Online age verification requirements in US legislation raise thorny problems

More than a dozen bills have been introduced in the current U.S. Congress that, if enacted, would increase protections for minors online by requiring website operators to use biometric or other personally identifiable information (PII) to verify a person’s age.

Such a requirement, however, would likely come up against a variety of constitutional and other legal challenges, wrote Clare Cho, a specialist in industrial organization and business policy at the U.S. Congressional Research Service (CRS), in a June report for Congress, Identifying Minors Online.

While many states have done so, there presently is no U.S. federal law that explicitly requires website operators to determine the age of their users, and U.S. federal judiciary rulings remain unclear as to whether they would survive a constitutional or some other legal challenge.

The U.S. Supreme Court has heard several cases involving federal laws designed to protect minors online that involved issues related to age verification which played major roles in the high court’s decisions. But the court has not definitively ruled on the constitutionality of age verification per se, or the specific way age verification is performed. In Ashcroft v. American Civil Liberties Union (2004), which dealt with the constitutionality of the Child Online Protection Act, the court “left open the possibility of regulating modes of communications technology as modes of technology, irrespective of whatever speech happens to be disseminated therein,” the Ethics and Public Policy Center said.

In Reno v. ACLU (1997), the court struck down the statutory provisions of the Communications Decency Act (CDA) that required the use of age verification software as an unconstitutional content-based blanket restriction on speech, saying that “in order to deny minors access to potentially harmful speech, the CDA effectively suppresses a large amount of speech that adults have a constitutional right to receive and address to one another.”

Earlier this month, the U.S. Supreme Court agreed to hear a challenge in October to the Texas law that requires pornographic websites to verify the age of their users, which followed a petition for certiorari challenging the 5th U.S. Circuit Court of Appeals’ ruling that Texas’ law does not violate the First Amendment.

Last week, following a Nebraska law taking effect that requires online porn companies to verify users’ ages by uploading ID cards or other age-identifying documents, Pornhub and its affiliates blocked access to their sites in the state.

The ramifications of how the U.S. Supreme Court may ultimately rule on the very narrow and specific issue of the constitutionality of online age requirements and how such is technically administered are enormous … and potentially fraught with even more legal landmines.

Fifty-eight bills requiring the use of age verification were introduced in states in 2023 and 2024, 12 of which became law. Altogether, 18 states have passed age verification laws: Alabama, Arkansas, Florida, Georgia, Idaho, Indiana, Kansas, Louisiana, Mississippi, Montana, Nebraska, North Carolina, Oklahoma, South Carolina, Tennessee, Texas, Utah, and Virginia. All except Alabama, Georgia, Florida, Idaho, Kansas, Nebraska, Oklahoma, South Carolina, and Tennessee have enacted their laws. Indiana enacted its law, but courts blocked it from taking effect following a preliminary injunction on June 28.

Most of these states’ laws appear to get around Reno v. ACLU by requiring the use of commercial age verification systems that check a user’s government identification or “public or private transactional data” to confirm a user’s age, and not on the technology, or software, used to do so.

A 2023 CRS report had pointed out that “age verification laws may unconstitutionally burden the free speech rights of website operators or users in violation of the Free Speech Clause of the First Amendment.”

The report further noted that “laws that include an age verification element frequently require age verification in conjunction with other obligations,” and that these “other obligations … may [also] pose separate constitutional issues,” including potential unintended privacy and civil rights issues.

The Kids off Social Media Act (S 4213), for instance, would require social media platforms to prohibit persons from creating or maintaining an account or profile if it knows that the individual is a child, but conversely would prohibit these same platforms from implementing “an age gating or age verification functionality.” And that clearly would put online platforms in a quandary as to how they would meet the bill’s burden of identifying users’ ages.

Indeed. As Cho emphasized in her report, in lieu of mandated “age verification methods,” social media and other website operators might respond by implementing changes for all users; implementing changes for individuals identified as minors, potentially using one of the methods that some websites currently use to verify age; stop offering certain services; or cease providing services altogether in the United States.

As has already been the case, in response to federal or state legislation, “website operators have developed various methods to determine users’ ages,” Cho wrote, saying that “some commonly used methods include relying on self-identification, such as requiring a user to provide their date of birth or check a box to indicate the user is of a certain age; requesting documentation, such as a photo identification or a digitized driver’s license containing the user’s name and age; and using consumer data, such as analyzing user content posted on the website or an image of the user’s face.”

And “each of these age verification methods presents different advantages and challenges,” Cho added. “For example, everyone can provide a date of birth, but a website operator cannot verify that information without additional data or documentation. A website operator that receives a user’s government-issued photo ID might be assured that the individual meets a minimum age requirement, but not everyone has a government-issued photo ID. This might also raise consumer data privacy concerns, depending on how the information is shared and stored.”

Still other online businesses “might develop and implement new age verification methods in response to public scrutiny, lawsuits, and laws enacted by states and other countries.”

“The reality is that companies will take the path of least resistance and will be incentivized to implement age gating and/or age verification, which we’ve raised concerns about many times over,” said the Electronic Frontier Foundation’s Sophia Cope, Aaron Mackey, and Jason Kelley. “This bait-and-switch tactic is not new in bills that aim to protect young people online. Legislators, aware that age verification requirements will likely be struck down, are explicit that the bills do not require age verification. Then, they write a requirement that would lead most companies to implement age verification or else face liability.”

