Calendar of US Legislation
With some 144 bills in across 43 US States introduced in 2023 which specifically attempt to protect children from various harms on the Internet, keeping track of what is required where is already a huge challenge for many online services. Even where Bills are copied from other states, there are subtle differences in the age verification requirements.
In this post, we will seek to track what is coming into force when. We are only listing laws that have been enacted with firm implementation deadlines, including any which are subject to temporary injunctions following constitutional challenges. Please note this post is intended to be informative, but should not be relied on as legal advice, nor assumed to be comprehensive. Services should be vigilant and keep up-to-date with the legal requirements applicable in the jurisdictions where they are available.
January 1 2023
Louisiana HB 142 Makes commercial websites where more than one-third of their content is pornographic liable to being sued for damages by individuals unless age verification using (1) digital ID card or (2) government-issued ID or (2) a commercial reasonable method based on transaction data (e.g. mortgage, education, employment)
May 2, 2023
Utah SB 287 Makes commercial websites where more than one-third of their content is pornographic liable to being sued for damages by individuals unless age verification using (1) government-issued ID or (2) a commercial reasonable method based on transaction data (e.g. mortgage, education, employment)
June 8 2023
Louisiana HB 77 Gives commercial websites where more than one-third of thjeir content is pornographic 30 days to remedy a failure to provide age verification before the Attorney-General can take legal action to impose a fine of $5k per day or $10k if done knowingly (the “PAVE Act”)
July 1, 2023
Mississippi SB 2346 Makes commercial websites where more than one-third of their content is pornographic liable to being sued for damages by individuals unless age verification using (1) state-approved digital ID, (2) independent, third-party age verification services checking authoritative databases or (3) a commercial reasonable method based on transaction data (e.g. mortgage, education, employment)
Virginia SB 1515 Makes commercial websites where more than one-third of their content is pornographic liable to being sued for damages by individuals unless age verification using (1) commercially available database or (2) a commercial reasonable method of age and identity verification
Florida SB 662 Restricts school technology services in their use of student data, and prevents targeted advertising
July 31, 2023
FEDERAL COURT INJUNCTION GRANTED TO STAY IMPLEMENTATION
Arkansas SB 66 Makes commercial websites where more than one-third of their content is pornographic liable to being sued for damages by individuals unless age verification using (1) state-approved digital ID, (2) government-issued ID or (3) a commercial reasonable method that holds identity assurance level 2 (for IAL2 definition, see NIST)
September 1 2023
FEDERAL COURT INJUNCTION GRANTED TO STAY IMPLEMENTATION
Texas HB 1181 – Makes commercial websites where more than one-third of their content is pornographic liable to being sued for damages by individuals unless age verification using (1) digitized ID card (not defined), or a commercial age verification system based on (2a) government-issued ID or (2b) a commercial reasonable method based on transaction data (e.g. mortgage, education, employment), and also requires sites to publish this warning:
TEXAS HEALTH AND HUMAN SERVICES WARNING: Pornography is potentially biologically addictive, is proven to harm human brain development, desensitizes brain reward circuits, increases conditioned responses, and weakens brain function.
FEDERAL COURT INJUNCTION GRANTED TO STAY IMPLEMENTATION
Arkansas SB 396 Requires parental consent before a minor can open a social media account (controlled by a company the over $100m turnover), based on age verification through (1) state-approved digital ID, (2) government-issued ID or (3) a commercial reasonable method. Social media companies may not retain personal data. Both the Attorney General, as a regulator, and private individuals can go to court to enforce this law.
January 1st 2024
Montana SB 544 Makes commercial websites where more than one-third of their content is pornographic liable to being sued for damages by individuals unless age verification using (1) digitized ID card (not defined), or a commercial age verification system based on (2a) government-issued ID or (2b) a commercial reasonable method based on transaction data (e.g. mortgage, education, employment)
North Carolina HB 8 Makes commercial websites where a substantial portion of their content is pornographic liable to being sued for damages by individuals unless age verification using (1) commercial database or (2) a commercially reasonable age verification system
March 1 2024
Utah SB 152 Requires parental consent to open a social media account, and gives parents access to a child’s account, and that the Department of Consumer Protection establishes “acceptable forms or methods of identification, which may not be limited to a valid identification card issued by a government entity.,”
Utah HB311 social media platforms liable for addiction, financial, physical, or emotional harm suffered by children under 18 as a onsequence of using or having an account.
July 1 2024
FEDERAL COURT INJUNCTION GRANTED TO STAY IMPLEMENTATION
California AB 2273 The California Age Appropriate Design Code Act is a wide-ranging Bill requiring websites likely to be accessed by children to create a timed plan to mitigate or eliminate the risk before the online service, product, or feature is accessed by children.
Florida SB 262 All online platforms that provide an online service, product, game, or feature “likely to be predominantly accessed by children.” must avoid a wide range of harms arising from physical injury, (2) economic injury, or (3) offensive intrusion into privacy, including through profiling. Processing the sensitive data of a known child requires either either consent if aged between 13 and 17 or compliance with COPPA. Data for age estimation must no tbe used for any other purpose or retained.
Louisiana SB 162 prohibits direct messaging between the account and any other user that is not linked to the account through ‘friending;’ he display of any advertising; the collection or use of personal information from the posts, content, messages, text, or usage; targeted or suggested groups, services, products, posts, accounts, or users and access to accounts between 10:30pm to 6:30am unless parents amend this
September 1 2024
Texas HB 18 Requires digital service providers to implement age verification measures if knowingly hosting “harmful” or “obscene” content. Allows parents more control over their children’s usage. A joint legislative study is required into the harms of various types of media on children
Connecticut Public Act No. 23-56 (SB 3) requires social media platforms to close accounts of those under 18 at their request or if they are under 16 also at the request of their parents; and not to process without consent (or parental consent if under 13) personal data of minors (where the platform has actual knowledge of their age or wilfully disrefards that they are minors) for the purposes of targeted ads, sale of that data or profiling for automated decision-making unless reasonably necessary to provide an online service, product or feature..
Age verification
This is the process of checking the age of an internet user, without necessarily needing to know their identity.
Age assurance
is a broader term, which includes age verification as well as methods for age estimation.
In the real world, we regularly apply age limits for a wide range of purposes
The purchase of alcohol or a knife
The use of a children’s playground
Going to the movies or into a casino
Buying adult magazines, or age-restricted films and video games
The purpose of age verification is to allow for these same limits to be applied in the digital world
Buying alcohol or knives on the internet
Socialising with other children online
Viewing age-rated videos or gambling online
Watching pornography or downloading age-rated games
In our physical lives, age checks are often done just by sight, often without the individual having to do anything at all, although sometimes the law requires evidence to be shown. Age verification aims to replicate this online as far as possible.
In particular, “AV” should usually be possible without being required also to disclose personally identifiable information – when you go into a bar, the bartender doesn’t need to know your name, just to check you are old enough to order a drink. This can be important to protect the privacy of internet users, and is particularly important when those users are children, whom we should generally discourage from disclosing their identity when they are using the worldwide web.
There are a wide range of methods of age verification, and each offers a different level of confidence or accuracy. It is good practice, and often a regulatory requirement, to select methods of age verification that achieve a “level of assurance” which is proportionate to the risk involved.