Identifying Minors Online

Identifying Minors Online

Identifying Minors Online

Updated September 23, 2025 (R47884)
Jump to Main Text of Report

Contents

Methods Used to Identify Minors Online

Self-Identification or User Attestation

Documentation

Digital ID

Consumer Data

Policy Considerations for Legislation

Support for Research

Requirements for Federal Agencies to Issue Guidance or Regulations

Requiring or Prohibiting Certain Age Verification Methods

Government Age Verification System

Concluding Observations

Summary

Concerns about potential harms to minors on the internet, particularly on social media platforms, have grown in recent years. Dating to the 1990s, policymakers have enacted legislation seeking to protect minors online, some of which create requirements for entities that provide websites, mobile applications, and online platforms (collectively, website operators).

Website operators have developed various methods to determine users' ages, often in response to federal or state legislation. Some commonly used methods include (1) relying on self-identification, such as requiring a user to provide their date of birth or check a box to indicate the user is of a certain age; (2) requesting documentation, such as a photo identification (ID) or a digitized driver's license containing the user's name and age; and (3) using consumer data, such as analyzing user content posted on the website or an image of the user's face. Each of these age verification methods presents different advantages and challenges. For example, everyone can provide a date of birth, but a website operator cannot verify that information without additional data or documentation. A website operator that receives a user's government-issued photo ID might be assured that the individual meets a minimum age requirement, but not everyone has a government-issued photo ID. This might also raise consumer data privacy concerns, depending on how the information is shared and stored.

Some Members of Congress have proposed increasing protections for minors online by implementing additional requirements for website operators. Website operators might respond by (1) implementing changes for all users; (2) implementing changes for individuals identified as minors, potentially using one of the methods mentioned above; (3) no longer offering certain services; or (4) no longer offering the entire service in the United States.

If Congress chooses not to address age verification methods used by website operators in legislation, website operators might still develop and implement new age verification methods in response to public scrutiny, lawsuits, and laws enacted by states and other countries. If Congress seeks to address age verification in legislation, some potential options include the following:

Supporting research on age verification. Congress could, for example, provide funding for or direct a federal agency to conduct research related to age verification. This might help inform Congress for future legislative action. Website operators would be able to continue using a wide range of age verification methods. The Kids Online Safety Act (S. 1748), for example, would direct some federal agencies to conduct a study evaluating methods to verify age at the device or operating system level.

Directing a federal agency to issue guidance or regulations. An agency could, for example, provide criteria that are to be considered in the development of age verification methods. This could influence the age verification methods that website operators develop and use. A consideration might include how much authority to provide the agency. The SCREEN Act (H.R. 1623, S. 737), for example, would direct the Federal Trade Commission to provide guidance to the covered platform on complying with requirements to use a technology verification measure to verify a user's age.

Requiring or prohibiting certain age verification methods. Website operators' responses would likely depend on the number and type of options specified. Allowing operators to use various forms of age verification, for example, might not address Congress's concerns or may raise new ones. Limiting the methods operators can use might increase the likelihood that they are unable or unwilling to determine a user's age. The CHAT Act (S. 2714) would require entities that operate AI chatbots to verify a user's age using a "commercially available method or process that is reasonably designed to ensure accuracy."

Implementing or supporting a government age verification system. Legislative options could include directing a federal agency to develop a system to help confirm users' ages or incentivize states to implement an age verification system. Some considerations might include which agency would be best suited to provide the system and what information would be provided to whom.

Some general considerations for Congress might include (1) who should be responsible for determining an individual's age online, (2) how would legislation on age verification be implemented and what are the potential effects, and (3) how an entity conducting age verification online can confirm that individuals are who they claim to be.

Concerns about potential harms to minors using the internet have grown over the last few years. Surveys conducted by the Centers for Disease Control and Prevention have found that the percentage of high school students considering suicide and experiencing persistent feelings of sadness increased over the last decade, particularly for females.¹ Much of the concern has focused on social media. Several studies, including internal research conducted by website operators,² suggest that some minors' mental health is harmed from using social media, although these studies find that other minors might not experience harms or might benefit from using social media.³

Congress has enacted legislation seeking to protect minors online. Some of the legislation creates requirements for website operators,⁴ including the following:

The Children's Online Privacy Protection Act of 1998 (COPPA) requires operators of online services that collect personal information and are directed to, or knowingly collect data from, children under 13 years of age to notify users about the data collection, obtain advance parental consent for the collection, and maintain "reasonable procedures" to protect the data.⁵

The PROTECT Our Children Act of 2008 requires providers of electronic communication services and remote computing services to report information related to child sexual abuse material (CSAM) to the CyberTipline operated by the National Center for Missing and Exploited Children, which provides the information to law enforcement.⁶ Providers are not required to monitor users and content or "affirmatively search, screen, or scan" for CSAM.⁷

The TAKE IT DOWN Act requires covered platforms to establish a process whereby minors and adults can notify the platform that an intimate visual depiction of themself has been published without that their consent and request the platform to remove it.⁸ The platform must remove it within 48 hours.

Some federal laws seeking to protect minors online have been deemed unconstitutional under the First Amendment by federal courts.⁹

The 119th Congress has held hearings and Members have introduced bills seeking to increase protections for minors online by implementing additional requirements for website operators.¹⁰ Several states have enacted laws creating requirements for websites that provide material intended for or likely to be accessed by minors (e.g., social media platforms) and for websites that provide material that is deemed harmful to minors in the legislation (e.g., websites that provide pornographic content).¹¹ Many of these laws have been challenged in court on free speech grounds. Although much of the litigation is ongoing, courts have temporarily blocked some of these requirements from going into effect after ruling that they likely violate the First Amendment,¹² or courts have permanently barred a state from enforcing certain requirements determined to be unconstitutional.¹³ Other state laws have been allowed to go into effect while First Amendment rulings are on appeal, such as a Mississippi law requiring digital service providers to "make commercially reasonable efforts to verify the age of the person creating an account" and follow certain provisions for individuals under the age of 18 (e.g., obtain express consent from a parent or guardian).¹⁴

A consideration for implementing requirements for website operators might include whether operators are able to identify minors. Some bills introduced in the 119th Congress require or would likely incentivize website operators to implement age verification methods.¹⁵ This report discusses some methods used by website operators to determine users' ages and potential trade-offs associated with each method. It also analyzes selected legislative options to address age verification and provides some considerations for Congress related to age verification and protecting minors online.

Methods Used to Identify Minors Online

No federal statute explicitly requires website operators to determine the age of individuals who use their websites. Nevertheless, some website operators have developed age verification methods or use age verification services provided by third parties to prevent minors from accessing their websites.¹⁶ Laws enacted by Congress, state governments, and policymakers in other countries may incentivize operators to implement age verification methods.

