Concerns about potential harms to minors on the internet, particularly on social media platforms, have grown in recent years. Dating to the 1990s, policymakers have enacted legislation seeking to protect minors online, some of which create requirements for entities that provide websites, mobile applications, and online platforms (collectively, website operators).
Website operators have developed various methods to determine users' ages, often in response to federal or state legislation. Some commonly used methods include (1) relying on self-identification, such as requiring a user to provide their date of birth or check a box to indicate the user is of a certain age; (2) requesting documentation, such as a photo identification (ID) or a digitized driver's license containing the user's name and age; and (3) using consumer data, such as analyzing user content posted on the website or an image of the user's face. Each of these age verification methods presents different advantages and challenges. For example, everyone can provide a date of birth, but a website operator cannot verify that information without additional data or documentation. A website operator that receives a user's government-issued photo ID might be assured that the individual meets a minimum age requirement, but not everyone has a government-issued photo ID. This might also raise consumer data privacy concerns, depending on how the information is shared and stored.
Some Members of Congress have proposed increasing protections for minors online by implementing additional requirements for website operators. Website operators might respond by (1) implementing changes for all users; (2) implementing changes for individuals identified as minors, potentially using one of the methods mentioned above; (3) no longer offering certain services; or (4) no longer offering the entire service in the United States.
If Congress chooses not to address age verification methods used by website operators in legislation, website operators might still develop and implement new age verification methods in response to public scrutiny, lawsuits, and laws enacted by states and other countries. If Congress seeks to address age verification in legislation, some potential options include the following:
Some general considerations for Congress might include (1) who should be responsible for determining an individual's age online, (2) how would legislation on age verification be implemented and what are the potential effects, and (3) how an entity conducting age verification online can confirm that individuals are who they claim to be.
Concerns about potential harms to minors using the internet have grown over the last few years. Surveys conducted by the Centers for Disease Control and Prevention have found that the percentage of high school students considering suicide and experiencing persistent feelings of sadness increased over the last decade, particularly for females.1 Much of the concern has focused on social media. Several studies, including internal research conducted by website operators,2 suggest that some minors' mental health is harmed from using social media, although these studies find that other minors might not experience harms or might benefit from using social media.3
Congress has enacted legislation seeking to protect minors online. Some of the legislation creates requirements for website operators,4 including the following:
Some federal laws seeking to protect minors online have been deemed unconstitutional under the First Amendment by federal courts.9
The 119th Congress has held hearings and Members have introduced bills seeking to increase protections for minors online by implementing additional requirements for website operators.10 Several states have enacted laws creating requirements for websites that provide material intended for or likely to be accessed by minors (e.g., social media platforms) and for websites that provide material that is deemed harmful to minors in the legislation (e.g., websites that provide pornographic content).11 Many of these laws have been challenged in court on free speech grounds. Although much of the litigation is ongoing, courts have temporarily blocked some of these requirements from going into effect after ruling that they likely violate the First Amendment,12 or courts have permanently barred a state from enforcing certain requirements determined to be unconstitutional.13 Other state laws have been allowed to go into effect while First Amendment rulings are on appeal, such as a Mississippi law requiring digital service providers to "make commercially reasonable efforts to verify the age of the person creating an account" and follow certain provisions for individuals under the age of 18 (e.g., obtain express consent from a parent or guardian).14
A consideration for implementing requirements for website operators might include whether operators are able to identify minors. Some bills introduced in the 119th Congress require or would likely incentivize website operators to implement age verification methods.15 This report discusses some methods used by website operators to determine users' ages and potential trade-offs associated with each method. It also analyzes selected legislative options to address age verification and provides some considerations for Congress related to age verification and protecting minors online.
No federal statute explicitly requires website operators to determine the age of individuals who use their websites. Nevertheless, some website operators have developed age verification methods or use age verification services provided by third parties to prevent minors from accessing their websites.16 Laws enacted by Congress, state governments, and policymakers in other countries may incentivize operators to implement age verification methods.
Some examples of age verification methods used by website operators include the following:
This section discusses potential trade-offs—such as level of assurance, feasibility for operators, accessibility for users, and user privacy—for some methods used by operators to identify minors online. These methods are grouped into three categories: (1) users self-report their age or date of birth, (2) users provide documentation to verify their age, and (3) operators or third parties use data collected about individuals' online activity to determine their age.
Some websites require users to self-attest that they meet a minimum age requirement—such as by checking a box or providing their age or date of birth—when creating an account or accessing the website. This age verification method can be accomplished by all individuals and generally requires relatively low effort and costs for operators. However, users can easily claim to meet the age requirement when they do not. A website operator cannot determine whether users are providing their actual age without additional information.
Some websites require users to provide documentation to verify their age. These often include government-issued documents—such as a driver's license, passport, or birth certificate—or other documents that provide some combination of the individual's full name, photo, age, and date of birth, such as a medical record, school ID, or membership ID. A website operator has an incentive to accept a wide range of documents or documents that most individuals can access to increase the number of potential users. Some operators might choose not to accept certain documents to maintain a higher level of assurance.
The types of documents held by most individuals vary. For example, the number of valid passports in circulation suggests that, at most, 51% of U.S. citizens have a passport.27 About 71% of individuals residing in the United States had a driver's license in 2023,28 with over 90% of those ages 30-79.29 About 1.4% of individuals ages 14 and 15 had a driver's license,30 and the percentages of individuals ages 16, 17, and 18 that had a driver's license were about 25%, 44%, and 60%, respectively.31 CRS could not find similar information for other state-issued IDs.
A larger number of minors have access to other documents, such as birth certificates and school IDs, but accessibility might remain an issue for some individuals. For example, although most individuals born in the United States have a birth certificate, about 14% of individuals in the United States in 2022 were born in a foreign country, some of which might not offer birth certificates.32 While nearly all children under five in Western Europe and North America have a birth certificate, UNICEF estimates that 77% of children under five across the world have their births registered.33 Similarly, some schools might not offer a school ID, and some school IDs might not indicate the individual's birthdate or age.
