US age assurance enters implementation phase as courts, lawmakers refine rules

The debate over whether platforms should verify users’ ages is largely over in the United States. Legislatures, regulators and courts increasingly accept that platforms have a responsibility to prevent children from accessing age-restricted content. Meta’s recent settlement, which includes specifics on age assurance tech, marks yet another step away from arguing over age checks toward arguing how to implement them. Who verifies age, what technologies are acceptable, where responsibility sits and how those requirements can survive judicial scrutiny: these are the questions now occupying U.S. legislators.

They will not have simple answers. Although the basic idea is clear – make it harder for kids to access harmful content online – the details of age assurance in practice have proven to be a dense thicket of privacy concerns, lawsuits and liability traded around like a handful of unruly scorpions. As is often the case in the U.S., the final shape of policy will depend on which state is making it, and the risk of patchwork legislation is real. But bigger shifts are shaping local debates, and some clear policy directions are emerging.

California grants age check exemption to open source platforms

California has passed Assembly Bill 1856, exempting open-source operating systems from the State’s Digital Age Assurance Act. This aims to put to rest confusion over whether Linux distributions and SteamOS would be forced to collect user age data during account setup.

The Digital Age Assurance Act places the responsibility for collecting age data on the device provider and app store operator, by requiring operating systems to ask for a date of birth when a user registers a device. The OS then shares an age signal (typically in the form of an age range or bracket) with sites and platforms, who are expected to adjust their content and services to be age-appropriate for particular age bands.

The new rule exempts any entity that distributes an OS or application “under license terms that permit a recipient to copy, redistribute, and modify the software.” That encompasses software distributed under the GPL, MIT, BSD, and Apache licenses.

In addition to distinguishing open source systems from their cousins iOS, Android and Windows, the bill includes some fine detailing over language and an interesting provision prohibiting any entity from requesting an age signal from an OS provider or app store unless required by law. Commentary in Tom’s Hardware says that “closes off potential abuse of the age API that could have led to it being used as a general-purpose data collection channel even when age verification wasn’t required.”

Per the bl0g, Windows, macOS, iOS, and Android remain fully in scope, with age collection required at account setup from January 1, 2027. Meanwhile, AB 1856 is now awaiting the signature of Governor Gavin Newsom.

Missouri law imposing age checks on porn sites takes effect

Missouri’s age verification law for online pornography is now in effect. According to a post on Wet Ink, House Bill 1839 requires creators and platforms comply with the regulations by implementing age checks that verify age through a third-party service using a government-issued ID, digital ID, or by cross-checking personal transactional records.

Alternatively, they can geoblock access in Missouri. The company Aylo, which operates some of the world’s largest porn sites, has opted for that route in Missouri and elsewhere; Pornhub is now blocked in 25 states.

Missouri’s law requires proof that a user is at least 18 years of age, and applies to any site on which more than one third of the content could be considered sexually explicit and potentially harmful to minors. It imposes noncompliance penalties of $10,000 per day, an additional $10,000 per “instance of improperly retained user data,” and up to $250,000 if a minor gains access to restricted material. There are exemptions for internet service providers, search engines, and cloud service providers.

It also addresses Aylo’s stated concern that biometric age verification opens the door for the risk of data breaches and creates a risk for identity theft. Under Missouri’s law, third-party age verification providers are barred from retaining identifying user data.

Regardless, as online safety laws take effect across the states, Pornhuib continues to bow out, suggesting that  age verification measures could indeed be an existential threat to its continued dominance in the smut market.

NetChoice wins right to keep suing in Tennessee

In the wake of the Supreme Court’s decision in the Texas case of Paxton v. Free Speech Coalition, adult content sites have had a tougher time arguing their case. Social media companies, on the other hand, continue to succeed in pushing back against age assurance requirements through their litigatory engine, the industry association NetChoice.

An announcement from the organization celebrates a recent win in Tennessee, where the U.S. Court of Appeals for the Sixth Circuit vacated a lower court’s denial of NetChoice’s request for a preliminary injunction, thereby keeping the case alive.

Paul Taske, director of the NetChoice Litigation Center, says “Tennesseans should not be forced to hand over their private information simply to access news, watch videos, connect with friends or engage in lawful speech online.”

NetChoice says the court “recognized that the threat of enforcement can itself chill First Amendment rights and that businesses can suffer irreparable harm from unrecoverable costs required to comply with a law they are challenging as unconstitutional.”

The memes they are a-changin’: social media faces paradigm shift

Social media is in the midst of a reckoning. Meta has agreed to pay out $18 billion to settle lawsuits from 29 states and conceded to put legally enforceable safeguards in place to better protect young users. However, if it has the First Amendment to lean on, it will continue to have the legal leverage to challenge laws it does not like.

Digital rights groups such as the Electronic Frontier Foundation have found themselves on the side of the social media giants in positioning age checks as a threat to privacy and free speech. Courts will ultimately decide the constitutionality of age assurance laws. But in the meantime, it would be wise for non-profits and privacy advocates to align with progressive government policies, such as Australia’s. Framing the argument in terms of the First Amendment mislocates the crux of the problem – which, ultimately, is that Meta and its cohort only ever cares about its users when they are forced to.

Global sentiment is beginning to reflect exhaustion with the power these companies have been able to accrue. Australia is pursuing a model rooted in a digital duty of care, which shifts the focus away from prohibition for users and toward greater accountability for social media companies. This will have a harder time taking hold in the U.S., where the Constitution is an object of national mythmaking and private enterprise tends to get freer reign.

But the regulatory winds are clearly blowing in one direction. Both social media and online pornography have enjoyed a golden age, in which they have ridden the currents of an unregulated internet to massive revenue. The specifics will be grappled over for years. But even in the U.S., the societal verdict is in: the free ride is over, and age checks are likely to be the first of many tools lawmakers use to put on the brakes.

While U.S. courts refine the rules, Roblox and Meta are already making concessions to governments across Asia on age assurance and child safety.  

Article Topics

age verification  |  California  |  legislation  |  Missouri  |  Netchoice  |  social media  |  Tennessee  |  United States