Some examples of age verification methods used by website operators include the following:

Some websites associated with alcoholic beverages—such as Guinness, Budweiser, and Patron Tequila—require users to enter their birthdates to indicate that they are at least 21 years old before accessing content.¹⁷

Instagram, a social media platform, requires users to enter their birthdate when creating an account to indicate that they are at least 13 years old.¹⁸ Instagram's parent company Meta reports that it also uses AI to help detect whether a user is a teen or adult.¹⁹ Some users in certain countries also need to verify their age by (1) recording a video selfie that is shared with Yoti,²⁰ a company that uses AI to conduct facial estimations, or (2) uploading certain forms of identification (ID), including a driver's license, passport, or birth certificate.²¹

YouTube, a social media platform, requires users to sign in with a Google account to access certain features, such as commenting on or subscribing to videos. Users are required to enter their birthdate when creating an account to indicate they are at least 13 years old; users under the age of 13 can use the platform if enabled by a parent or legal guardian.²² YouTube reports that it is also using AI to estimate whether users are over or under the age of 18 for a small set of users in the United States.²³

Tinder, a dating app, says that it requires users to enter their birthdate when creating an account to indicate that they are at least 18 years old. It requires some users in certain countries to verify their age by providing a copy of their driver's license or passport; it does not allow users to verify their age with a resident card, temporary driver's license, or student ID.²⁴

Pornhub, a platform that hosts pornographic content, requires users in Louisiana to verify that they are at least 18 years old using a digital ID through the LA Wallet app.²⁵ Pornhub is no longer available in 21 states in response to state laws.²⁶

This section discusses potential trade-offs—such as level of assurance, feasibility for operators, accessibility for users, and user privacy—for some methods used by operators to identify minors online. These methods are grouped into three categories: (1) users self-report their age or date of birth, (2) users provide documentation to verify their age, and (3) operators or third parties use data collected about individuals' online activity to determine their age.

Self-Identification or User Attestation

Some websites require users to self-attest that they meet a minimum age requirement—such as by checking a box or providing their age or date of birth—when creating an account or accessing the website. This age verification method can be accomplished by all individuals and generally requires relatively low effort and costs for operators. However, users can easily claim to meet the age requirement when they do not. A website operator cannot determine whether users are providing their actual age without additional information.

Documentation

Some websites require users to provide documentation to verify their age. These often include government-issued documents—such as a driver's license, passport, or birth certificate—or other documents that provide some combination of the individual's full name, photo, age, and date of birth, such as a medical record, school ID, or membership ID. A website operator has an incentive to accept a wide range of documents or documents that most individuals can access to increase the number of potential users. Some operators might choose not to accept certain documents to maintain a higher level of assurance.

The types of documents held by most individuals vary. For example, the number of valid passports in circulation suggests that, at most, 51% of U.S. citizens have a passport.²⁷ About 71% of individuals residing in the United States had a driver's license in 2023,²⁸ with over 90% of those ages 30-79.²⁹ About 1.4% of individuals ages 14 and 15 had a driver's license,³⁰ and the percentages of individuals ages 16, 17, and 18 that had a driver's license were about 25%, 44%, and 60%, respectively.³¹ CRS could not find similar information for other state-issued IDs.

A larger number of minors have access to other documents, such as birth certificates and school IDs, but accessibility might remain an issue for some individuals. For example, although most individuals born in the United States have a birth certificate, about 14% of individuals in the United States in 2022 were born in a foreign country, some of which might not offer birth certificates.³² While nearly all children under five in Western Europe and North America have a birth certificate, UNICEF estimates that 77% of children under five across the world have their births registered.³³ Similarly, some schools might not offer a school ID, and some school IDs might not indicate the individual's birthdate or age.

Some documents might be considered more reliable and harder to falsify than others. For example, the REAL ID Act prohibits federal agencies from accepting drivers' licenses and state-issued IDs unless the cards meet certain standards;³⁴ enforcement began on May 7, 2025.³⁵ In contrast, schools do not have a uniform ID system; there were 98,577 public schools, including kindergarten through high school, in the 2020-2021 school year.³⁶ Schools might implement different security standards, if any, and use various designs, styles, and formats that could make it difficult to determine which school IDs are legitimate and which are fake.

The ability to counterfeit or falsify documents would also depend on other factors, such as the systems used to share documents. For example, an image of a driver's license would likely be easier to alter than a digital version of a driver's license that is verified by a state agency, which are discussed below in "Digital ID." Government-issued documents are considered to be reliable, and often are used to verify an individual's identity. Sharing government-issued documents with other entities might raise greater privacy and identity theft concerns than sharing other types of documents.

Digital ID

Some states offer digital IDs in the form of a digitized driver's license and state ID.³⁷ These digital IDs are accessible through an app operated by the state government or a company partnering with the state government, often with the state's Department of Motor Vehicles (DMV). Some states allow these digital IDs to be used only at Transportation Security Administration (TSA) PreCheck entrances at certain airports;³⁸ others allow various retail locations to accept digital IDs.³⁹

Most of the digital ID systems implemented by states thus far comply with standards set by two international organizations: the International Organization of Standardization (ISO) and the International Electrotechnical Commission (IEC).⁴⁰ The ISO/IEC 18013-5 standards provide technical and functional requirements to maintain security, privacy, and interoperability for mobile drivers' licenses.⁴¹ These standards differ from the REAL ID requirements, which were expanded to mobile drivers' licenses in 2019.⁴² The TSA published a final rule to temporarily waive the requirement that mobile drivers' licenses be compliant with REAL ID standards to be accepted by federal agencies for official purposes.⁴³ Digital IDs can be compliant with both ISO/IEC 18013-5 and REAL ID standards with some minor adjustments.⁴⁴

Some of the accessibility concerns discussed in "Documentation" may be applicable to digital IDs. For example, because most individuals younger than 18 and nearly all individuals under 16 do not have a driver's license, a mobile driver's license would not be an option for most minors. However, the percentage of minors with a driver's license or other state-issued IDs might increase if these IDs can be used to access websites. Accessibility might remain an issue for some individuals if the app is provided only on mobile devices, particularly for individuals who do not have access to a mobile device and access the internet using computers and laptops.

A digital ID system might provide greater privacy protections than, for example, having individuals send photos of government-issued documents to every website they wish to access. A digital ID system could allow a government agency verify an individual's age without disclosing additional information to various website operators. Nevertheless, privacy concerns might depend on various factors, including the security of the system implemented and the amount and type of data the operator of a digital ID system would be able to access. There may be concern, for example, that the operator of the system would be able to track an individual's movements across websites. The operators of digital ID systems state that they do not store users' data.⁴⁵

A potential complication with relying on digital IDs for age verification is that most states currently do not have a digital ID system that website operators can use to verify users' ages.⁴⁶ However, several states have implemented digital IDs for some entities, and other states might be implementing their own systems.⁴⁷ If states rely on companies to provide their digital IDs, it might raise concerns about potential unintended effects, such as whether consumers would be encouraged to use the companies' mobile wallets and other adjacent products.⁴⁸

Consumer Data

Consumer data can be used to estimate a user's age on a website. Data that might be used include conversations users have with their peers (e.g., upcoming birthday, classes), biometric data (e.g., image of a user's face), and data provided by other entities (e.g., credit card number).⁴⁹ Operators of websites that host large amounts of user-generated content may be able to use information provided directly on the website, while others might need to rely on data provided by other entities, such as data brokers, or age verification services offered by third parties.