Some documents might be considered more reliable and harder to falsify than others. For example, the REAL ID Act prohibits federal agencies from accepting drivers' licenses and state-issued IDs unless the cards meet certain standards;34 enforcement began on May 7, 2025.35 In contrast, schools do not have a uniform ID system; there were 98,577 public schools, including kindergarten through high school, in the 2020-2021 school year.36 Schools might implement different security standards, if any, and use various designs, styles, and formats that could make it difficult to determine which school IDs are legitimate and which are fake.
The ability to counterfeit or falsify documents would also depend on other factors, such as the systems used to share documents. For example, an image of a driver's license would likely be easier to alter than a digital version of a driver's license that is verified by a state agency, which are discussed below in "Digital ID." Government-issued documents are considered to be reliable, and often are used to verify an individual's identity. Sharing government-issued documents with other entities might raise greater privacy and identity theft concerns than sharing other types of documents.
Some states offer digital IDs in the form of a digitized driver's license and state ID.37 These digital IDs are accessible through an app operated by the state government or a company partnering with the state government, often with the state's Department of Motor Vehicles (DMV). Some states allow these digital IDs to be used only at Transportation Security Administration (TSA) PreCheck entrances at certain airports;38 others allow various retail locations to accept digital IDs.39
Most of the digital ID systems implemented by states thus far comply with standards set by two international organizations: the International Organization of Standardization (ISO) and the International Electrotechnical Commission (IEC).40 The ISO/IEC 18013-5 standards provide technical and functional requirements to maintain security, privacy, and interoperability for mobile drivers' licenses.41 These standards differ from the REAL ID requirements, which were expanded to mobile drivers' licenses in 2019.42 The TSA published a final rule to temporarily waive the requirement that mobile drivers' licenses be compliant with REAL ID standards to be accepted by federal agencies for official purposes.43 Digital IDs can be compliant with both ISO/IEC 18013-5 and REAL ID standards with some minor adjustments.44
Some of the accessibility concerns discussed in "Documentation" may be applicable to digital IDs. For example, because most individuals younger than 18 and nearly all individuals under 16 do not have a driver's license, a mobile driver's license would not be an option for most minors. However, the percentage of minors with a driver's license or other state-issued IDs might increase if these IDs can be used to access websites. Accessibility might remain an issue for some individuals if the app is provided only on mobile devices, particularly for individuals who do not have access to a mobile device and access the internet using computers and laptops.
A digital ID system might provide greater privacy protections than, for example, having individuals send photos of government-issued documents to every website they wish to access. A digital ID system could allow a government agency verify an individual's age without disclosing additional information to various website operators. Nevertheless, privacy concerns might depend on various factors, including the security of the system implemented and the amount and type of data the operator of a digital ID system would be able to access. There may be concern, for example, that the operator of the system would be able to track an individual's movements across websites. The operators of digital ID systems state that they do not store users' data.45
A potential complication with relying on digital IDs for age verification is that most states currently do not have a digital ID system that website operators can use to verify users' ages.46 However, several states have implemented digital IDs for some entities, and other states might be implementing their own systems.47 If states rely on companies to provide their digital IDs, it might raise concerns about potential unintended effects, such as whether consumers would be encouraged to use the companies' mobile wallets and other adjacent products.48
Consumer data can be used to estimate a user's age on a website. Data that might be used include conversations users have with their peers (e.g., upcoming birthday, classes), biometric data (e.g., image of a user's face), and data provided by other entities (e.g., credit card number).49 Operators of websites that host large amounts of user-generated content may be able to use information provided directly on the website, while others might need to rely on data provided by other entities, such as data brokers, or age verification services offered by third parties.
To estimate a user's age, consumer data are typically analyzed using algorithms, AI, and other technologies; the accuracy depends on the system used. For example, some studies suggest that facial age estimation systems can estimate age within a range but have difficulty distinguishing between small differences in age (e.g., whether someone is 13 or 14 years old).50 Additionally, the accuracy of these systems can be affected by factors such as facial expressions, makeup, color mode, and the use of props (e.g., glasses).51 These systems might perpetuate or amplify biases in the datasets they are trained on.52
Using consumer data to estimate a user's age might raise privacy concerns. Website operators and third parties offering age verification services might be compelled to collect greater amounts of consumer data to develop and improve the models and systems used to estimate a user's age. For example, some methods of facial age estimation require large datasets.53 Data collection and tracking tools—such as cookies and pixels—have enabled various entities to collect consumer data on the internet, which has led some policymakers to introduce or enact comprehensive consumer data privacy laws.54
Consumer data privacy laws might affect the feasibility of using consumer data for age verification. Comprehensive data privacy bills have been introduced in previous sessions of Congress,55 and 19 states have passed comprehensive consumer data privacy laws.56 The effect of data privacy laws might depend, in part, on how consumers respond. For example, all of the identified state comprehensive data privacy laws provide consumers with the right to delete their personal data and opt out of having their personal data collected for certain purposes. If enough consumers request their data to be deleted or not collected, these state laws might reduce the data that can be used for age verification. Additionally, some states that do not have a comprehensive data privacy law have enacted legislation related to specific types of data, such as biometric data, that might affect the use of consumer data to conduct age verification (e.g., facial age estimation).57
Multiple bills introduced in the 119th Congress seek to increase protections for minors online by creating requirements for website operators.58 Some requirements for website operators, if included in enacted legislation, could be subject to constitutional challenges under the Free Speech Clause of the First Amendment.59
If Congress were to enact legislation creating requirements for website operators that are specific to minors, some operators might
The effectiveness of legislation might depend, in part, on the age verification methods used by the operator. Although some operators use various age verification methods, surveys and internal company data indicate that minors who are below the minimum age requirement continue to access some of these websites.62 Each age verification method offers a different level of assurance and can raise various considerations, as discussed in the previous section. If Congress were not to enact legislation to increase protections for minors online, some operators might still explore various safety measures and age verification methods in response to public scrutiny, lawsuits,63 and laws enacted by states and other countries.64
This section analyzes some legislative options to address age verification. Specifically, this section provides some potential considerations if Congress chooses to (1) support research on age verification methods, (2) direct a federal agency to issue guidance or regulations specifying requirements related to age verification methods, (3) prohibit or require certain age verification methods, and/or (4) implement or support a government age verification system.
