Online Age Verification (Part I): Current Context
Legal Sidebari
Online Age Verification (Part I): Current
Context
August 17, 2023
For almost as long as the internet has existed, journalists and lawmakers have sounded alarms over
children’s ability to access harmful material online. The targeted material has expanded over the years,
with pornography being a primary focus in the 1990s and social media content receiving attention in the
2020s. One legislative response that has been particularly popular over the decades involves enacting
laws that require or encourage website operators to ascertain the ages of their websites’ users before
letting them access content. Some Members of the 118th Congress have introduced bills requiring or
encouraging age verification in certain contexts, and several states have passed laws mandating that some
website operators take various steps to learn the ages of their users.
As discussed in this CRS Insight, determining an individual’s age online can present practical difficulties.
This three-part Legal Sidebar discusses constitutional concerns with requiring age verification procedures
through legislation, using recently enacted state age verification laws and several introduced federal bills
as examples. Part One provides an overview of the current online age verification landscape by describing
the provisions of enacted state laws and proposed federal laws. Part II provides an overview of the Free
Speech Clause of the First Amendment and its historic relationship to online age verification legislation.
Part III discusses concerns with age verification laws posed by the Free Speech Clause of the First
Amendment.
Overview of Age Verification Laws
Laws requiring age verification have been proposed throughout the internet’s lifetime, though the
approach has seen renewed interest in the past several years. Following reports of social media’s negative
impact on teens’ mental health, many states introduced legislation aimed at social media specifically.
States may also have taken cues from the United Kingdom, which implemented its Age-Appropriate
Design Code for online services—also known as the Children’s Code—in 2020. California enacted a
similar piece of legislation, the California Age-Appropriate Design Code (CAADC), in 2022.
“Age Verification” Terminology
While the goal of many pieces of proposed and enacted legislation is similar—to ensure that users of
particular online services are above a certain age—the language used varies. The CAADC uses the phrase
Congressional Research Service
https://crsreports.congress.gov
LSB11020
CRS Legal Sidebar
Prepared for Members and
Committees of Congress
Congressional Research Service
2
“age assurance,” while some federal bills use the phrase “age verification.” There are no universally
recognized legal definitions for these various terms. In an opinion written to assist with compliance with
the UK Children’s Code, the Information Commissioner’s Office for the United Kingdom describes “age
assurance” as an umbrella term to cover both age verification—“determining a person’s age with a high
level of certainty”—and age estimation. The CAADC appears to use “age assurance” to require
“estimat[ing] the age of child users with a reasonable level of certainty appropriate to the risks” posed
from collecting estimation data. Bills introduced in the 118th Congress, such as the Kids Online Safety
Act, appear to use “age verification” to refer broadly to systems that may determine age without any
specified degree of certainty, similar to the use of “age assurance” in the United Kingdom. Because the
use of these terms is not uniform, understanding how various state laws and proposed bills may apply
requires reference to the specific requirements they contain, not just the terms used. This sidebar uses the
term “age verification” to refer generally to methods for estimating or determining a user’s age with
varying levels of certainty.
Targeted Businesses
Age verification laws frequently target two types of businesses: (1) businesses that provide material that
is intended for or likely to be accessed by individuals under the age of 18 (minors) or a younger cohort of
minors such as individuals under the age of 16, and (2) businesses that provide material that is “harmful”
to minors but may not be intended for their use.
The first of these categories includes laws that target specific businesses or content types—for example,
social media—as well as more generally applicable laws. The CAADC applies to “a business that
provides an online service, product, or feature likely to be accessed by” minors. Utah’s Social Media
Regulation Act applies to “social media platforms.”
The second category of age verification laws is frequently aimed at websites that provide pornography. A
law from Louisiana that applies to “commercial entities who distribute material harmful to minors”
discusses at length the impact of pornography on minors. Louisiana restricts application of its law to
entities operating websites that contain “a substantial portion” of material harmful to minors, which the
law defines as “more than thirty-three and one-third percent”—that is, more than one-third—of “total
material on a website.” Laws passed in Mississippi, Utah, and Virginia use similar language for both the
covered material and the “substantial portion” threshold.
