Age Verification Laws by State: Rules, Penalties, and Scope

Age verification laws by state now cover roughly half the country: twenty-five states require commercial websites that host a substantial amount of sexually explicit material to confirm a visitor is at least 18 before granting access. The specifics vary, but the core template is consistent, and after a June 2025 Supreme Court ruling upholding the Texas version, the constitutional questions that once stalled these statutes are largely resolved.

Which States Require Age Verification

Twenty-five states have enacted laws requiring commercial websites with a substantial portion of adult content to verify that users are at least 18 years old. Louisiana passed the first in 2022, with adoption accelerating sharply after the Supreme Court’s 2025 decision.

2023: Louisiana, Arkansas, Mississippi, Montana, Texas, Utah, Virginia
2024: Alabama, Idaho, Indiana, Kansas, Kentucky, Nebraska, North Carolina, Oklahoma
2025: Arizona, Florida, Georgia, Missouri, North Dakota, Ohio, South Carolina, South Dakota, Tennessee, Wyoming

Most of these statutes track the Louisiana model. Louisiana’s law holds a commercial entity liable if it publishes material harmful to minors online without first performing “reasonable age verification methods” to confirm the user is 18 or older.¹ Virginia’s version requires “a commercially available database” or “another commercially reasonable method” for age and identity verification.² Texas codified its rules in Chapter 129B of the Civil Practice and Remedies Code, allowing either government-issued identification or “a commercially reasonable method that relies on public or private transactional data.”³ Mississippi’s statute mirrors Louisiana’s almost line for line, including the verification methods and data retention prohibitions.⁴

When the Law Applies

These statutes do not reach every website. They apply to commercial entities where a “substantial portion” of the content qualifies as material harmful to minors, and nearly every state defines “substantial portion” as more than one-third of the total material on a site.² That threshold keeps general-interest sites, news organizations, and platforms with incidental adult content outside the law’s reach.

“Material harmful to minors” is defined through a three-part test drawn from obscenity doctrine. Content qualifies when it appeals to a prurient interest in sex when judged by adult community standards, is patently offensive for minors, and lacks serious literary, artistic, political, or scientific value for minors.⁵

The laws bind only commercial entities, meaning businesses or individuals distributing restricted material as part of a profit-driven enterprise. Non-commercial actors and educational institutions are excluded. A university health education page or a nonprofit medical resource would not trigger verification requirements even when the content discusses sexual topics.

How Verification Works

State laws generally let a platform pick its verification method, provided the approach is commercially reasonable and reliably confirms adult age. Three categories dominate.

Government-issued identification. The user uploads or scans a driver’s license, state ID, or passport. The platform or a third-party service checks the document’s security features and reads the date of birth. Every state statute names this method.
Transactional data verification. A third-party service cross-references public or private records — credit bureau data, financial transaction history, or similar databases — to confirm the person is an adult. No ID document is submitted to the adult site itself.³
Facial age estimation. Camera-based technology estimates age from facial geometry without collecting identity documents. A handful of state frameworks recognize this as compliant, though it is less common than ID-based methods.

One practical gap: not every adult has a government photo ID or a credit history robust enough for transactional checks. A Congressional Research Service report flagged this directly, noting that restricting the available verification methods “might increase the likelihood that [operators] are unable or unwilling to determine a user’s age.”⁶ No state has mandated a specific fallback, so adults without traditional identification may find themselves blocked alongside minors.

Data Retention Rules

Because these laws require millions of adults to submit identification to access legal content, most statutes prohibit retaining that data after the check is complete. The Texas law is representative. Under Section 129B.002, neither the commercial entity nor any third-party verifier may “retain any identifying information of the individual after access has been granted to the material.” An entity that knowingly retains the data is liable for damages, court costs, and attorney’s fees.⁷ Mississippi and Louisiana include nearly identical provisions.⁴

The design goal is a bouncer-style check: confirm age at the door, then discard the record. In Texas, keeping identifying information after verification can result in fines of $10,000 per instance, separate from any penalty for failing to verify in the first place.³

Penalties and Who Can Sue

Enforcement generally falls to state attorneys general, who can bring civil actions against non-compliant platforms. Financial exposure varies significantly.