To estimate a user's age, consumer data are typically analyzed using algorithms, AI, and other technologies; the accuracy depends on the system used. For example, some studies suggest that facial age estimation systems can estimate age within a range but have difficulty distinguishing between small differences in age (e.g., whether someone is 13 or 14 years old).⁵⁰ Additionally, the accuracy of these systems can be affected by factors such as facial expressions, makeup, color mode, and the use of props (e.g., glasses).⁵¹ These systems might perpetuate or amplify biases in the datasets they are trained on.⁵²

Using consumer data to estimate a user's age might raise privacy concerns. Website operators and third parties offering age verification services might be compelled to collect greater amounts of consumer data to develop and improve the models and systems used to estimate a user's age. For example, some methods of facial age estimation require large datasets.⁵³ Data collection and tracking tools—such as cookies and pixels—have enabled various entities to collect consumer data on the internet, which has led some policymakers to introduce or enact comprehensive consumer data privacy laws.⁵⁴

Consumer data privacy laws might affect the feasibility of using consumer data for age verification. Comprehensive data privacy bills have been introduced in previous sessions of Congress,⁵⁵ and 19 states have passed comprehensive consumer data privacy laws.⁵⁶ The effect of data privacy laws might depend, in part, on how consumers respond. For example, all of the identified state comprehensive data privacy laws provide consumers with the right to delete their personal data and opt out of having their personal data collected for certain purposes. If enough consumers request their data to be deleted or not collected, these state laws might reduce the data that can be used for age verification. Additionally, some states that do not have a comprehensive data privacy law have enacted legislation related to specific types of data, such as biometric data, that might affect the use of consumer data to conduct age verification (e.g., facial age estimation).⁵⁷

Policy Considerations for Legislation

Multiple bills introduced in the 119th Congress seek to increase protections for minors online by creating requirements for website operators.⁵⁸ Some requirements for website operators, if included in enacted legislation, could be subject to constitutional challenges under the Free Speech Clause of the First Amendment.⁵⁹

If Congress were to enact legislation creating requirements for website operators that are specific to minors, some operators might

implement changes for all users;

implement changes for individuals that the operator identifies as minors using one or more age verification methods, including those discussed in "Methods Used to Identify Minors Online";

stop offering certain services based on legislative requirements (e.g., if websites were required to prevent adults from messaging minors, some websites might not allow any users to communicate with each other); or

stop offering the website. Some websites that primarily consist of pornographic content have stopped offering their platform in certain states in response to state laws that require these websites to conduct age verification beyond self-declaration.⁶⁰ Similarly, the social media platform BlueSky stopped offering its service in Mississippi in response to the state law requiring digital service providers to verify their users' ages.⁶¹ Some operators might try to avoid this option, particularly if their revenue comes primarily from the website.

The effectiveness of legislation might depend, in part, on the age verification methods used by the operator. Although some operators use various age verification methods, surveys and internal company data indicate that minors who are below the minimum age requirement continue to access some of these websites.⁶² Each age verification method offers a different level of assurance and can raise various considerations, as discussed in the previous section. If Congress were not to enact legislation to increase protections for minors online, some operators might still explore various safety measures and age verification methods in response to public scrutiny, lawsuits,⁶³ and laws enacted by states and other countries.⁶⁴

This section analyzes some legislative options to address age verification. Specifically, this section provides some potential considerations if Congress chooses to (1) support research on age verification methods, (2) direct a federal agency to issue guidance or regulations specifying requirements related to age verification methods, (3) prohibit or require certain age verification methods, and/or (4) implement or support a government age verification system.

Support for Research

Congress has directed federal agencies to conduct research related to verifying identities online. Examples include the following:

In 2019, the Government Accountability Office (GAO) analyzed online identity verification processes used by six federal agencies and whether they relied on information provided by consumer reporting agencies (e.g., Equifax, Experian, and TransUnion),⁶⁵ as requested by Congress.⁶⁶ Two of the federal agencies no longer relied on information from consumer reporting agencies, and officials cited high costs and implementation challenges for not adopting alternative identify verification methods.

In 2022, Congress directed the National Science Foundation (NSF), subject to the availability of appropriations, to provide awards to support research on distributed ledger technologies.⁶⁷ One of the listed potential research areas is the application of distributed ledger technologies for digital identities.⁶⁸ The legislation also allows the National Institute of Standards and Technology (NIST) to carry out a research project that would identify potential applications of distributed ledger technologies that could "improve the privacy and interoperability of digital identity and access management solutions."⁶⁹

Legislation has been introduced to support research specifically on age verification methods. For example, the Kids Online Safety Act (S. 1748; 119th Congress) would require certain federal agencies to "conduct a study evaluating the most technologically feasible methods and options for developing systems to verify age at the device or operating system level," in addition to implementing other requirements for online platforms.

Supporting research on age verification methods could help inform Congress, potentially for future legislative action. For example, a federal agency may be able to test the accuracy of some age verification methods and provide an in-depth analysis of potential benefits, harms, and risks. However, website operators would be able to continue using a wide range of age verification methods. Additionally, some researchers and organizations have published reports that examine some age verification methods and provide potential trade-offs.⁷⁰ NIST conducted a study of six facial age estimation systems and found that, on average, the systems estimated the ages of individuals within a range of 3.1 years.⁷¹ Additional research might raise new considerations and legislative options.

Congressional considerations in this area might include who might need access to what types of data to provide information that would be helpful in creating federal legislation. For example, to create a comprehensive overview of potential age verification methods and their advantages and challenges, assembling a working group with researchers from industry, academia, and federal agencies might be sufficient. To analyze the number of minors accessing websites that rely on certain age verification methods, researchers may need access to these websites' internal, nonpublic data. This might raise additional considerations, such as how the internal data would be accessed and what information could be disclosed.

Requirements for Federal Agencies to Issue Guidance or Regulations

Congress has enacted legislation directing federal agencies to provide guidance or regulations related to verifying identities and protecting children's privacy online. Examples include the following:

NIST provides guidance on identity verification standards for federal agencies that offer online services through its Digital Identity Guidelines,⁷² as required by the Federal Information Security Modernization Act of 2014.⁷³ The guidelines provide three levels of assurance within three main components: (1) enrollment and identity proofing, (2) authentication and lifecycle management, and (3) federation and assertions.⁷⁴ In May 2019, the Office of Management and Budget required federal agencies to implement NIST's Digital Identity Guidelines.⁷⁵ Login.gov, a platform operated by the General Services Administration, came under scrutiny in 2023 for advertising and billing a higher level of identity assurance than it was able to offer.⁷⁶

Congress directed the FTC to promulgate regulations for website operators under COPPA.⁷⁷ The FTC outlines steps companies can take to determine whether they are covered by COPPA,⁷⁸ provides information on how companies can comply with the law,⁷⁹ and has taken enforcement action against companies for violating the law.⁸⁰ On April 22, 2025, the FTC published a final rule to amend COPPA regulations.⁸¹

Legislation has been introduced to direct a federal agency to provide guidance or promulgate regulations. For example, the SCREEN Act (H.R. 1623, S. 737; 119th Congress) would direct the FTC to provide guidance to covered platforms on complying with requirements to use a technology verification measure to verify a user's age. The Kids PRIVACY Act (H.R. 2801, 118th Congress) would have directed the FTC to promulgate regulations requiring a risk-based approach to determine the age of a user, where higher privacy and security risks would require a higher certainty of the user's age. Some mandatory requirements could be subject to constitutional challenges, as mentioned above.⁸² Congress could also direct a federal agency to promulgate regulations or establish incentives for self-regulation by enabling industry groups and other entities to provide guidelines to meet regulations prescribed by a federal agency, similar to COPPA's safe harbor program.⁸³

Guidance or regulations from a federal agency may influence the age verification methods that are developed and used by website operators. This could provide flexibility for website operators and other entities to explore new age verification methods, particularly if new options become feasible with technological developments, while addressing concerns some of the methods might raise. The effectiveness of agency guidelines or regulations would depend on the different criteria the guidelines or regulations would include and how feasible it would be for website operators to address. For example, if the regulations required a high level of assurance while prohibiting the use of government-issued documentation and consumer data, it might be difficult for website operators to comply.

The scope of the regulations may also arise as a consideration when issuing regulatory authority. For example, Congress could provide specific criteria that should be considered in the development of age verification methods and the importance of each criterion, or it could allow an agency to determine what criteria should be considered. Providing more detail in legislation could provide greater clarity for companies, enforcers, and courts and help ensure the legislation is enforced as Congress intended. However, providing an agency with greater flexibility might allow the agency to respond to technological developments that make it feasible to implement new methods. This might also create some uncertainty, depending on how frequently agency-promulgated definitions or regulations are altered.

