Online age-verification tools spread across U.S. for child safety, but adults are being surveilled

The Growing Wave of Age Verification in the U.S.

From Florida to California, a patchwork of age-verification laws is sweeping across the United States, all in the name of protecting children online. But as these tools spread, a critical question emerges: are we inadvertently surveilling every adult in the process? The rush to shield minors from harmful content and social media's addictive grip is reshaping the digital landscape, and the implications for privacy and free speech are profound.

At least sixteen states have enacted laws regulating minors' access to social media, according to a recent Harvard Law Review analysis. These laws range from outright bans for under-16 users to requirements for parental consent or age estimation. Yet, the implementation is far from uniform, and the legal battles are just beginning.

State-by-State: A Complex Patchwork

Each state is taking its own approach, creating a fragmented regulatory environment. Utah's Social Media Regulation Act, signed in March 2023, requires age verification and parental consent for users under 18. Arkansas followed with its Social Media Safety Act, mandating third-party age verification for platforms earning over $100 million annually. Louisiana's Secure Online Child Interaction and Age Limitation Act goes further, prohibiting under-16s from messaging adults unless already connected.

California, often a trendsetter, has enacted multiple laws. The Age-Appropriate Design Code Act (AB 2273) requires sites likely used by minors to estimate ages, while the Digital Age Assurance Act, signed in October 2025, mandates operating systems to categorize users into four age brackets. Meanwhile, the Protecting Our Kids from Social Media Addiction Act, effective January 2025, restricts addictive feeds and notification times for minors without parental consent.

Other states like Mississippi, Nebraska, and Tennessee have imposed similar verification and consent requirements, but with varying enforcement mechanisms. Some allow private lawsuits, while others delegate authority to state attorneys general, creating a legal maze for platforms and users alike.

How Age Verification Works: Methods and Friction

The technologies behind these laws are evolving, with four primary methods emerging, as outlined by ISO/IEC 27566-1:2025. Self-declaration, once the norm, is no longer considered sufficient by any regulatory framework. Document verification, such as government IDs, is mandatory in Malaysia and an option in France, but it's high-friction and raises privacy red flags. Live image age estimation, using real-time selfies, is low-friction and preferred by minors, but it relies on biometric data. Reusable digital identity, using zero-knowledge proofs, offers privacy but is still in pilot stages.

In the U.S., states vary in their chosen methods. Arkansas and Tennessee require third-party verification with government IDs, while California's laws allow for age estimation with a 'reasonable level of certainty.' The friction for adults is significant: they must submit to ID scans or facial recognition to access platforms they've used for years, creating a chilling effect on speech and assembly.

Biometric Risks and Data Breaches

Critics warn that these tools increase data exposure. Many sites transmit or store government IDs and biometric photos insecurely, without encryption. This not only puts adults at risk of identity theft but also undermines the safety of children, whose data becomes a treasure trove for hackers. The Electronic Frontier Foundation and other advocates have filed lawsuits, arguing that these laws violate the First Amendment by chilling anonymous speech and imposing undue burdens on users.

Legal Challenges and the First Amendment

The courts are pushing back. In a landmark trend, district courts have almost uniformly enjoined state age-verification laws for likely violating the First Amendment. Justice Kavanaugh, in a recent concurrence, called Mississippi's law 'likely unconstitutional.' The Harvard Law Review notes that all but one district court addressing these laws has found them content-based, triggering strict scrutiny. For example, a federal court blocked Arkansas's law in 2023, and Utah's law has also been temporarily stayed.

These rulings highlight a fundamental tension: while protecting children is a compelling interest, the methods must be narrowly tailored. Age verification, as currently designed, often sweeps in adults, reducing online anonymity and cutting off access for those without IDs or smartphones. The Supreme Court's involvement seems inevitable, with cases like NetChoice v. Griffin already making their way through the lower courts.

What This Means for Adult Privacy and Free Speech

The unintended consequence is that adults are now being surveilled. Every time you log into Facebook or Instagram, you may be asked to verify your age, submitting sensitive data that can be breached or misused. This creates a chilling effect: users may self-censor to avoid scrutiny, or abandon platforms altogether. The 4.7 million underage deactivations in Australia show the scale, but in the U.S., millions of adults are also caught in the net.

Moreover, these laws force platforms to collect and store data they otherwise wouldn't, making them targets for hackers. The risk is particularly acute for domestic violence survivors, LGBTQ+ individuals, and others who rely on anonymity for safety. As states race to pass new laws, the balance between child safety and adult rights is tipping dangerously.

Innovative Solutions: Balancing Safety and Liberty

The path forward isn't to abandon age verification, but to innovate responsibly. Encouragingly, new technologies offer hope. Reusable digital identities with zero-knowledge proofs, currently piloted by the EU, allow users to prove they're over 18 without revealing their exact age or identity. This could satisfy regulators while preserving privacy. Additionally, age estimation based on behavioral patterns, rather than biometric scans, offers a less intrusive alternative. The result is a framework that effectively protects minors without putting every adult under surveillance. As the U.S. navigates this complex terrain, the message is clear: we must embrace child safety, but not at the cost of our rights. The true innovation lies in crafting solutions that achieve both.