Age-Verification Laws by State: A 2026 Privacy Tracker

More than half of US states now require some form of age verification to reach adult content, and a growing number are extending the idea to social media. The mechanism is usually a government ID upload, a third-party check against transactional or public records, or (in the newest laws) a device or operating-system age signal. This guide maps who requires what, the court decision that cleared the path, and why privacy advocates treat age verification as a surveillance system.

Adult-Content Age-Verification Laws

These laws generally apply to sites where more than roughly a third of the content is "material harmful to minors." Louisiana was first, in 2023; the list below is drawn from the Age Verification Providers Association tracker and corroborated against state and news sources.

A common point of confusion: Arkansas has two separate laws. Act 612 (the adult-content law above) is in force. Its separate social media parental-consent law, Act 689, was blocked by a federal judge in 2023 and should not be conflated with it.

Social Media and Minors: A Moving Target

Laws aimed at minors on social media are far more contested, and the map splits three ways: in force, enjoined by a court, and not yet effective. As of mid-2026, laws at least partly in effect include Florida's HB 3 (its under-14 ban was itself enjoined), Mississippi's HB 1126, Tennessee's HB 1891, and New York's SAFE for Kids Act. California's Digital Age Assurance Act (AB 1043) requires device-level age signals starting in 2027. Meanwhile, social-media laws in Arkansas, Utah, Ohio, Texas (the SCOPE Act), and Louisiana have been blocked or permanently enjoined, mostly on First Amendment grounds under the Moody v. NetChoice framework. Because this category changes monthly, the EFF's age-verification coverage and the AVPA tracker are better live references than any static list.

The Federal Picture

There is no federal age-verification mandate in law yet. The Kids Online Safety Act (KOSA) passed the Senate in 2024 but died in the House. On June 29, 2026, the House passed a broader package, the KIDS Act (H.R. 7757), 267-117. As the EFF explains, the House version drops KOSA's "duty of care" standard and instead leans hard on age verification, requiring platforms to judge whether a user is "more likely than not" a minor for explicit content and to act when they "know or should have known" a user is underage. EFF warns that this negligence standard would push platforms toward ID or passport checks, or facial and behavioral age-estimation, for all users. The bill's Senate path is uncertain.

The Supreme Court Cleared the Path

On June 27, 2025, in Free Speech Coalition v. Paxton, the Supreme Court upheld Texas's HB 1181 by a 6-3 vote. Writing for the majority, Justice Thomas held that the law "triggers, and survives, review under intermediate scrutiny because it only incidentally burdens the protected speech of adults," rejecting both a lower rational-basis standard and the challengers' call for strict scrutiny. In dissent, Justice Kagan (joined by Justices Sotomayor and Jackson) argued strict scrutiny should apply, since the law conditions adult access to protected speech on surrendering anonymity. As legal analysts at Faegre Drinker noted, the ruling substantially de-risks the roughly two dozen similar adult-content laws from First Amendment challenge. It does not resolve the separate fight over social-media laws.

Why Advocates Call It Surveillance

The privacy objection is not abstract. Per the EFF, the most invasive common method pairs a government ID photo with a live selfie match, and even where a law bans retention, a user has no way to verify their data was actually deleted. The risk is concrete: in June 2024, the identity-verification vendor AU10TIX left login credentials exposed online for over a year, exposing names, dates of birth, nationalities, ID numbers, and ID images. EFF argues age verification is fundamentally incompatible with the anonymity that domestic-abuse survivors, journalists, and activists rely on, that facial age-estimation misjudges age based on skin tone, gender, and disability, and that the systems are trivially bypassed by determined minors while leaving a durable privacy burden on every compliant adult, a "less private internet for everyone."

Around the World

The US is not alone. The UK's Online Safety Act required "highly effective age assurance" for pornography and self-harm content by July 25, 2025, enforced by Ofcom. The EU is piloting a white-label age-verification app tied to its Digital Identity Wallets, using zero-knowledge proofs so a site receives only an "over 18" signal, not underlying ID. And Australia's Social Media Minimum Age law took effect December 10, 2025, requiring platforms to take "reasonable steps" to block under-16 accounts, with parental consent not overriding the ban and fines up to AUD $50 million.

Related reading: how to find and avoid Flock ALPR cameras, the federal car-surveillance mandate, or the full guides hub.