Congress has directed federal agencies to conduct research related to verifying identities online. Examples include the following:
Legislation has been introduced to support research specifically on age verification methods. For example, the Kids Online Safety Act (S. 1748; 119th Congress) would require certain federal agencies to "conduct a study evaluating the most technologically feasible methods and options for developing systems to verify age at the device or operating system level," in addition to implementing other requirements for online platforms.
Supporting research on age verification methods could help inform Congress, potentially for future legislative action. For example, a federal agency may be able to test the accuracy of some age verification methods and provide an in-depth analysis of potential benefits, harms, and risks. However, website operators would be able to continue using a wide range of age verification methods. Additionally, some researchers and organizations have published reports that examine some age verification methods and provide potential trade-offs.70 NIST conducted a study of six facial age estimation systems and found that, on average, the systems estimated the ages of individuals within a range of 3.1 years.71 Additional research might raise new considerations and legislative options.
Congressional considerations in this area might include who might need access to what types of data to provide information that would be helpful in creating federal legislation. For example, to create a comprehensive overview of potential age verification methods and their advantages and challenges, assembling a working group with researchers from industry, academia, and federal agencies might be sufficient. To analyze the number of minors accessing websites that rely on certain age verification methods, researchers may need access to these websites' internal, nonpublic data. This might raise additional considerations, such as how the internal data would be accessed and what information could be disclosed.
Congress has enacted legislation directing federal agencies to provide guidance or regulations related to verifying identities and protecting children's privacy online. Examples include the following:
Legislation has been introduced to direct a federal agency to provide guidance or promulgate regulations. For example, the SCREEN Act (H.R. 1623, S. 737; 119th Congress) would direct the FTC to provide guidance to covered platforms on complying with requirements to use a technology verification measure to verify a user's age. The Kids PRIVACY Act (H.R. 2801, 118th Congress) would have directed the FTC to promulgate regulations requiring a risk-based approach to determine the age of a user, where higher privacy and security risks would require a higher certainty of the user's age. Some mandatory requirements could be subject to constitutional challenges, as mentioned above.82 Congress could also direct a federal agency to promulgate regulations or establish incentives for self-regulation by enabling industry groups and other entities to provide guidelines to meet regulations prescribed by a federal agency, similar to COPPA's safe harbor program.83
Guidance or regulations from a federal agency may influence the age verification methods that are developed and used by website operators. This could provide flexibility for website operators and other entities to explore new age verification methods, particularly if new options become feasible with technological developments, while addressing concerns some of the methods might raise. The effectiveness of agency guidelines or regulations would depend on the different criteria the guidelines or regulations would include and how feasible it would be for website operators to address. For example, if the regulations required a high level of assurance while prohibiting the use of government-issued documentation and consumer data, it might be difficult for website operators to comply.
The scope of the regulations may also arise as a consideration when issuing regulatory authority. For example, Congress could provide specific criteria that should be considered in the development of age verification methods and the importance of each criterion, or it could allow an agency to determine what criteria should be considered. Providing more detail in legislation could provide greater clarity for companies, enforcers, and courts and help ensure the legislation is enforced as Congress intended. However, providing an agency with greater flexibility might allow the agency to respond to technological developments that make it feasible to implement new methods. This might also create some uncertainty, depending on how frequently agency-promulgated definitions or regulations are altered.
Congress could require or prohibit website operators from using certain methods to determine a user's age, although this may be subject to the potential constitutional limitations mentioned above. For example, the CHAT Act (S. 2714; 119th Congress) would require entities that operate AI chatbots to verify a user's age using a "commercially available method or process that is reasonably designed to ensure accuracy." The Protecting Kids on Social Media Act (S. 1291; 118th Congress) would have required social media platforms to take "reasonable steps beyond merely requiring attestation" and prohibited them from using or retaining "any information collected as part of the platform's age verification process." It also would have directed the Department of Commerce to establish a pilot program to provide a secure digital identification credential for U.S. citizens and lawful residents. Legislation also could affect age verification methods indirectly. For example, legislation related to consumer data privacy or AI might incentivize operators to avoid certain age verification methods and rely on others.
Website operators' responses to legislation prohibiting or requiring certain age verification methods would likely depend on the number of options specified and the legislative language used. For example, if legislation requires that operators use an age verification method other than a user's attestation, operators would have several methods to choose from. Similarly, certain terminology—such as requiring a "reasonable method of verification"—might be subject to interpretation and potentially result in a wide range of methods used.
Allowing website operators to use various age verification methods might result in different levels of assurance, privacy risks, and other trade-offs discussed in the section "Methods Used to Identify Minors Online." However, if legislation restricts operators to a limited number of age verification methods, it might increase the likelihood that operators are unable or unwilling to determine users' ages, particularly if the operators see the types of age verification methods allowed as costly and difficult to implement. It might increase the likelihood that website operators stop offering their services and might be more likely to raise constitutional concerns.84 In June 2025, the Supreme Court ruled that a Texas law requiring certain websites that provide sexually explicit material to conduct age verification using certain allowable methods—including using a third-party service to check government-issued IDs or transactional data—does not violate the First Amendment.85 This ruling suggests that age verification requirements may be a constitutional means of restricting minors' access to at least some kinds of content.86
Congress has enacted legislation requiring federal agencies to use their records to confirm information provided by certain entities. Examples are as follows:
Legislative options could include expanding the entities that are able to use these services to include website operators or directing a federal agency to develop a new system to help confirm the age of users. Some considerations may include the following:
Congress could also incentivize states to implement an age verification system, such as providing states with funding to assist with a system's development and implementation. For example, although states manage elections, the Help America Vote Act of 2002 implemented minimum standards for states and established the Election Assistance Commission to assist states with federal elections.97 Congress could implement similar provisions for a digital ID system. Some states have implemented digital ID systems or are considering doing so, and providing incentives might encourage other states to implement systems that websites could use. It may be possible to implement similar systems with, for example, each state's division for vital records.98
Some states might not want to implement an age verification system, even if they are offered incentives. A state digital ID system would raise some of the considerations mentioned above, such as which division would be best suited to provide information for an age verification system and concerns about government surveillance. A state-run system might raise additional considerations, such as whether there would be minimum standards or security levels across states and who would set these standards.
