. §405b.
77 For more information, see Social Security Administration (SSA), “Information About eCBSV,†https://www.ssa.gov/
dataexchange/eCBSV/.
78 P.L. 104-208, Title IV, Subtitle A, §§401-405; 8 U.S.C. §1324a note.
79 P.L. 104-208, Title IV, Subtitle A, §404(h)(2).
80 For more information about E-Verify, see CRS Report R40446, Electronic Employment Eligibility Verification, by
Andorra Bruno; DHS, “What Is E-Verify?,†last updated June 2, 2023, https://www.e-verify.gov/about-e-verify/what-
is-e-verify; and DHS, “History and Milestones,†last updated May 4, 2023, https://www.e-verify.gov/about-e-verify/
history-and-milestones.
Congressional Research Service
15
Identifying Minors Online
• The federal agency best suited to provide an age verification system. Some
considerations might include what information the agency has access to, the
agency’s existing authorities, and whether the agency has the necessary resources
and systems to provide the service.
• What information would be provided and to whom. Requiring individuals to
provide their SSN to website operators, for example, might raise consumer
privacy concerns, particularly as certain operators are not subject to the same
consumer data protection requirements as other entities, such as financial
institutions.81 Additionally, if every website operator had to provide SSNs to SSA
for verification, it might raise concerns about potential government surveillance.
Another option could be providing individuals access to an age verification
system, similar to how digital IDs are used to access certain websites in some
states. Websites could direct individuals to log in to a system to obtain
verification that the individual meets a certain age threshold without obtaining
additional personal information. This option might not fully address concerns
about government surveillance.
• Whether the legislation would raise concerns about federalism. Many records
of individuals—such as birth, marriage, and death records and drivers’ licenses—
are maintained by states, although some federal agencies and other entities
acquire this information from states.82 While Congress may be able to acquire or
regulate this information in some circumstances, federalism principles may
prevent Congress from mandating that states use the information to assist in
federal age verification policies.83
Congress could also incentivize states to implement an age verification system, such as providing
states with funding to assist with a system’s development and implementation. For example,
although states manage elections, Congress enacted the Help America Vote Act of 2002 to
implement minimum standards for states and establish the Election Assistance Commission to
assist states with federal elections.84 Congress could implement similar provisions for a digital ID
system. Some states have implemented digital ID systems or are considering doing so, and
providing incentives might encourage other states to implement systems that websites could use.
It may be possible to implement similar systems with, for example, each state’s division for vital
records.85
81 Financial institutions and their affiliates are subject to consumer data protection requirements under the Gramm-
Leach-Bliley Act (15 U.S.C. §§6801-6809). For an overview of the Gramm-Leach-Bliley Act and other data protection
laws, see CRS Report R45631, Data Protection Law: An Overview, by Stephen P. Mulligan and Chris D. Linebaugh.
82 For example, the SSA acquires and maintains death data from states to administer some of its programs, and Naphsis,
a nonprofit organization, provides access to birth and death data from most states. For more information, see CRS
Report R46640, The Social Security Administration’s Death Data: In Brief, by Paul S. Davies; and Naphsis, “Get Fast,
Secure Access to Birth and Death Information,†https://www.naphsis.org/get-vital-records/for-work/on-demand.
83 For more information on federalism, see CRS Report R45323, Federalism-Based Limitations on Congressional
Power: An Overview, coordinated by Kevin J. Hickey.
84 P.L. 107-252; 52 U.S.C. §§20901-21145. For more information, see CRS In Focus IF12033, The Help America Vote
Act of 2002 (HAVA): An Overview, by Karen L. Shanton.
85 The vital records division in each state has birth, death, marriage, and divorce records. Contact information for the
vital records division for each state is available at Centers for Disease Control and Prevention, National Center for
Health Statistics, “Where to Write for Vital Records,†https://www.cdc.gov/nchs/w2w/index.htm.
Congressional Research Service
16
Identifying Minors Online
A state digital ID system would raise some of the considerations mentioned above, such as which
division would be best suited to provide information for an age verification system. A state-run
system might raise additional considerations, such as whether there would be minimum standards
or security levels across states and who would set these standards. Furthermore, some states
might not want to implement an age verification system, even if they are given incentives.
Concluding Observations
If Congress wishes to address age verification in legislation, some overarching considerations
may include the following:
• Who should be responsible for determining an individual’s age online?
Requiring website operators to treat minors differently than adults without
addressing age verification in legislation might place the responsibility of
identifying users’ ages on website operators. Some operators might be able to
easily conduct age verification; others might not have the necessary resources to
do so.
A consideration may be what requirements, if any, should be placed on devices,
intermediaries (e.g., app stores, web browsers), and state and federal agencies.
For example, some intermediaries offer parental controls, and additional controls
are offered by third-party subscription apps.86 However, this scenario places the
burden on guardians who might not be aware of the different parental controls
available and their efficacy, as well as some of the risks associated with certain
online platforms. Additionally, it might be difficult to implement these types of
controls on devices used by multiple individuals, such as at libraries and schools.