Texas has the steepest penalties: up to $10,000 per day a website operates without compliant verification, and an additional penalty of up to $250,000 if a minor actually accesses sexually explicit material because of the violation.³ Kentucky sets damages at $10,000 per instance where a platform failed to verify a minor’s age.⁸ Virginia makes non-compliant entities liable for damages resulting from a minor’s access plus attorney’s fees.²

Several states also give parents a private right of action, so families can sue without waiting for the attorney general to act. Kentucky’s statute allows a parent or guardian to bring a civil action on behalf of any minor injured by a platform’s failure to verify age, recovering $10,000 per instance plus actual damages and attorney’s fees.⁸ Arizona, Indiana, South Carolina, Tennessee, and Virginia also include a private right of action, with damage caps and procedural requirements that differ by state.

What the Supreme Court Settled in 2025

For two years, the constitutionality of these statutes was an open question, with federal challenges arguing that mandatory age verification burdened adults’ access to legal speech under the First Amendment. That uncertainty ended on June 27, 2025, when the Supreme Court decided Free Speech Coalition, Inc. v. Paxton and upheld the Texas law.

The Court held that age verification requirements trigger intermediate scrutiny rather than strict scrutiny. Because no one has a First Amendment right to access material that is obscene as to minors without proving their age, the burden on adults is “incidental” rather than direct. Applying strict scrutiny, the Court noted, “would call into question all age-verification requirements, even longstanding in-person requirements.” Under intermediate scrutiny, the Texas law survived because it “advances important governmental interests unrelated to the suppression of free speech and does not burden substantially more speech than necessary to further those interests.”³ The ruling removed the main legal obstacle that had kept several state laws in limbo, and adoption accelerated in the months that followed.

What These Laws Do Not Cover

Two boundaries are worth flagging. First, a separate line of state legislation targets social media platforms rather than adult content sites. Florida’s HB 3, effective January 1, 2025, bars social media platforms from allowing minors under 14 to hold accounts and requires parental consent for users aged 14 and 15.⁹ Florida’s administrative rules accept government-issued ID, anonymous age verification systems, or any method regularly used by businesses for identity confirmation.¹⁰ Utah has passed multiple bills addressing platform design features for minor accounts.¹¹ These regimes work differently from the adult-content laws described above and apply to different platforms.

Second, no federal age verification law has been enacted. The Kids Online Safety Act (KOSA), reintroduced as S. 1748 in the 119th Congress, was referred to the Senate Commerce Committee in May 2025 and remains pending.¹² Until Congress acts, the rules a platform must follow depend entirely on where its users are located, and the number of states with active requirements is likely to keep growing.

1
Louisiana State Legislature. Louisiana Revised Statutes 9:2800.28 – Liability for Publishers and Distributors of Material Harmful to Minors
2
Virginia Code Commission. Virginia Code 8.01-40.5 – Publishing or Distributing Material Harmful to Minors on the Internet
3
Supreme Court of the United States. Free Speech Coalition, Inc. v. Paxton, Attorney General of Texas
4
Mississippi Legislature. Mississippi HB1315 – Age Verification for Material Harmful to Minors
5
Illinois General Assembly. Illinois General Assembly HB1103 – Age Verification Requirements
6
Congressional Research Service. Identifying Minors Online
7
Texas Legislature. Texas HB 1181 – Civil Practice and Remedies Code Chapter 129B
8
Justia Law. Kentucky Revised Statutes 436.002 – Liability for Failure to Perform Age Verification to Access Matter Harmful to Minors
9
Florida Senate. Online Protections for Minors
10
Cornell Law Institute. Florida Administrative Code 2-43.002 – Social Media Use for Minors
11
Utah Senate. Protecting Utah’s Youth From Harms of Social Media
12
Congress.gov. S.1748 – Kids Online Safety Act