If Congress seeks to address age verification in legislation, some overarching considerations may include the following:
If Congress seeks to increase protections for minors online in legislation, some general considerations may include the following:
| 1. |
From 2013 to 2023, the percentage who experienced persistent feelings of sadness or hopelessness increased from 30% to 40% (39% to 53% for females, 21% to 28% for males), and the percentage of high school students who seriously considered attempting suicide increased from 17% to 20% (22% to 27% for females, 12% to 14% for males). See Centers for Disease Control and Prevention, Youth Risk Behavior Survey: Data Summary and Trends Report, 2013-2023, pp. 54-61, https://www.cdc.gov/healthyyouth/data/yrbs/yrbs_data_summary_and_trends.htm. |
| 2. |
This report uses the term website to refer to websites, online platforms, and mobile applications, and the term website operator for the entities that provide these websites. |
| 3. |
For example, see National Academies of Sciences, Engineering, and Medicine, Social Media and Adolescent Health, (The National Academies Press, 2024), https://doi.org/10.17226/27396; and U.S. Surgeon General Vivek Murthy, Social Media and Youth Mental Health: The U.S. Surgeon General's Advisory, U.S. Department of Health and Human Services, 2023, https://www.hhs.gov/sites/default/files/sg-youth-mental-health-social-media-advisory.pdf. |
| 4. |
An example of legislation Congress has enacted that does not create requirements for website operators is the Protecting Children in the 21st Century Act, which implemented a nationwide program to increase public awareness and provide education on strategies to promote safe use of the internet by children (P.L. 110-385, Title II, §§201-216; 15 U.S.C. §§6551-6555). |
| 5. |
P.L. 105-277, Division C, Title XIII, §§1301-1308; 15 U.S.C. §§6501-6506. |
| 6. |
P.L. 110-401, Title V, §§501-503 (has been amended twice: P.L. 115-395, P.L. 118-59); 18 U.S.C. §§2258A-2258E. |
| 7. |
Legislation requiring website operators to actively search for content might raise constitutional concerns under the Fourth Amendment. For more information, see CRS Legal Sidebar LSB10713, The Fourth Amendment and the Internet: Legal Limits on Digital Searches for Child Sexual Abuse Material (CSAM), by Michael A. Foster. |
| 8. |
P.L. 119-12; 47 U.S.C. §§223, 223a. |
| 9. |
For example, the Child Online Protection Act (P.L. 105-277, Division C, Title XIV, §§1401-1406; 47 U.S.C. §231). For more information, see CRS Report R47049, Children and the Internet: Legal Considerations in Restricting Access to Content, by Eric N. Holmes. |
| 10. |
For example, see U.S. Congress, House Committee on Energy and Commerce, Subcommittee on Commerce, Manufacturing, and Trade, The World Wide Web: Examining Harms Online, hearing, 119th Cong., 1st sess., March 26, 2025, https://docs.house.gov/Committee/Calendar/ByEvent.aspx?EventID=118066; and Kids Online Safety Act (S. 1748). |
| 11. |
For example, see California Age-Appropriate Design Code (California Civil Code, Division 3, Part 4, Title 1.81.47, https://leginfo.legislature.ca.gov/faces/codes_displayText.xhtml?lawCode=CIV&division=3.&title=1.81.47.&part=4.&chapter=&article=); and Utah Social Media Regulation Act (Utah Code, Title 13, Chapter 63, https://le.utah.gov/~2023/bills/static/SB0152.html). For an overview of some state laws seeking to protect minors online, see CRS Legal Sidebar LSB11020, Online Age Verification (Part I): Current Context, by Eric N. Holmes. |
| 12. |
For example, see CRS Legal Sidebar LSB11071, NetChoice v. Bonta and First Amendment Limits on Protecting Children Online, by Peter J. Benson. |
| 13. |
For example, see NetChoice, LLC v. Griffin, No. 5:23-CV-5105, 2025 WL 978607, at *14 (W.D. Ark. Mar. 31, 2025) (holding that Arkansas Act 689 "is a content-based restriction on speech that is not narrowly tailored to serve a compelling government interest" and "therefore violates the First Amendment"), appeal filed, No. 25-1889 (8th Cir. 2025); NetChoice, LLC v. Yost, 778 F. Supp. 3d 923, 959 (S.D. Ohio 2025) (permanently enjoining enforcement of Ohio's Parental Notification by Social Media Operators Act), appeal filed, No. 25-3371 (6th Cir. 2025). |
| 14. |
Walker Montgomery Protecting Children Online Act (Mississippi Legislature, H.B. 1126, https://billstatus.ls.state.ms.us/2024/pdf/history/HB/HB1126.xml); Supreme Court of the United States, NetChoice, LLC v. Lynn Fitch, Attorney General of Mississippi, August 14, 2025, https://www.supremecourt.gov/opinions/24pdf/25a97_5h25.pdf; Amy Howe, "Supreme Court Allows Restrictions on Children's Access to Social Media to Remain in Place," SCOTUSblog, August 14, 2025, https://www.scotusblog.com/2025/08/supreme-court-allows-mississippi-restrictions-on-childrens-social-media-access-to-remain-in-place/. |
| 15. |
Throughout this report, the term age verification is used to discuss all methods used to determine the age of an individual. The term age assurance is used as an umbrella term that includes age verification and age estimation, which consist of different methods (for example, see Age Check Certification Scheme, "ISO Working Draft Age Assurance Systems Standard," euCONSENT, November 2021, https://euconsent.eu/download/iso-working-draft-age-assurance-systems-standard/). This report does not make this distinction. |
| 16. |
Examples of companies that offer age verification services include Entrust and Veratad. See Entrust, "Age Verification," 2025, https://www.entrust.com/use-case/age-verification; and Veratad Technologies, "Flexible, Secure Age Verification," 2025, https://veratad.com/solutions/age-verification/. |
| 17. |
Guinness, https://www.guinness.com/en-us; Budweiser, https://us.budweiser.com/; and Patron Tequila, https://www.patrontequila.com/. |
| 18. |
Meta Platforms, "Introducing New Ways to Verify Age on Instagram," June 23, 2022, https://about.instagram.com/blog/announcements/new-ways-to-verify-age-on-instagram. |