Requiring or Prohibiting Certain Age Verification Methods

Congress could require or prohibit website operators from using certain methods to determine a user's age, although this may be subject to the potential constitutional limitations mentioned above. For example, the CHAT Act (S. 2714; 119th Congress) would require entities that operate AI chatbots to verify a user's age using a "commercially available method or process that is reasonably designed to ensure accuracy." The Protecting Kids on Social Media Act (S. 1291; 118th Congress) would have required social media platforms to take "reasonable steps beyond merely requiring attestation" and prohibited them from using or retaining "any information collected as part of the platform's age verification process." It also would have directed the Department of Commerce to establish a pilot program to provide a secure digital identification credential for U.S. citizens and lawful residents. Legislation also could affect age verification methods indirectly. For example, legislation related to consumer data privacy or AI might incentivize operators to avoid certain age verification methods and rely on others.

Website operators' responses to legislation prohibiting or requiring certain age verification methods would likely depend on the number of options specified and the legislative language used. For example, if legislation requires that operators use an age verification method other than a user's attestation, operators would have several methods to choose from. Similarly, certain terminology—such as requiring a "reasonable method of verification"—might be subject to interpretation and potentially result in a wide range of methods used.

Allowing website operators to use various age verification methods might result in different levels of assurance, privacy risks, and other trade-offs discussed in the section "Methods Used to Identify Minors Online." However, if legislation restricts operators to a limited number of age verification methods, it might increase the likelihood that operators are unable or unwilling to determine users' ages, particularly if the operators see the types of age verification methods allowed as costly and difficult to implement. It might increase the likelihood that website operators stop offering their services and might be more likely to raise constitutional concerns.⁸⁴ In June 2025, the Supreme Court ruled that a Texas law requiring certain websites that provide sexually explicit material to conduct age verification using certain allowable methods—including using a third-party service to check government-issued IDs or transactional data—does not violate the First Amendment.⁸⁵ This ruling suggests that age verification requirements may be a constitutional means of restricting minors' access to at least some kinds of content.⁸⁶

Government Age Verification System

Congress has enacted legislation requiring federal agencies to use their records to confirm information provided by certain entities. Examples are as follows:

In an effort to reduce fraud, Congress directed the Social Security Administration (SSA) to develop or modify a database to confirm the validity of certain personal information provided electronically by financial institutions if the individual gives consent.⁸⁷ In response, SSA created the electronic Consent Based Social Security Number Verification (eCBSV) service, which verifies that the individual's Social Security number (SSN), name, and date of birth combination matches SSA's records; it does not verify an individual's identity.⁸⁸

Congress directed the Attorney General to work with SSA and the Department of Homeland Security (DHS) to create a voluntary pilot program to compare information on employees' I-9 forms with government records to confirm each employee's identity and authorization to work in the United States.⁸⁹ The legislation states, "Nothing in this subtitle shall be construed to authorize, directly or indirectly, the issuance or use of national identification cards or the establishment of a national identification card."⁹⁰ The pilot program became E-Verify and is administered by DHS. Some states require some or all businesses to use E-Verify through contracting or business licensing laws.⁹¹

Legislative options could include expanding the entities that are able to use these services to include website operators or directing a federal agency to develop a new system to help confirm the age of users. Some considerations may include the following:

The level of assurance necessary to access a website. Some websites might not need the same level of assurance as opening an account with a financial institution or confirming an employee's authorization to work in the United States. Congress might consider whether different websites need different levels of assurance and which age verification methods might be appropriate.

The federal agency best suited to provide an age verification system. Some considerations might include what information the agency has access to, the agency's existing authorities, and whether the agency has the necessary resources and systems to provide the service.

What information would be provided and to whom. Requiring individuals to provide their SSN to website operators, for example, might raise consumer privacy concerns, particularly as certain operators are not subject to the same consumer data protection requirements as other entities, such as financial institutions.⁹² Additionally, if every website operator had to provide SSNs to SSA for verification, it might raise concerns about potential government surveillance.
Another option could be providing individuals access to an age verification system, similar to how digital IDs are used to access certain websites in some states. Websites could direct individuals to log in to a system to obtain verification that the individual meets a certain age threshold without obtaining additional personal information. This option might not fully address concerns about government surveillance.

Whether operators and consumers would use the age verification system. For example, the Dot Kids Implementation and Efficiency Act of 2002 directed the National Telecommunications and Information Administration (NTIA) to establish and oversee a second-level internet domain that would only provide access to material suitable for minors.⁹³ NTIA indefinitely suspended the second-level domain in 2012 because it was unable to gain public interest.⁹⁴ The effectiveness of an age verification system might depend, in part, on whether operators of popular websites use the system.

Whether the legislation would raise concerns about federalism. Many records of individuals—such as birth, marriage, and death records and drivers' licenses—are maintained by states, although some federal agencies and other entities acquire this information from states.⁹⁵ While Congress may be able to acquire or regulate this information in some circumstances, federalism principles may prevent Congress from mandating that states use the information to assist in federal age verification policies.⁹⁶

Congress could also incentivize states to implement an age verification system, such as providing states with funding to assist with a system's development and implementation. For example, although states manage elections, the Help America Vote Act of 2002 implemented minimum standards for states and established the Election Assistance Commission to assist states with federal elections.⁹⁷ Congress could implement similar provisions for a digital ID system. Some states have implemented digital ID systems or are considering doing so, and providing incentives might encourage other states to implement systems that websites could use. It may be possible to implement similar systems with, for example, each state's division for vital records.⁹⁸

Some states might not want to implement an age verification system, even if they are offered incentives. A state digital ID system would raise some of the considerations mentioned above, such as which division would be best suited to provide information for an age verification system and concerns about government surveillance. A state-run system might raise additional considerations, such as whether there would be minimum standards or security levels across states and who would set these standards.

Concluding Observations

If Congress seeks to address age verification in legislation, some overarching considerations may include the following:

Who should be responsible for determining an individual's age online? Requiring website operators to treat minors differently than adults without addressing age verification in legislation might place the responsibility of identifying users' ages on operators. Some operators might be able to easily conduct age verification; others might not have the necessary resources to do so.
A consideration may be what requirements, if any, should be placed on devices, intermediaries (e.g., app stores), and state and federal agencies. Some devices and intermediaries offer parental controls,⁹⁹ and additional controls are offered by third-party subscription apps.¹⁰⁰ Apple developed an application programming interface (API) that informs app developers when a user is below a certain age if parents consented to sharing the information when creating the child's account.¹⁰¹ However, this scenario places the burden on guardians who might not be aware of the different parental controls available and their efficacy, as well as some of the risks associated with certain online platforms. Additionally, it might be difficult to implement these types of controls on devices used by multiple individuals, such as at libraries and schools, or if children are using a parent's mobile device.

How would legislation on age verification be implemented, and what are the potential effects? For example, it would be less burdensome if users needed to verify their age once while creating an account with a website, rather than requiring users to verify their age every time they access a website. However, some websites currently do not require users to create an account. If legislation were to encourage users to create accounts with each website, it might increase the burden on users and potentially have indirect effects on the industry. For example, if individuals use the account information of popular platforms—such as Facebook, Google, and Apple—to access other websites, it might allow these companies to gather data that are not available for other operators.¹⁰²

How can an entity conducting age verification online confirm that individuals are who they claim to be? In person, a photo ID can be compared to the individual, which is not an option on the internet. Some websites use additional authentication methods—such as a security key, authentication app, or a link sent to a connected email address—to confirm individuals' identities when they create an account or access a website.¹⁰³ Some websites ask users to provide a selfie with specific requirements in the image so that the user needs to take a new photo at that moment.¹⁰⁴ Some minors may be able to bypass these security measures if, for example, they have access to their guardian's email address.

