For almost as long as the internet has existed, journalists and lawmakers have sounded alarms over children's ability to access harmful material online. The targeted material has expanded over the years, with pornography being a primary focus in the 1990s and social media content receiving attention in the 2020s. One legislative response that has been particularly popular over the decades involves enacting laws that require or encourage website operators to ascertain the ages of their websites' users before letting them access content. Some Members of the 118th Congress have introduced bills requiring or encouraging age verification in certain contexts, and several states have passed laws mandating that some website operators take various steps to learn the ages of their users.
As discussed in this CRS Insight, determining an individual's age online can present practical difficulties. This three-part Legal Sidebar discusses constitutional concerns with requiring age verification procedures through legislation, using recently enacted state age verification laws and several introduced federal bills as examples. Part I provides an overview of the current online age verification landscape by describing the provisions of enacted state laws and proposed federal laws. Part II provides an overview of the Free Speech Clause of the First Amendment and its historic relationship to online age verification legislation. Part III discusses concerns with age verification laws posed by the Free Speech Clause of the First Amendment.
Overview of Age Verification Laws
Laws requiring age verification have been proposed throughout the internet's lifetime, though the approach has seen renewed interest in the past several years. Following reports of social media's negative impact on teens' mental health, many states introduced legislation aimed at social media specifically. States may also have taken cues from the United Kingdom, which implemented its Age-Appropriate Design Code for online services—also known as the Children's Code—in 2020. California enacted a similar piece of legislation, the California Age-Appropriate Design Code (CAADC), in 2022.
"Age Verification" Terminology
While the goal of many pieces of proposed and enacted legislation is similar—to ensure that users of particular online services are above a certain age—the language used varies. The CAADC uses the phrase "age assurance," while some federal bills use the phrase "age verification." There are no universally recognized legal definitions for these various terms. In an opinion written to assist with compliance with the UK Children's Code, the Information Commissioner's Office for the United Kingdom describes "age assurance" as an umbrella term to cover both age verification—"determining a person's age with a high level of certainty"—and age estimation. The CAADC appears to use "age assurance" to require "estimat[ing] the age of child users with a reasonable level of certainty appropriate to the risks" posed from collecting estimation data. Bills introduced in the 118th Congress, such as the Kids Online Safety Act, appear to use "age verification" to refer broadly to systems that may determine age without any specified degree of certainty, similar to the use of "age assurance" in the United Kingdom. Because the use of these terms is not uniform, understanding how various state laws and proposed bills may apply requires reference to the specific requirements they contain, not just the terms used. This sidebar uses the term "age verification" to refer generally to methods for estimating or determining a user's age with varying levels of certainty.
Targeted Businesses
Age verification laws frequently target two types of businesses: (1) businesses that provide material that is intended for or likely to be accessed by individuals under the age of 18 (minors) or a younger cohort of minors such as individuals under the age of 16, and (2) businesses that provide material that is "harmful" to minors but may not be intended for their use.
The first of these categories includes laws that target specific businesses or content types—for example, social media—as well as more generally applicable laws. The CAADC applies to "a business that provides an online service, product, or feature likely to be accessed by" minors. Utah's Social Media Regulation Act applies to "social media platforms."
The second category of age verification laws is frequently aimed at websites that provide pornography. A law from Louisiana that applies to "commercial entities who distribute material harmful to minors" discusses at length the impact of pornography on minors. Louisiana restricts application of its law to entities operating websites that contain "a substantial portion" of material harmful to minors, which the law defines as "more than thirty-three and one-third percent"—that is, more than one-third—of "total material on a website." Laws passed in Mississippi, Utah, and Virginia use similar language for both the covered material and the "substantial portion" threshold.
These two approaches are not mutually exclusive. Louisiana has enacted laws requiring age verification for both social media companies and pornography providers, and Utah has two such laws as well.
Required Actions
Laws vary in terms of what steps businesses must take to verify ages. Louisiana's pornography age verification law allows businesses to use a "digitized identification card" or a commercial age verification system that relies on government-issued identification or "public or private transactional data." Utah's pornography law allows for similar age verification procedures, but also allows businesses to rely on third-party services that compare information provided by the individual to commercially available data "that is regularly used by government agencies and businesses for the purpose of age and identity verification." Arkansas's Social Media Safety Act requires businesses to employ third-party vendors to perform "reasonable age verification," which the law defines to include digitized identification cards, any government-issued identification, or "any commercially reasonable age verification method." Virginia's law requires that regulated entities engage in "commercially reasonable method[s] of age and identity verification." California's CAADC provides only that businesses must "estimate the age of child users with a reasonable level of certainty appropriate to the risks." Louisiana's social media law uses similar language.
Federal proposals vary in terms of what actions they would require. The Protecting Kids on Social Media Act would require social media platforms to take "reasonable steps . . . taking into account existing age verification technologies" to verify the ages of users. The Kids Online Safety Act would not require any websites to age verify users, but because the bill would obligate websites to extend certain protections to minors, critics of the bill have argued that it would in practice "force" platforms to age verify.
Enforcement Mechanisms
State age verification laws allow for enforcement either by state officials or by private parties, such as the parents of a minor. Louisiana's pornography age verification law allows individuals to bring lawsuits against commercial entities who fail to implement age verification when such a failure results in a minor accessing harmful material. A second Louisiana law allows the Louisiana attorney general to seek civil penalties for violations of the pornography age verification law. Other states with pornography age verification laws have chosen to allow for one of these enforcement methods but not the other. Texas's attorney general has sole enforcement authority over the state's pornography age verification law, and Virginia's and Utah's pornography age verification laws provide only for enforcement by individuals.
Social media age verification laws, along with the CAADC, also take various enforcement approaches. The laws of Utah and Louisiana place "exclusive authority" to enforce the law in state law enforcement, and the CAADC explicitly provides that the law shall not serve as the basis for a lawsuit brought by an individual. Arkansas's social media age verification law allows for private enforcement and is the only state law that provides for criminal liability for knowing and willful violations.
How a law is enforced may impact individuals' ability to challenge a law's constitutionality. Individuals may challenge the constitutionality of a state law prior to enforcement of the law by instituting a legal action against a state official that enforces the law. As discussed in this Legal Sidebar, the Supreme Court has disallowed individuals from bringing such actions when a state law is enforced solely by private parties. A federal district court in Utah dismissed a challenge to Utah's pornography age verification law on these grounds.
Imposing penalties for failing to implement age verification may discourage website operators from hosting particular material—or, if the costs of implementing age verification are sufficiently high, from hosting material altogether. The Supreme Court has voiced concerns with laws that impose burdens on adult communication in the name of protecting minors. The second installment of this three-part Sidebar discusses the Free Speech Clause of the First Amendment and how courts have applied the Clause to online age verification in the past.