| 19. |
Erica Finkle et al., "How Meta Uses AI to Better Understand People's Ages on Our Platforms," Tech at Meta, Meta Platforms, June 22, 2022, https://tech.facebook.com/artificial-intelligence/2022/06/adult-classifier/. |
| 20. |
Yoti, "Age Verification Should Be Just an Age," https://www.yoti.com/business/age-verification/. |
| 21. |
Instagram used to allow users to confirm their age with social vouching (i.e., other users confirm a user's age) but stated the option was removed to make improvements on October 13, 2022. Meta Platforms, "Introducing New Ways to Verify Age on Instagram," June 23, 2022, https://about.instagram.com/blog/announcements/new-ways-to-verify-age-on-instagram. |
| 22. |
YouTube, "Who May Use the Service?," last updated December 15, 2023, https://www.youtube.com/t/terms#eb887a967c. |
| 23. |
James Beser, "Extending Our Built-in Protections to More Teens on YouTube," YouTube Official Blog, July 29, 2025, https://blog.youtube/news-and-events/extending-our-built-in-protections-to-more-teens-on-youtube/. |
| 24. |
Tinder, "How Does Age Verification Work?," https://www.help.tinder.com/hc/en-us/articles/360040592771-How-does-age-verification-work-. |
| 25. |
Adi Robertson, "Louisiana Now Requires a Government ID to Access Pornhub," Verge, January 3, 2023, https://www.theverge.com/2023/1/3/23537226/louisiana-pornhub-age-verification-law-government-id. |
| 26. |
The 21 states are Alabama, Arkansas, Florida, Georgia, Idaho, Indiana, Kansas, Kentucky, Mississippi, Montana, Nebraska, North Carolina, North Dakota, Oklahoma, South Carolina, South Dakota, Tennessee, Texas, Utah, Virginia, and Wyoming (see Pornhub, "Age Verification in the U.S.," July 31, 2025, https://www.pornhub.com/blog/age-verification-in-the-news). |
| 27. |
In 2023, 160,668,889 valid passports were in circulation (see U.S. Department of State, Bureau of Consular Affairs, "Reports and Statistics," https://travel.state.gov/content/travel/en/about-us/reports-and-statistics.html). That year, the number of U.S. citizens was estimated to be 312,053,551 (see Census Bureau's American Community Survey one-year estimate at https://data.census.gov/table/ACSSE2023.K200501). This means that if each valid passport belonged to a different individual, at most, 51% of U.S. citizens had a U.S. passport. The actual percentage may be lower; an individual can have both a passport book and card, which counts as two valid passports, and qualifying non-U.S. citizens can have a U.S. passport. |
| 28. |
U.S. Department of Transportation (DOT), Federal Highway Administration (FHWA), Office of Highway Policy Information, Policy and Governmental Affairs, "6.3.1. Licensed Drivers—Ratio of Licensed Drivers to Population," Highway Statistics Series 2023, January 2025, https://www.fhwa.dot.gov/policyinformation/statistics/2023/dl1c.cfm. |
| 29. |
DOT, FHWA, Office of Highway Policy Information, Policy and Governmental Affairs, "6.3.2. Licensed Drivers, by Sex and Percentage in Each Age Group," Highway Statistics Series 2023, January 2025, https://www.fhwa.dot.gov/policyinformation/statistics/2023/dl20.cfm. |
| 30. |
Ibid. The "under 16" group is compared with 14- and 15-year-old population estimates. Ten states are estimated to have individuals younger than sixteen with a driver's license in 2023 (see DOT, FHWA, Office of Highway Policy Information, Policy and Governmental Affairs, "6.3.3. Licensed Drivers, by State, Sex, and Age Group," Highway Statistics Series 2023, January 2025, https://www.fhwa.dot.gov/policyinformation/statistics/2023/dl22.cfm). |
| 31. |
Ibid. |
| 32. |
In 2023, the number of foreign-born individuals (excluding U.S. citizens born abroad to American parent[s]) was estimated to be 47,831,411, and the total U.S. population was estimated to be 334,914,896 (see Census Bureau's American Community Service one-year estimate at https://data.census.gov/table/ACSSE2023.K200503). |
| 33. |
UNICEF, "Birth Registration," last updated June 2025, https://data.unicef.org/topic/child-protection/birth-registration/. |
| 34. |
P.L. 109-13, Division B, Title II. For more information about REAL ID, see U.S. Department of Homeland Security (DHS), "About REAL ID," https://www.dhs.gov/real-id/about-real-id. |
| 35. |
DHS, "REAL ID Frequently Asked Questions," https://www.dhs.gov/real-id/real-id-faqs. |
| 36. |
The number of private schools is reported every other year and was not reported for the 2020-2021 school year; there were 30,492 private schools in the 2019-2020 school year. See National Center for Education Statistics, "Educational Institutions," https://nces.ed.gov/fastfacts/display.asp?id=84. |
| 37. |
In this report, a digital ID refers to an electronic version of a government-issued document. It does not include other information individuals might use to identify themselves on the internet, such as usernames or sign-in information. |
| 38. |
For more information on which states allow digital IDs to be used at TSA PreCheck, see TSA, "Participating States and Eligible Digital IDs," accessed on September 10, 2025, https://www.tsa.gov/digital-id/participating-states. |
| 39. |
For example, the California DMV Wallet can be used in certain retail locations in Sacramento (see State of California DMV, "Download California's First Mobile Driver's License Today," https://www.dmv.ca.gov/portal/ca-dmv-wallet/) and LA Wallet (see LA Wallet, "LA Wallet Origins," https://lawallet.com/about/). |
| 40. |
For example, see Utah Department of Public Safety, "Utah mDL FAQs," https://dld.utah.gov/mdlfaqs/; and Iowa Department of Transportation, "Iowa Mobile ID for Businesses, Organizations, and Agencies," https://iowadot.gov/mvd/MID-businesses. |
| 41. |
The International Organization of Standardization (ISO) and the International Electrotechnical Commission (IEC), Personal Identification – ISO-compliant Driving License – Part 5: Mobile Driving License Application, ISO/IEC 18013-5, September 2021. |