If Congress seeks to increase protections for minors online in legislation, some general considerations may include the following:

Whether requirements for website operators should address only minors. Some content that may be considered harmful, such as online bullying and harassment, can affect all users.

Whether the legislation would apply to all websites or a subset. Some policymakers have focused on websites that primarily host pornographic content and social media platforms. If certain types of content or services are associated with a greater risk of users being harmed, considerations may include how to define the platforms Congress wishes to address.¹⁰⁵

The feasibility of enforcing legislation. For example, searches for virtual private networks (VPNs) reportedly spiked after some websites that primarily provide pornographic content stopped being offered in certain states in response to state age verification laws.¹⁰⁶

Potential unintended effects. For example, if legislation were to create requirements that are burdensome for platforms to implement, nascent companies may find it difficult to enter and compete with more resourced incumbents.

Lena Maman, Senior Research Librarian, provided research assistance for this report.

Footnotes

1.

From 2013 to 2023, the percentage who experienced persistent feelings of sadness or hopelessness increased from 30% to 40% (39% to 53% for females, 21% to 28% for males), and the percentage of high school students who seriously considered attempting suicide increased from 17% to 20% (22% to 27% for females, 12% to 14% for males). See Centers for Disease Control and Prevention, Youth Risk Behavior Survey: Data Summary and Trends Report, 2013-2023, pp. 54-61, https://www.cdc.gov/healthyyouth/data/yrbs/yrbs_data_summary_and_trends.htm.

2.

This report uses the term website to refer to websites, online platforms, and mobile applications, and the term website operator for the entities that provide these websites.

3.

For example, see National Academies of Sciences, Engineering, and Medicine, Social Media and Adolescent Health, (The National Academies Press, 2024), https://doi.org/10.17226/27396; and U.S. Surgeon General Vivek Murthy, Social Media and Youth Mental Health: The U.S. Surgeon General's Advisory, U.S. Department of Health and Human Services, 2023, https://www.hhs.gov/sites/default/files/sg-youth-mental-health-social-media-advisory.pdf.

4.

An example of legislation Congress has enacted that does not create requirements for website operators is the Protecting Children in the 21st Century Act, which implemented a nationwide program to increase public awareness and provide education on strategies to promote safe use of the internet by children (P.L. 110-385, Title II, §§201-216; 15 U.S.C. §§6551-6555).

5.

P.L. 105-277, Division C, Title XIII, §§1301-1308; 15 U.S.C. §§6501-6506.

6.

P.L. 110-401, Title V, §§501-503 (has been amended twice: P.L. 115-395, P.L. 118-59); 18 U.S.C. §§2258A-2258E.

7.

Legislation requiring website operators to actively search for content might raise constitutional concerns under the Fourth Amendment. For more information, see CRS Legal Sidebar LSB10713, The Fourth Amendment and the Internet: Legal Limits on Digital Searches for Child Sexual Abuse Material (CSAM), by Michael A. Foster.

8.

P.L. 119-12; 47 U.S.C. §§223, 223a.

9.

For example, the Child Online Protection Act (P.L. 105-277, Division C, Title XIV, §§1401-1406; 47 U.S.C. §231). For more information, see CRS Report R47049, Children and the Internet: Legal Considerations in Restricting Access to Content, by Eric N. Holmes.

10.

For example, see U.S. Congress, House Committee on Energy and Commerce, Subcommittee on Commerce, Manufacturing, and Trade, The World Wide Web: Examining Harms Online, hearing, 119th Cong., 1st sess., March 26, 2025, https://docs.house.gov/Committee/Calendar/ByEvent.aspx?EventID=118066; and Kids Online Safety Act (S. 1748).

11.

For example, see California Age-Appropriate Design Code (California Civil Code, Division 3, Part 4, Title 1.81.47, https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&title=1.81.47.&part=4.&chapter=&article=); and Utah Social Media Regulation Act (Utah Code, Title 13, Chapter 63, https://le.utah.gov/~2023/bills/static/SB0152.html).

For an overview of some state laws seeking to protect minors online, see CRS Legal Sidebar LSB11020, Online Age Verification (Part I): Current Context, by Eric N. Holmes.

12.

For example, see CRS Legal Sidebar LSB11071, NetChoice v. Bonta and First Amendment Limits on Protecting Children Online, by Peter J. Benson.

13.

For example, see NetChoice, LLC v. Griffin, No. 5:23-CV-5105, 2025 WL 978607, at *14 (W.D. Ark. Mar. 31, 2025) (holding that Arkansas Act 689 "is a content-based restriction on speech that is not narrowly tailored to serve a compelling government interest" and "therefore violates the First Amendment"), appeal filed, No. 25-1889 (8th Cir. 2025); NetChoice, LLC v. Yost, 778 F. Supp. 3d 923, 959 (S.D. Ohio 2025) (permanently enjoining enforcement of Ohio's Parental Notification by Social Media Operators Act), appeal filed, No. 25-3371 (6th Cir. 2025).

14.

Walker Montgomery Protecting Children Online Act (Mississippi Legislature, H.B. 1126, https://billstatus.ls.state.ms.us/2024/pdf/history/HB/HB1126.xml); Supreme Court of the United States, NetChoice, LLC v. Lynn Fitch, Attorney General of Mississippi, August 14, 2025, https://www.supremecourt.gov/opinions/24pdf/25a97_5h25.pdf; Amy Howe, "Supreme Court Allows Restrictions on Children's Access to Social Media to Remain in Place," SCOTUSblog, August 14, 2025, https://www.scotusblog.com/2025/08/supreme-court-allows-mississippi-restrictions-on-childrens-social-media-access-to-remain-in-place/.

15.

Throughout this report, the term age verification is used to discuss all methods used to determine the age of an individual. The term age assurance is used as an umbrella term that includes age verification and age estimation, which consist of different methods (for example, see Age Check Certification Scheme, "ISO Working Draft Age Assurance Systems Standard," euCONSENT, November 2021, https://euconsent.eu/download/iso-working-draft-age-assurance-systems-standard/). This report does not make this distinction.

16.

Examples of companies that offer age verification services include Entrust and Veratad. See Entrust, "Age Verification," 2025, https://www.entrust.com/use-case/age-verification; and Veratad Technologies, "Flexible, Secure Age Verification," 2025, https://veratad.com/solutions/age-verification/.

17.

Guinness, https://www.guinness.com/en-us; Budweiser, https://us.budweiser.com/; and Patron Tequila, https://www.patrontequila.com/.

18.

Meta Platforms, "Introducing New Ways to Verify Age on Instagram," June 23, 2022, https://about.instagram.com/blog/announcements/new-ways-to-verify-age-on-instagram.

19.

Erica Finkle et al., "How Meta Uses AI to Better Understand People's Ages on Our Platforms," Tech at Meta, Meta Platforms, June 22, 2022, https://tech.facebook.com/artificial-intelligence/2022/06/adult-classifier/.

20.

Yoti, "Age Verification Should Be Just an Age," https://www.yoti.com/business/age-verification/.

21.

Instagram used to allow users to confirm their age with social vouching (i.e., other users confirm a user's age) but stated the option was removed to make improvements on October 13, 2022. Meta Platforms, "Introducing New Ways to Verify Age on Instagram," June 23, 2022, https://about.instagram.com/blog/announcements/new-ways-to-verify-age-on-instagram.