It’s a Catch-22, as is reflected by the hodgepodge of proposed legislation that’s all over the map, and any one of which, if it were to become law, would present any number of Constitutional, privacy, and civil rights and liberties challenges.

Take the Social Media Child Protection Act (HR 821), for instance. It undoubtedly would spark backlash to its requirement that the providers of social media platforms block children from accessing such websites by mandating verification of a user’s age using “a valid identity document issued by the federal government or a state or local government, such as a birth certificate, driver’s license, or passport; or … another reasonable method of verification (taking into consideration available technology).”

Other legislation aimed at protecting minors online also would require social media and other online content providers to use some form of official government-issued identification.

Still other proposed legislation would create other sorts of headaches, like the far more intrusive age-verification processes that would be mandated by the Protecting Kids on Social Media Act (HR 6149 and S 1291).

These companion bills would require social media platforms to “take reasonable steps beyond merely requiring attestation of one’s age – taking into account existing age verification technologies – to verify the age of individuals who are account holders on the platform.”

But to do that, the verification that these two bills call for would require “a secure digital identification credential” that would be provided by the federal government to “individuals who are citizens and lawful residents of the United States.”

Under the legislation, a pilot program would be administered by the U.S. Department of Commerce which would require any individual who wanted to access social media sites to have to verify their age — or their parent or guardian relationship — by first uploading copies of government-issued and other forms of identification (such as records issued by an educational institution), or by validating the authenticity of identity information provided by the individual using electronic records of state departments of motor vehicles, the U.S. Internal Revenue Service, the U.S. Social Security Administration, state agencies responsible for vital records, or other governmental or professional records providers that the Secretary of Commerce determines are able to reliably assist in the verification of identity information.

Under this program, individuals would have to “obtain a secure digital identification credential [to] use to verify their age or parent or guardian relationship with enrolled social media platforms.” Users would have control over what information they choose to allow the pilot program to share with a social media platform.

The obvious and glaring problem with this proposal is that it’s almost certain to be opposed by civil liberties organizations because of the big brother nature of giving the government the authority to require and issue “digital identification credentials” to U.S. citizens and lawful residents in order to access social media, and, potentially, any other online media which provides content that’s restricted from being accessed by, or is otherwise inappropriate for minors.

Cho said Congress needs to consider “who should be responsible for determining an individual’s age online; how would legislation on age verification be implemented and what are the potential effects; and how an entity conducting age verification online can confirm that individuals are who they claim to be.”

While a few states have passed laws creating requirements for websites that provide material intended for or likely to be accessed by minors, and for websites that provide material that is deemed harmful to minors, “courts have ruled that some of these state laws likely violate the First Amendment,” Cho explained. “In addition, some federal laws seeking to protect minors online have been deemed unconstitutional under the First Amendment by federal courts.”

Cho said website operators’ responses to legislation prohibiting or requiring certain age verification methods would likely depend on the number of options specified and the legislative language that’s used. For example, if legislation requires that website operators use an age verification method other than a user’s attestation, operators would have several methods to choose from. Similarly, certain terminology – such as requiring a ‘reasonable method of verification’ – might be subject to interpretation and potentially result in a wide range of methods used.

Any way its sliced, there are bound to be problems. “Allowing website operators to use various age verification methods might result in different levels of assurance, privacy risks, and other trade-offs,” Cho said.

“However, if legislation restricts operators to a limited number of age verification methods, it might increase the likelihood that operators are unable or unwilling to determine users’ ages, particularly if the types of age verification methods allowed are costly and difficult to implement,” Cho explained.

Additionally, it might also increase the likelihood that website operators just simply stop offering their services or take actions that make constitutional challenges more likely.

Cho highlighted some of the overarching issues she said Congress ought to address when considering legislating age verification. They are:

• Who should be responsible for determining an individual’s age online?
• How would legislation on age verification be implemented, and what are the potential effects?
• How can an entity conducting age verification online confirm that individuals are who they claim to be?
• Whether requirements for website operators should address only minors.
• Whether the legislation would apply to all websites or a subset.
• The feasibility of enforcing legislation, and
• What are the potential unintended effects.

Other proposed legislation pending before both U.S. House and Senate committees are the:

Verifying Kids’ Online Privacy Act (HR 7534);

Kids Online Safety Act (S 1409 and HR 7891);

Kids PRIVACY Act (HR 2801);

Children and Teens’ Online Privacy Protection Act (S 1418 and HR 7890);

Child Online Safety Modernization Act (HR 5182);

Protecting Young Minds Online Act (HR 3164);

Curbing Online Non-consensual Sexually Explicit Nudity Transfers Act (HR 7736);

Sammy’s Law (HR 5778);

EARN It Act (S 1207); and,

Eliminating Abusive and Rampant Neglect of Interactive Technologies Act (HR 2732)

Article Topics

age verification  |  biometrics  |  data privacy  |  digital identity  |  face biometrics  |  Kids Online Safety Act (KOSA)  |  legislation  |  social media  |  United States