| 42. |
P.L. 116-260, Division U, Title X, §1001. |
| 43. |
TSA, "Minimum Standards for Driver's Licenses and Identification Cards Acceptable by Federal Agencies for Official Purposes; Waiver for Mobile Driver's Licenses," 89 Federal Register 85340, October 25, 2024, https://www.federalregister.gov/documents/2024/10/25/2024-23881/minimum-standards-for-drivers-licenses-and-identification-cards-acceptable-by-federal-agencies-for. |
| 44. |
American Association of Motor Vehicle Administrators, Mobile Driver's License (mDL) Implementation Guidelines, version 1.2, January 2023, https://aamva.org/getmedia/b801da7b-5584-466c-8aeb-f230cef6dda5/mDL-Implementation-Guidelines-Version-1-2_final.pdf. |
| 45. |
For example, see IDEMIA, "Mobile ID: Frequently Asked Questions," https://na.idemia.com/dmv-2/mobile-id/. |
| 46. |
When this report was published, Louisiana was the only state that explicitly stated its digital ID system can be used for online identity verification (LA Wallet, "Bring Digital Verification to Your Business," https://lawallet.com/digital-verification/). |
| 47. |
For example, see Apple, "Apple Launches the First Driver's License and State ID in Wallet with Arizona," Apple Newsroom, last updated March 23, 2022, https://www.apple.com/newsroom/2022/03/apple-launches-the-first-drivers-license-and-state-id-in-wallet-with-arizona/; and Idemia, "Mobile ID: Everything Is on Your Phone. Now Your ID Is Too," https://na.idemia.com/dmv-2/mobile-id/. |
| 48. |
Grace Broadbent, "Samsung Wallet Adds State IDs to Compete Against Apple Pay and Google Pay," eMarketer, October 11, 2023, https://content-na1.emarketer.com/samsung-wallets-adds-state-ids-compete-against-apple-pay-google-pay. |
| 49. |
For example, see Lubna Takuri, "Age Verification System: How to Verify Customer Ages," Onfido, January 24, 2023, https://onfido.com/blog/age-verification-system/; Yoti, "Age Verification Should be Just an Age," https://www.yoti.com/business/age-verification/; and Google, "Access Age-Restricted Content and Features," Google Account Help, https://support.google.com/accounts/answer/10071085?hl=en. |
| 50. |
For example, Yoti reported that the probability that its facial age estimation system correctly identified an individual age 6-11 as younger than 13 was 98.35%. The results separated by skin tone and gender indicate that, on average, the system estimated the ages of individuals 6-11 within a range of 2.2 years or less (based on mean absolute error for each year). Yoti, Yoti Facial Age Estimation, white paper, March 2023, pp. 2, 5, https://www.yoti.com/wp-content/uploads/Yoti-Age-Estimation-White-Paper-March-2023.pdf. |
| 51. |
For example, see Prachi Punyani, Rashmi Gupta, and Ashwani Kumar, "Neural Networks for Facial Age Estimation: A Survey on Recent Advances," Artificial Intelligence Review, vol. 53 (2020), pp. 3299-3347, https://doi.org/10.1007/s10462-019-09765-w; and Tzvi Ganel, Carmel Sofer, and Melvyn Goodale, "Biases in Human Perception of Facial Age Are Present and More Exaggerated in Current AI Technology," Nature: Scientific Reports, vol. 12, no. 22519 (2022), https://www.nature.com/articles/s41598-022-27009-w. |
| 52. |
CRS Report R47644, Artificial Intelligence: Overview, Recent Advances, and Considerations for the 118th Congress, by Laurie A. Harris; and CRS Report R47569, Generative Artificial Intelligence and Data Privacy: A Primer, by Ling Zhu and Laurie Harris. |
| 53. |
For example, facial age estimation using convolutional neural network (CNN) frameworks require very large datasets for training; see Zichang Tan et al., "Efficient Group-n Encoding and Decoding for Facial Age Estimation," IEEE Transactions on Pattern Analysis and Machine Intelligence, vol. 40, no. 11 (2018), pp. 2610-2623, https://doi.org/10.1109/TPAMI.2017.2779808; and Oussama Guehairia et al., "Facial Age Estimation Using Tensor Based Subspace Learning and Deep Random Forests," Information Sciences, vol. 609 (September 2022), pp. 1309-1317, https://doi.org/10.1016/j.ins.2022.07.135. |
| 54. |
For more information, see CRS Report R47298, Online Consumer Data Collection and Data Privacy, by Clare Y. Cho and Ling Zhu. |
| 55. |
For example, a discussion draft of the American Privacy Rights Act (APRA) was passed by the Subcommittee on Innovation, Data, and Commerce of the House Committee on Energy and Commerce on May 23, 2024 (markup available at https://docs.house.gov/Committee/Calendar/ByEvent.aspx?EventID=117372). For more information about APRA, see CRS Legal Sidebar LSB11161, The American Privacy Rights Act, by Chris D. Linebaugh et al. |
| 56. |
Caroline Kibby, "US State Privacy Legislation Tracker," IAPP, last updated July 7, 2025, https://iapp.org/resources/article/us-state-privacy-legislation-tracker/. |
| 57. |
For example, see Illinois General Assembly, Biometric Information Privacy Act, 740 ILCS 14/, https://www.ilga.gov/legislation/ilcs/ilcs3.asp?ActID=3004&ChapterID=57; and Washington State Legislature, Biometric Identifiers, Chapter 19.375, https://app.leg.wa.gov/RCW/default.aspx?cite=19.375. |
| 58. |
Some examples include the Kids Online Safety Act (S. 1409), Children and Teens' Online Privacy Protection Act (S. 1418), Social Media Child Protection Act (H.R. 821), Sammy's Law of 2023 (H.R. 5778), and EARN It Act of 2023 (H.R. 2732/S. 1207). |
| 59. |
For more information on potential constitutional concerns, see CRS Legal Sidebar LSB11021, Online Age Verification (Part II): Constitutional Background, by Eric N. Holmes; and CRS Legal Sidebar LSB11022, Online Age Verification (Part III): Select Constitutional Issues, by Eric N. Holmes. |
| 60. |
For example, Pornhub is no longer available in 21 states (see footnote 26). |
| 61. |
Bluesky Team, "Our Response to Mississippi's Age Assurance Law" (blog), August 22, 2025, https://bsky.social/about/blog/08-22-2025-mississippi-hb1126. For more information about the Mississippi law, see footnote 14). |