22.

YouTube, "Who May Use the Service?," last updated December 15, 2023, https://www.youtube.com/t/terms#eb887a967c.

23.

James Beser, "Extending Our Built-in Protections to More Teens on YouTube," YouTube Official Blog, July 29, 2025, https://blog.youtube/news-and-events/extending-our-built-in-protections-to-more-teens-on-youtube/.

24.

Tinder, "How Does Age Verification Work?," https://www.help.tinder.com/hc/en-us/articles/360040592771-How-does-age-verification-work-.

25.

Adi Robertson, "Louisiana Now Requires a Government ID to Access Pornhub," Verge, January 3, 2023, https://www.theverge.com/2023/1/3/23537226/louisiana-pornhub-age-verification-law-government-id.

26.

The 21 states are Alabama, Arkansas, Florida, Georgia, Idaho, Indiana, Kansas, Kentucky, Mississippi, Montana, Nebraska, North Carolina, North Dakota, Oklahoma, South Carolina, South Dakota, Tennessee, Texas, Utah, Virginia, and Wyoming (see Pornhub, "Age Verification in the U.S.," July 31, 2025, https://www.pornhub.com/blog/age-verification-in-the-news).

27.

In 2023, 160,668,889 valid passports were in circulation (see U.S. Department of State, Bureau of Consular Affairs, "Reports and Statistics," https://travel.state.gov/content/travel/en/about-us/reports-and-statistics.html). That year, the number of U.S. citizens was estimated to be 312,053,551 (see Census Bureau's American Community Survey one-year estimate at https://data.census.gov/table/ACSSE2023.K200501). This means that if each valid passport belonged to a different individual, at most, 51% of U.S. citizens had a U.S. passport. The actual percentage may be lower; an individual can have both a passport book and card, which counts as two valid passports, and qualifying non-U.S. citizens can have a U.S. passport.

28.

U.S. Department of Transportation (DOT), Federal Highway Administration (FHWA), Office of Highway Policy Information, Policy and Governmental Affairs, "6.3.1. Licensed Drivers—Ratio of Licensed Drivers to Population," Highway Statistics Series 2023, January 2025, https://www.fhwa.dot.gov/policyinformation/statistics/2023/dl1c.cfm.

29.

DOT, FHWA, Office of Highway Policy Information, Policy and Governmental Affairs, "6.3.2. Licensed Drivers, by Sex and Percentage in Each Age Group," Highway Statistics Series 2023, January 2025, https://www.fhwa.dot.gov/policyinformation/statistics/2023/dl20.cfm.

30.

Ibid. The "under 16" group is compared with 14- and 15-year-old population estimates. Ten states are estimated to have individuals younger than sixteen with a driver's license in 2023 (see DOT, FHWA, Office of Highway Policy Information, Policy and Governmental Affairs, "6.3.3. Licensed Drivers, by State, Sex, and Age Group," Highway Statistics Series 2023, January 2025, https://www.fhwa.dot.gov/policyinformation/statistics/2023/dl22.cfm).

31.

Ibid.

32.

In 2023, the number of foreign-born individuals (excluding U.S. citizens born abroad to American parent[s]) was estimated to be 47,831,411, and the total U.S. population was estimated to be 334,914,896 (see Census Bureau's American Community Service one-year estimate at https://data.census.gov/table/ACSSE2023.K200503).

33.

UNICEF, "Birth Registration," last updated June 2025, https://data.unicef.org/topic/child-protection/birth-registration/.

34.

P.L. 109-13, Division B, Title II. For more information about REAL ID, see U.S. Department of Homeland Security (DHS), "About REAL ID," https://www.dhs.gov/real-id/about-real-id.

35.

DHS, "REAL ID Frequently Asked Questions," https://www.dhs.gov/real-id/real-id-faqs.

36.

The number of private schools is reported every other year and was not reported for the 2020-2021 school year; there were 30,492 private schools in the 2019-2020 school year. See National Center for Education Statistics, "Educational Institutions," https://nces.ed.gov/fastfacts/display.asp?id=84.

37.

In this report, a digital ID refers to an electronic version of a government-issued document. It does not include other information individuals might use to identify themselves on the internet, such as usernames or sign-in information.

38.

For more information on which states allow digital IDs to be used at TSA PreCheck, see TSA, "Participating States and Eligible Digital IDs," accessed on September 10, 2025, https://www.tsa.gov/digital-id/participating-states.

39.

For example, the California DMV Wallet can be used in certain retail locations in Sacramento (see State of California DMV, "Download California's First Mobile Driver's License Today," https://www.dmv.ca.gov/portal/ca-dmv-wallet/) and LA Wallet (see LA Wallet, "LA Wallet Origins," https://lawallet.com/about/).

40.

For example, see Utah Department of Public Safety, "Utah mDL FAQs," https://dld.utah.gov/mdlfaqs/; and Iowa Department of Transportation, "Iowa Mobile ID for Businesses, Organizations, and Agencies," https://iowadot.gov/mvd/MID-businesses.

41.

The International Organization of Standardization (ISO) and the International Electrotechnical Commission (IEC), Personal Identification – ISO-compliant Driving License – Part 5: Mobile Driving License Application, ISO/IEC 18013-5, September 2021.

42.

P.L. 116-260, Division U, Title X, §1001.

43.

TSA, "Minimum Standards for Driver's Licenses and Identification Cards Acceptable by Federal Agencies for Official Purposes; Waiver for Mobile Driver's Licenses," 89 Federal Register 85340, October 25, 2024, https://www.federalregister.gov/documents/2024/10/25/2024-23881/minimum-standards-for-drivers-licenses-and-identification-cards-acceptable-by-federal-agencies-for.

44.

American Association of Motor Vehicle Administrators, Mobile Driver's License (mDL) Implementation Guidelines, version 1.2, January 2023, https://aamva.org/getmedia/b801da7b-5584-466c-8aeb-f230cef6dda5/mDL-Implementation-Guidelines-Version-1-2_final.pdf.

45.

For example, see IDEMIA, "Mobile ID: Frequently Asked Questions," https://na.idemia.com/dmv-2/mobile-id/.

46.

When this report was published, Louisiana was the only state that explicitly stated its digital ID system can be used for online identity verification (LA Wallet, "Bring Digital Verification to Your Business," https://lawallet.com/digital-verification/).

47.

For example, see Apple, "Apple Launches the First Driver's License and State ID in Wallet with Arizona," Apple Newsroom, last updated March 23, 2022, https://www.apple.com/newsroom/2022/03/apple-launches-the-first-drivers-license-and-state-id-in-wallet-with-arizona/; and Idemia, "Mobile ID: Everything Is on Your Phone. Now Your ID Is Too," https://na.idemia.com/dmv-2/mobile-id/.

48.

Grace Broadbent, "Samsung Wallet Adds State IDs to Compete Against Apple Pay and Google Pay," eMarketer, October 11, 2023, https://content-na1.emarketer.com/samsung-wallets-adds-state-ids-compete-against-apple-pay-google-pay.

49.

For example, see Lubna Takuri, "Age Verification System: How to Verify Customer Ages," Onfido, January 24, 2023, https://onfido.com/blog/age-verification-system/; Yoti, "Age Verification Should be Just an Age," https://www.yoti.com/business/age-verification/; and Google, "Access Age-Restricted Content and Features," Google Account Help, https://support.google.com/accounts/answer/10071085?hl=en.

50.