• How would legislation on age verification be implemented, and what are the
potential effects? For example, it would be less burdensome if users needed to
verify their age once while creating an account with a website, rather than
requiring users to verify their age every time they access a website. However,
some websites currently do not require users to create an account. If legislation
were to encourage users to create accounts with each website, it might increase
the burden on users and potentially have indirect effects on the industry. For
example, if individuals use the account information of popular platforms—such
as Facebook, Google, and Apple—to access other websites, it might allow these
companies to gather data that are not available for other operators.87
• How can an entity conducting age verification online confirm that
individuals are who they claim to be? In person, a photo ID can be compared to
the individual, which is not an option on the internet. Some websites use
additional authentication methods—such as a security key, authentication app, or
a link sent to a connected e-mail address—to confirm individuals’ identities when
86 For example, see Google, “How to Set Up Parental Controls on Google Play,†Google Play Help,
https://support.google.com/googleplay/answer/1075738; Apple, “Use Parental Controls on Your Child’s iPhone, iPad,
and iPod Touch,†November 1, 2023, https://support.apple.com/en-us/HT201304; Qustodio,
https://www.qustodio.com/en/ , and Net Nanny, https://www.netnanny.com/.
87 For example, Pinterest allows users to sign in using Facebook and Google (see Pinterest, https://www.pinterest.com/
), and Airbnb allows users to sign in using their Facebook, Google, and Apple account, as well as their email address or
phone number (see Airbnb, https://www.airbnb.com/).
Congressional Research Service
17
Identifying Minors Online
they create an account or access a website.88 Some websites ask users to provide
a selfie with specific requirements in the image so that the user needs to take a
new photo at that moment.89 Some minors may be able to bypass these security
measures if, for example, they have access to their guardian’s e-mail address.
If Congress wishes to increase protections for minors online in legislation, some general
considerations may include the following:
• Whether requirements for website operators should address only minors.
Some content that may be considered harmful, such as online bullying and
harassment, can affect all users.
• Whether the legislation would apply to all websites or a subset. Some
policymakers have focused on websites that primarily host pornographic content
and social media platforms. If certain types of content or services are associated
with a greater risk of users being harmed, considerations may include how to
define the platforms Congress wishes to address.90
• The feasibility of enforcing legislation. For example, searches for virtual
private networks (VPNs) reportedly spiked after some websites that primarily
provide pornographic content stopped being offered in certain states in response
to state age verification laws.91
• Potential unintended effects. For example, if legislation were to create
requirements that are burdensome for platforms to implement, it might be
difficult for nascent companies to enter and compete with incumbents that have
more resources.
Author Information
Clare Y. Cho
Analyst in Industrial Organization and Business
88 For example, Login.gov requires additional authentication methods to create an account. See General Services
Administration, “Create an Account,†Login.gov, https://www.login.gov/create-an-account/. Using multiple
authentication methods to access a website is also known as multifactor authentication or two-step verification; for
more information, see Cybersecurity and Infrastructure Security Agency, “Multi-Factor Authentication,†January 5,
2022, https://www.cisa.gov/resources-tools/resources/multi-factor-authentication-mfa.
89 Kashmir Hill, “Want Your Personal Data? Hand Over More Please,†New York Times, updated October 27, 2021,
https://www.nytimes.com/2020/01/15/technology/data-privacy-law-access.html.
90 For more information, see CRS Report R47662, Defining and Regulating Online Platforms, coordinated by Clare Y.
Cho.
91 Ned Oliver, “Virginia Leads Nation in VPN Searches After PornHub Block,†Axios, July 7, 2023,
https://www.axios.com/local/richmond/2023/07/07/pornhub-ban-virginia-vpn. A virtual private network (VPN) is a
private network that can provide users with increased privacy, such as masking the IP address of their device so that the
location of the device cannot be identified. For more information, see Sheila Frankel et al., Guide to SSL VPNs:
Recommendations of the National Institute of Standards and Technology, Special Publication 800-113, NIST, U.S.
Department of Commerce, July 2008 pp. 6-36 and 6-37.
Congressional Research Service
18
Identifying Minors Online
Acknowledgments
Lena Maman, Research Librarian, provided research assistance for this report.
Disclaimer
This document was prepared by the Congressional Research Service (CRS). CRS serves as nonpartisan
shared staff to congressional committees and Members of Congress. It operates solely at the behest of and
under the direction of Congress. Information in a CRS Report should not be relied upon for purposes other
than public understanding of information that has been provided by CRS to Members of Congress in
connection with CRS’s institutional role. CRS Reports, as a work of the United States Government, are not
subject to copyright protection in the United States. Any CRS Report may be reproduced and distributed in
its entirety without permission from CRS. However, as a CRS Report may include copyrighted images or
material from a third party, you may need to obtain the permission of the copyright holder if you wish to
copy or otherwise use copyrighted material.
Congressional Research Service
R47884 · VERSION 1 · NEW
19