| 62. |
For example, 38% of survey respondents ages 8-12 years old stated that they had used a social media platform in 2021 (see Common Sense, The Common Sense Census: Media Use by Tweens and Teens, March 9, 2022, https://www.commonsensemedia.org/research/the-common-sense-census-media-use-by-tweens-and-teens-2021). A chart from an internal presentation at Meta Platforms indicates that the monthly active people penetration was between 20% and 60% for individuals ages 11-13 who were born between 2000 and 2004, and an internal report estimated that 4 million U.S. individuals under 13 were on Instagram in 2015 (see "Complaint for Injunctive and Other Relief," The People of the State of California et al. v. Meta Platforms, Inc., case no. 4:23-cv-05448-YGR (N.D. Cal), November 22, 2023, pp. 108-111). |
| 63. |
For example, multiple state attorneys general filed a lawsuit against Meta Platforms, Inc., for allegedly downplaying and concealing harms to minors caused by Facebook and Instagram, manipulating minors to spend more time on the platforms, and violating the Children's Online Privacy Protection Act of 1998 (COPPA). See "Complaint for Injunctive and Other Relief," The People of the State of California et al. v. Meta Platforms, Inc., case no. 4:23-cv-05448-YGR (N.D. Cal), October 24, 2023, pp. 1-4. |
| 64. |
For examples of state laws, see footnote 11. Examples of laws enacted in other countries include the U.K. Online Safety Act (Department of Science, Innovation, and Technology, "Online Safety Act: Explainer," Guidance, U.K. Government, last updated April 24, 2025, https://www.gov.uk/government/publications/online-safety-act-explainer/online-safety-act-explainer) and European Union's Digital Services Act (European Union, "Regulation (EU) 2022/2065 of the European Parliament and of the Council of 19 October 2022 on a Single Market For Digital Services and amending Directive 2000/31/EC (Digital Services Act)," October 27, 2022, https://eur-lex.europa.eu/legal-content/EN/TXT/?uri=CELEX%3A32022R2065&qid=1666857835014). |
| 65. |
The Government Accountability Office (GAO) examined six federal agencies: Centers for Medicare and Medicaid Services, General Services Administration, Internal Revenue Service, Social Security Administration, U.S. Postal Service, and Department of Veterans Affairs. GAO, Data Protection: Federal Agencies Need to Strengthen Online Identity Verification Processes, May 2019, https://www.gao.gov/assets/gao-19-288.pdf. |
| 66. |
The report specifies that congressional requesters included Senators Ron Wyden and Elizabeth Warren and Representatives Elijah E. Cummings and Jim Jordan (ibid., p. 39). Congress also requested a GAO report on consumer reporting agencies in the Economic Growth, Regulatory Relief, and Consumer Protection Act (P.L. 115-174), §308. |
| 67. |
P.L. 117-263, Division E, Title LIX, §5913; 42 U.S.C. §19222. |
| 68. |
Ibid., §(c)(1)(H)(i). |
| 69. |
Ibid., §(d)(2)(A)(i). |
| 70. |
For example, see Scott Brennen and Matt Perault, Keeping Kids Safe Online: How Should Policymakers Approach Age Verification?, The Center for Growth and Opportunity, Utah State University, June 21, 2023, https://www.thecgo.org/research/keeping-kids-safe-online-how-should-policymakers-approach-age-verification/; and Shoshana Weissmann, "The Fundamental Problems with Social Media Age-Verification Legislation," R Street Institute, May 16, 2023, https://www.rstreet.org/commentary/the-fundamental-problems-with-social-media-age-verification-legislation/. |
| 71. |
Kayee Hanaoka et al., Face Analysis Technology Evaluation: Age Estimation and Verification, National Institute of Standards and Technology Internal Report 8525, U.S. Department of Commerce, May 2024, https://doi.org/10.6028/NIST.IR.8525. |
| 72. |
Paul Grassi, Michael Garcia, and James Fenton, Digital Identity Guidelines, NIST Special Publication 800-63-3, last updated March 2, 2020, https://pages.nist.gov/800-63-3/. An initial public draft of the fourth revision is available at https://pages.nist.gov/800-63-4/. |
| 73. |
P.L. 113-283; 44 U.S.C. §§3551-3559. |
| 74. |
Federation and assertions refers to the protocol used in a federated environment to communicate authentication and attribute information, when applicable, to the party relying on this information. After the entity conducting the verification completes the authentication process, it generates an assertion containing the results to the requesting party. Ibid. |
| 75. |
Office of Management and Budget, "Memorandum for Heads of Executive Department and Agencies," May 21, 2019, https://www.whitehouse.gov/wp-content/uploads/2019/05/M-19-17.pdf. |
| 76. |
For more information about login.gov and the scrutiny it received, see CRS In Focus IF12395, Login.gov: Administration and Identity Authentication, by Dominick A. Fiorentino, Natalie R. Ortiz, and Meghan M. Stuessy. |
| 77. |
15 U.S.C. §6502. |
| 78. |
FTC, "Children's Online Privacy Protection Rule: A Six-Step Compliance Plan for Your Business," https://www.ftc.gov/business-guidance/resources/childrens-online-privacy-protection-rule-six-step-compliance-plan-your-business. |
| 79. |
Ibid. FTC, "Complying with COPPA: Frequently Asked Questions," https://www.ftc.gov/business-guidance/resources/complying-coppa-frequently-asked-questions. |
| 80. |
For a list of enforcement actions taken by the FTC, see FTC, "Cases Tagged with Children's Online Privacy Protection Act (COPPA)," https://www.ftc.gov/enforcement/cases-proceedings/terms/875. |
| 81. |
FTC, "Children's Online Privacy Protection Rule," 90 Federal Register 16918, April 22, 2025, https://www.federalregister.gov/documents/2025/04/22/2025-05904/childrens-online-privacy-protection-rule. |
| 82. |
CRS Legal Sidebar LSB11022, Online Age Verification (Part III): Select Constitutional Issues, by Eric N. Holmes. |
| 83. |