For example, Yoti reported that the probability that its facial age estimation system correctly identified an individual age 6-11 as younger than 13 was 98.35%. The results separated by skin tone and gender indicate that, on average, the system estimated the ages of individuals 6-11 within a range of 2.2 years or less (based on mean absolute error for each year). Yoti, Yoti Facial Age Estimation, white paper, March 2023, pp. 2, 5, https://www.yoti.com/wp-content/uploads/Yoti-Age-Estimation-White-Paper-March-2023.pdf.

51.

For example, see Prachi Punyani, Rashmi Gupta, and Ashwani Kumar, "Neural Networks for Facial Age Estimation: A Survey on Recent Advances," Artificial Intelligence Review, vol. 53 (2020), pp. 3299-3347, https://doi.org/10.1007/s10462-019-09765-w; and Tzvi Ganel, Carmel Sofer, and Melvyn Goodale, "Biases in Human Perception of Facial Age Are Present and More Exaggerated in Current AI Technology," Nature: Scientific Reports, vol. 12, no. 22519 (2022), https://www.nature.com/articles/s41598-022-27009-w.

52.

CRS Report R47644, Artificial Intelligence: Overview, Recent Advances, and Considerations for the 118th Congress, by Laurie A. Harris; and CRS Report R47569, Generative Artificial Intelligence and Data Privacy: A Primer, by Ling Zhu and Laurie Harris.

53.

For example, facial age estimation using convolutional neural network (CNN) frameworks require very large datasets for training; see Zichang Tan et al., "Efficient Group-n Encoding and Decoding for Facial Age Estimation," IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 40, no. 11 (2018), pp. 2610-2623, https://doi.org/10.1109/TPAMI.2017.2779808; and Oussama Guehairia et al., "Facial Age Estimation Using Tensor Based Subspace Learning and Deep Random Forests," Information Sciences, vol. 609 (September 2022), pp. 1309-1317, https://doi.org/10.1016/j.ins.2022.07.135.

54.

For more information, see CRS Report R47298, Online Consumer Data Collection and Data Privacy, by Clare Y. Cho and Ling Zhu.

55.

For example, a discussion draft of the American Privacy Rights Act (APRA) was passed by the Subcommittee on Innovation, Data, and Commerce of the House Committee on Energy and Commerce on May 23, 2024 (markup available at https://docs.house.gov/Committee/Calendar/ByEvent.aspx?EventID=117372). For more information about APRA, see CRS Legal Sidebar LSB11161, The American Privacy Rights Act, by Chris D. Linebaugh et al.

56.

Caroline Kibby, "US State Privacy Legislation Tracker," IAPP, last updated July 7, 2025, https://iapp.org/resources/article/us-state-privacy-legislation-tracker/.

57.

For example, see Illinois General Assembly, Biometric Information Privacy Act, 740 ILCS 14/, https://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=3004&ChapterID=57; and Washington State Legislature, Biometric Identifiers, Chapter 19.375, https://app.leg.wa.gov/RCW/default.aspx?cite=19.375.

58.

Some examples include the Kids Online Safety Act (S. 1409), Children and Teens' Online Privacy Protection Act (S. 1418), Social Media Child Protection Act (H.R. 821), Sammy's Law of 2023 (H.R. 5778), and EARN It Act of 2023 (H.R. 2732/S. 1207).

59.

For more information on potential constitutional concerns, see CRS Legal Sidebar LSB11021, Online Age Verification (Part II): Constitutional Background, by Eric N. Holmes; and CRS Legal Sidebar LSB11022, Online Age Verification (Part III): Select Constitutional Issues, by Eric N. Holmes.

60.

For example, Pornhub is no longer available in 21 states (see footnote 26).

61.

Bluesky Team, "Our Response to Mississippi's Age Assurance Law" (blog), August 22, 2025, https://bsky.social/about/blog/08-22-2025-mississippi-hb1126. For more information about the Mississippi law, see footnote 14).

62.

For example, 38% of survey respondents ages 8-12 years old stated that they had used a social media platform in 2021 (see Common Sense, The Common Sense Census: Media Use by Tweens and Teens, March 9, 2022, https://www.commonsensemedia.org/research/the-common-sense-census-media-use-by-tweens-and-teens-2021). A chart from an internal presentation at Meta Platforms indicates that the monthly active people penetration was between 20% and 60% for individuals ages 11-13 who were born between 2000 and 2004, and an internal report estimated that 4 million U.S. individuals under 13 were on Instagram in 2015 (see "Complaint for Injunctive and Other Relief," The People of the State of California et al. v. Meta Platforms, Inc., case no. 4:23-cv-05448-YGR (N.D. Cal), November 22, 2023, pp. 108-111).

63.

For example, multiple state attorneys general filed a lawsuit against Meta Platforms, Inc., for allegedly downplaying and concealing harms to minors caused by Facebook and Instagram, manipulating minors to spend more time on the platforms, and violating the Children's Online Privacy Protection Act of 1998 (COPPA). See "Complaint for Injunctive and Other Relief," The People of the State of California et al. v. Meta Platforms, Inc., case no. 4:23-cv-05448-YGR (N.D. Cal), October 24, 2023, pp. 1-4.

64.

For examples of state laws, see footnote 11. Examples of laws enacted in other countries include the U.K. Online Safety Act (Department of Science, Innovation, and Technology, "Online Safety Act: Explainer," Guidance, U.K. Government, last updated April 24, 2025, https://www.gov.uk/government/publications/online-safety-act-explainer/online-safety-act-explainer) and European Union's Digital Services Act (European Union, "Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a Single Market For Digital Services and amending Directive 2000/31/EC (Digital Services Act)," October 27, 2022, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022R2065&qid=1666857835014).

65.

The Government Accountability Office (GAO) examined six federal agencies: Centers for Medicare and Medicaid Services, General Services Administration, Internal Revenue Service, Social Security Administration, U.S. Postal Service, and Department of Veterans Affairs. GAO, Data Protection: Federal Agencies Need to Strengthen Online Identity Verification Processes, May 2019, https://www.gao.gov/assets/gao-19-288.pdf.

66.

The report specifies that congressional requesters included Senators Ron Wyden and Elizabeth Warren and Representatives Elijah E. Cummings and Jim Jordan (ibid., p. 39). Congress also requested a GAO report on consumer reporting agencies in the Economic Growth, Regulatory Relief, and Consumer Protection Act (P.L. 115-174), §308.

67.

P.L. 117-263, Division E, Title LIX, §5913; 42 U.S.C. §19222.

68.

Ibid., §(c)(1)(H)(i).

69.

Ibid., §(d)(2)(A)(i).

70.

For example, see Scott Brennen and Matt Perault, Keeping Kids Safe Online: How Should Policymakers Approach Age Verification?, The Center for Growth and Opportunity, Utah State University, June 21, 2023, https://www.thecgo.org/research/keeping-kids-safe-online-how-should-policymakers-approach-age-verification/; and Shoshana Weissmann, "The Fundamental Problems with Social Media Age-Verification Legislation," R Street Institute, May 16, 2023, https://www.rstreet.org/commentary/the-fundamental-problems-with-social-media-age-verification-legislation/.

71.

Kayee Hanaoka et al., Face Analysis Technology Evaluation: Age Estimation and Verification, National Institute of Standards and Technology Internal Report 8525, U.S. Department of Commerce, May 2024, https://doi.org/10.6028/NIST.IR.8525.

72.

Paul Grassi, Michael Garcia, and James Fenton, Digital Identity Guidelines, NIST Special Publication 800-63-3, last updated March 2, 2020, https://pages.nist.gov/800-63-3/. An initial public draft of the fourth revision is available at https://pages.nist.gov/800-63-4/.

73.