These two approaches are not mutually exclusive. Louisiana has enacted laws requiring age verification
for both social media companies and pornography providers, and Utah has two such laws as well.
Required Actions
Laws vary in terms of what steps businesses must take to verify ages. Louisiana’s pornography age
verification law allows businesses to use a “digitized identification card” or a commercial age verification
system that relies on government-issued identification or “public or private transactional data.” Utah’s
pornography law allows for similar age verification procedures, but also allows businesses to rely on
third-party services that compare information provided by the individual to commercially available data
“that is regularly used by government agencies and businesses for the purpose of age and identity
verification.” Arkansas’s Social Media Safety Act requires businesses to employ third-party vendors to
perform “reasonable age verification,” which the law defines to include digitized identification cards, any
government-issued identification, or “any commercially reasonable age verification method.” Virginia’s
law requires that regulated entities engage in “commercially reasonable method[s] of age and identity
verification.” California’s CAADC provides only that businesses must “estimate the age of child users
with a reasonable level of certainty appropriate to the risks.” Louisiana’s social media law uses similar
language.
Congressional Research Service
3
Federal proposals vary in terms of what actions they would require. The Protecting Kids on Social Media
Act would require social media platforms to take “reasonable steps . . . taking into account existing age
verification technologies” to verify the ages of users. The Kids Online Safety Act would not require any
websites to age verify users, but because the bill would obligate websites to extend certain protections to
minors, critics of the bill have argued that it would in practice “force” platforms to age verify.
Enforcement Mechanisms
State age verification laws allow for enforcement either by state officials or by private parties, such as the
parents of a minor. Louisiana’s pornography age verification law allows individuals to bring lawsuits
against commercial entities who fail to implement age verification when such a failure results in a minor
accessing harmful material. A second Louisiana law allows the Louisiana attorney general to seek civil
penalties for violations of the pornography age verification law. Other states with pornography age
verification laws have chosen to allow for one of these enforcement methods but not the other. Texas’s
attorney general has sole enforcement authority over the state’s pornography age verification law, and
Virginia’s and Utah’s pornography age verification laws provide only for enforcement by individuals.
Social media age verification laws, along with the CAADC, also take various enforcement approaches.
The laws of Utah and Louisiana place “exclusive authority” to enforce the law in state law enforcement,
and the CAADC explicitly provides that the law shall not serve as the basis for a lawsuit brought by an
individual. Arkansas’s social media age verification law allows for private enforcement and is the only
state law that provides for criminal liability for knowing and willful violations.
How a law is enforced may impact individuals’ ability to challenge a law’s constitutionality. Individuals
may challenge the constitutionality of a state law prior to enforcement of the law by instituting a legal
action against a state official that enforces the law. As discussed in this Legal Sidebar, the Supreme Court
has disallowed individuals from bringing such actions when a state law is enforced solely by private
parties. A federal district court in Utah dismissed a challenge to Utah’s pornography age verification law
on these grounds.
Imposing penalties for failing to implement age verification may discourage website operators from
hosting particular material—or, if the costs of implementing age verification are sufficiently high, from
hosting material altogether. The Supreme Court has voiced concerns with laws that impose burdens on
adult communication in the name of protecting minors. The second installment of this three-part Sidebar
discusses the Free Speech Clause of the First Amendment and how courts have applied the Clause to
online age verification in the past.
Author Information
Eric N. Holmes
Attorney-Advisor
Disclaimer
Congressional Research Service
4
This document was prepared by the Congressional Research Service (CRS). CRS serves as nonpartisan shared staff
to congressional committees and Members of Congress. It operates solely at the behest of and under the direction of
Congress. Information in a CRS Report should not be relied upon for purposes other than public understanding of
information that has been provided by CRS to Members of Congress in connection with CRS’s institutional role.
CRS Reports, as a work of the United States Government, are not subject to copyright protection in the United
States. Any CRS Report may be reproduced and distributed in its entirety without permission from CRS. However,
as a CRS Report may include copyrighted images or material from a third party, you may need to obtain the
permission of the copyright holder if you wish to copy or otherwise use copyrighted material.
LSB11020 · VERSION 1 · NEW