For more information about the safe harbor program, see FTC, "COPPA Safe Harbor Program," at https://www.ftc.gov/enforcement/coppa-safe-harbor-program. |
| 84. |
See the "Speech Rights of Website Operators" section in CRS Legal Sidebar LSB11022, Online Age Verification (Part III): Select Constitutional Issues, by Eric N. Holmes. |
| 85. |
Texas Legislature Online, H.B. 1181, https://capitol.texas.gov/billlookup/History.aspx?LegSess=88R&Bill=HB1181; Supreme Court of the United States, Free Speech Coalition, Inc., et al. v. Paxton, Attorney General of Texas, July 27, 2025, https://www.supremecourt.gov/opinions/24pdf/23-1122_3e04.pdf. |
| 86. |
For more information about the ruling, see CRS Legal Sidebar LSB11354, Supreme Court Upholds State Age-Verification Requirement for Certain Websites, by Victoria L. Killion. |
| 87. |
P.L. 115-174, Title II, §215; 42 U.S.C. §405b. |
| 88. |
For more information, see Social Security Administration (SSA), "Information About eCBSV," https://www.ssa.gov/dataexchange/eCBSV/. |
| 89. |
P.L. 104-208, Title IV, Subtitle A, §§401-405; 8 U.S.C. §1324a note. |
| 90. |
P.L. 104-208, Title IV, Subtitle A, §404(h)(2). |
| 91. |
For more information about E-Verify, see CRS Report R40446, Electronic Employment Eligibility Verification, by Andorra Bruno; DHS, "What Is E-Verify?," last updated June 2, 2023, https://www.e-verify.gov/about-e-verify/what-is-e-verify; and DHS, "History and Milestones," last updated May 4, 2023, https://www.e-verify.gov/about-e-verify/history-and-milestones. |
| 92. |
Financial institutions and their affiliates are subject to consumer data protection requirements under the Gramm-Leach-Bliley Act (15 U.S.C. §§6801-6809). For an overview of the Gramm-Leach-Bliley Act and other data protection laws, see CRS Report R45631, Data Protection Law: An Overview, by Stephen P. Mulligan and Chris D. Linebaugh. |
| 93. |
P.L. 107-317; 47 U.S.C. §941. |
| 94. |
NTIA, ".us Domain Space," https://www.ntia.gov/page/us-domain-space (see "2007 Contract – Modification 0012" on June 27, 2012). According to an industry publication, the number of domain name registrations was relatively low, the use of the extension was limited, and it was determined that "there are now numerous websites with high-quality content aimed at children and numerous tools available to create a safe internet space for children." Hogan Lovells International LLP, "NTIA Suspends '.kids.us' Extension," World Trademark Review Daily, September 10, 2012, https://www.hoganlovells.com/-/media/hogan-lovells/pdf/publication/parlib011219512v1worldtrademarkreviewdailydtaylor100912_pdf.pdf. |
| 95. |
For example, the SSA acquires and maintains death data from states to administer some of its programs, and Naphsis, a nonprofit organization, provides access to birth and death data from most states. For more information, see CRS Report R46640, The Social Security Administration's Death Data: In Brief, by Paul S. Davies; and Naphsis, "About Us," https://www.naphsis.org/about-us/. |
| 96. |
For more information on federalism, see CRS Report R45323, Federalism-Based Limitations on Congressional Power: An Overview, coordinated by Kevin J. Hickey. |
| 97. |
P.L. 107-252; 52 U.S.C. §§20901-21145. For more information, see CRS In Focus IF12033, The Help America Vote Act of 2002 (HAVA): An Overview, by Karen L. Shanton. |
| 98. |
The vital records division in each state has birth, death, marriage, and divorce records. Contact information for the vital records division for each state is available at Centers for Disease Control and Prevention, National Center for Health Statistics, "Where to Write for Vital Records," https://www.cdc.gov/nchs/w2w/index.htm. |
| 99. |
For example, see Google Play Help, "How to Set Up Parental Controls on Google Play," Google, https://support.google.com/googleplay/answer/1075738; and Apple, "Use Parental controls on Your Child's iPhone or iPad," May 5, 2025, https://support.apple.com/en-us/105121. |
| 100. |
Qustodio, https://www.qustodio.com/en/; and Net Nanny, https://www.netnanny.com/. |
| 101. |
Apple, Helping Protect Kids Online, February 2025, https://developer.apple.com/support/downloads/Helping-Protect-Kids-Online-2025.pdf. |
| 102. |
For example, Pinterest allows users to sign in using Facebook and Google (see Pinterest, https://www.pinterest.com/), and Airbnb allows users to sign in using their Facebook, Google, and Apple account, as well as their email address or phone number (see Airbnb, https://www.airbnb.com/). |
| 103. |
For example, Login.gov requires additional authentication methods to create an account. See General Services Administration, "Create an Account," Login.gov, https://www.login.gov/create-an-account/. Using multiple authentication methods to access a website is also known as multifactor authentication or two-step verification; for more information, see Cybersecurity and Infrastructure Security Agency, "Multi-Factor Authentication," January 5, 2022, https://www.cisa.gov/resources-tools/resources/multi-factor-authentication-mfa. |
| 104. |
Kashmir Hill, "Want Your Personal Data? Hand Over More Please," New York Times, updated October 27, 2021, https://www.nytimes.com/2020/01/15/technology/data-privacy-law-access.html. |
| 105. |
For more information, see CRS Report R47662, Defining and Regulating Online Platforms, coordinated by Clare Y. Cho. |
| 106. |
Ned Oliver, "Virginia Leads Nation in VPN Searches After PornHub Block," Axios, July 7, 2023, https://www.axios.com/local/richmond/2023/07/07/pornhub-ban-virginia-vpn. A virtual private network (VPN) is a private network that can provide users with increased privacy, such as masking the IP address of their device so that the location of the device cannot be identified. For more information, see Sheila Frankel et al., Guide to SSL VPNs: Recommendations of the National Institute of Standards and Technology, Special Publication 800-113, NIST, U.S. Department of Commerce, July 2008 pp. 6-36 and 6-37. |