P.L. 113-283; 44 U.S.C. §§3551-3559.

74.

Federation and assertions refers to the protocol used in a federated environment to communicate authentication and attribute information, when applicable, to the party relying on this information. After the entity conducting the verification completes the authentication process, it generates an assertion containing the results to the requesting party. Ibid.

75.

Office of Management and Budget, "Memorandum for Heads of Executive Department and Agencies," May 21, 2019, https://www.whitehouse.gov/wp-content/uploads/2019/05/M-19-17.pdf.

76.

For more information about login.gov and the scrutiny it received, see CRS In Focus IF12395, Login.gov: Administration and Identity Authentication, by Dominick A. Fiorentino, Natalie R. Ortiz, and Meghan M. Stuessy.

77.

15 U.S.C. §6502.

78.

FTC, "Children's Online Privacy Protection Rule: A Six-Step Compliance Plan for Your Business," https://www.ftc.gov/business-guidance/resources/childrens-online-privacy-protection-rule-six-step-compliance-plan-your-business.

79.

Ibid. FTC, "Complying with COPPA: Frequently Asked Questions," https://www.ftc.gov/business-guidance/resources/complying-coppa-frequently-asked-questions.

80.

For a list of enforcement actions taken by the FTC, see FTC, "Cases Tagged with Children's Online Privacy Protection Act (COPPA)," https://www.ftc.gov/enforcement/cases-proceedings/terms/875.

81.

FTC, "Children's Online Privacy Protection Rule," 90 Federal Register 16918, April 22, 2025, https://www.federalregister.gov/documents/2025/04/22/2025-05904/childrens-online-privacy-protection-rule.

82.

CRS Legal Sidebar LSB11022, Online Age Verification (Part III): Select Constitutional Issues, by Eric N. Holmes.

83.

For more information about the safe harbor program, see FTC, "COPPA Safe Harbor Program," at https://www.ftc.gov/enforcement/coppa-safe-harbor-program.

84.

See the "Speech Rights of Website Operators" section in CRS Legal Sidebar LSB11022, Online Age Verification (Part III): Select Constitutional Issues, by Eric N. Holmes.

85.

Texas Legislature Online, H.B. 1181, https://capitol.texas.gov/billlookup/History.aspx?LegSess=88R&Bill=HB1181; Supreme Court of the United States, Free Speech Coalition, Inc., et al. v. Paxton, Attorney General of Texas, July 27, 2025, https://www.supremecourt.gov/opinions/24pdf/23-1122_3e04.pdf.

86.

For more information about the ruling, see CRS Legal Sidebar LSB11354, Supreme Court Upholds State Age-Verification Requirement for Certain Websites, by Victoria L. Killion.

87.

P.L. 115-174, Title II, §215; 42 U.S.C. §405b.

88.

For more information, see Social Security Administration (SSA), "Information About eCBSV," https://www.ssa.gov/dataexchange/eCBSV/.

89.

P.L. 104-208, Title IV, Subtitle A, §§401-405; 8 U.S.C. §1324a note.

90.

P.L. 104-208, Title IV, Subtitle A, §404(h)(2).

91.

For more information about E-Verify, see CRS Report R40446, Electronic Employment Eligibility Verification, by Andorra Bruno; DHS, "What Is E-Verify?," last updated June 2, 2023, https://www.e-verify.gov/about-e-verify/what-is-e-verify; and DHS, "History and Milestones," last updated May 4, 2023, https://www.e-verify.gov/about-e-verify/history-and-milestones.

92.

Financial institutions and their affiliates are subject to consumer data protection requirements under the Gramm-Leach-Bliley Act (15 U.S.C. §§6801-6809). For an overview of the Gramm-Leach-Bliley Act and other data protection laws, see CRS Report R45631, Data Protection Law: An Overview, by Stephen P. Mulligan and Chris D. Linebaugh.

93.

P.L. 107-317; 47 U.S.C. §941.

94.

NTIA, ".us Domain Space," https://www.ntia.gov/page/us-domain-space (see "2007 Contract – Modification 0012" on June 27, 2012). According to an industry publication, the number of domain name registrations was relatively low, the use of the extension was limited, and it was determined that "there are now numerous websites with high-quality content aimed at children and numerous tools available to create a safe internet space for children." Hogan Lovells International LLP, "NTIA Suspends '.kids.us' Extension," World Trademark Review Daily, September 10, 2012, https://www.hoganlovells.com/-/media/hogan-lovells/pdf/publication/parlib011219512v1worldtrademarkreviewdailydtaylor100912_pdf.pdf.

95.

For example, the SSA acquires and maintains death data from states to administer some of its programs, and Naphsis, a nonprofit organization, provides access to birth and death data from most states. For more information, see CRS Report R46640, The Social Security Administration's Death Data: In Brief, by Paul S. Davies; and Naphsis, "About Us," https://www.naphsis.org/about-us/.

96.

For more information on federalism, see CRS Report R45323, Federalism-Based Limitations on Congressional Power: An Overview, coordinated by Kevin J. Hickey.

97.

P.L. 107-252; 52 U.S.C. §§20901-21145. For more information, see CRS In Focus IF12033, The Help America Vote Act of 2002 (HAVA): An Overview, by Karen L. Shanton.

98.

The vital records division in each state has birth, death, marriage, and divorce records. Contact information for the vital records division for each state is available at Centers for Disease Control and Prevention, National Center for Health Statistics, "Where to Write for Vital Records," https://www.cdc.gov/nchs/w2w/index.htm.

99.

For example, see Google Play Help, "How to Set Up Parental Controls on Google Play," Google, https://support.google.com/googleplay/answer/1075738; and Apple, "Use Parental controls on Your Child's iPhone or iPad," May 5, 2025, https://support.apple.com/en-us/105121.

100.

Qustodio, https://www.qustodio.com/en/; and Net Nanny, https://www.netnanny.com/.

101.

Apple, Helping Protect Kids Online, February 2025, https://developer.apple.com/support/downloads/Helping-Protect-Kids-Online-2025.pdf.

102.

For example, Pinterest allows users to sign in using Facebook and Google (see Pinterest, https://www.pinterest.com/), and Airbnb allows users to sign in using their Facebook, Google, and Apple account, as well as their email address or phone number (see Airbnb, https://www.airbnb.com/).

103.

For example, Login.gov requires additional authentication methods to create an account. See General Services Administration, "Create an Account," Login.gov, https://www.login.gov/create-an-account/. Using multiple authentication methods to access a website is also known as multifactor authentication or two-step verification; for more information, see Cybersecurity and Infrastructure Security Agency, "Multi-Factor Authentication," January 5, 2022, https://www.cisa.gov/resources-tools/resources/multi-factor-authentication-mfa.

104.

Kashmir Hill, "Want Your Personal Data? Hand Over More Please," New York Times, updated October 27, 2021, https://www.nytimes.com/2020/01/15/technology/data-privacy-law-access.html.

105.

For more information, see CRS Report R47662, Defining and Regulating Online Platforms, coordinated by Clare Y. Cho.

106.

Ned Oliver, "Virginia Leads Nation in VPN Searches After PornHub Block," Axios, July 7, 2023, https://www.axios.com/local/richmond/2023/07/07/pornhub-ban-virginia-vpn. A virtual private network (VPN) is a private network that can provide users with increased privacy, such as masking the IP address of their device so that the location of the device cannot be identified. For more information, see Sheila Frankel et al., Guide to SSL VPNs: Recommendations of the National Institute of Standards and Technology, Special Publication 800-113, NIST, U.S. Department of Commerce, July 2008 pp. 6-36 and 6-37.