Texas HB 1181 Age Verification: Compliance Guide for Adult Sites

Texas HB 1181 is the adult-content age verification law every other US state copied, and since 27 June 2025 it is also the one the Supreme Court has blessed. If you publish adult content and have any US traffic, this is the statute to build against. Comply with Texas and you have covered most of the requirements in the 26 other states that followed, with a handful of local variations covered below.

This guide walks through what the law actually says, what the Supreme Court decided, how the penalties stack, and the architecture decision that the "may not retain" clause forces on you. It is a compliance map, not legal advice.

Quick answer

• Who: Commercial entities that knowingly publish or distribute sexual material harmful to minors on a site where more than one-third of the content is such material.
• What: Verify that each visitor is 18 or older before access, using a digital ID or a commercial age verification system that checks a government-issued ID or transactional data.
• Data rule: Neither the site nor its verifier may retain identifying information after access is granted.
• Status: In force. Upheld by the US Supreme Court in Free Speech Coalition v. Paxton (June 2025).
• Penalties: Up to $10,000 per day, $10,000 per retention instance, and up to $250,000 more if a minor gets through.
• Copied by: 26 other states, for a total of 27 with adult-site age verification laws as of September 2026.

What HB 1181 requires

The law lives in Texas Civil Practice and Remedies Code chapter 129B. Three sections do the work.

Section 129B.002 sets the duty. A commercial entity that knowingly and intentionally publishes or distributes material on a website, including a social media platform, "more than one-third of which is sexual material harmful to minors," must use reasonable age verification methods to verify that an individual attempting to access the material is 18 or older. The one-third test is measured against the site, not a page, and it is the main reason mainstream platforms with incidental adult content fall outside the law while dedicated adult sites fall squarely inside it.

Section 129B.003 defines what counts as verification. Acceptable methods are either a digital identification (a state-issued digital ID) or a commercial age verification system that verifies age using government-issued identification or a commercially reasonable method that relies on public or private transactional data. A checkbox or a "I am over 18" button is not on the list and has never been.

Section 129B.002(b) is the clause most operators underestimate. The commercial entity "or a third party that performs the required age verification" may not retain any identifying information of the individual. This applies to you and to your verification vendor. If your vendor keeps a copy of the ID, you are both exposed.

A 2025 amendment, HB 581 (effective 1 September 2025), added section 129B.002(a-1): a commercial entity that offers a publicly accessible tool for creating artificial sexual material harmful to minors must verify users are 18+ as well, unless it bans such output in its terms and takes technical steps to filter it.

The Supreme Court ruling and why it matters beyond Texas

Adult industry plaintiffs challenged HB 1181 on First Amendment grounds, arguing that age verification burdens adults' access to lawful speech and should be subject to strict scrutiny. The district court agreed and enjoined the law. The Fifth Circuit reversed, and the case reached the Supreme Court as Free Speech Coalition v. Paxton.

On 27 June 2025 the Court ruled 6-3 that intermediate scrutiny is the right standard, because the law regulates minors' access to material that is obscene for them and only incidentally burdens adults. Under that standard, HB 1181 survives: it advances an important government interest and the burden of proving one's age is not substantial enough to be unconstitutional.

The practical consequence is larger than Texas. Every pending challenge to a copycat law now runs into Paxton. On 4 November 2025 the Sixth Circuit vacated the injunction against Tennessee's Protect Tennessee Minors Act on exactly that basis. Operators who were waiting for the courts to make these laws go away should stop waiting.

Penalties and how they stack

Section 129B.006 gives the Texas Attorney General the enforcement role. The exposure is cumulative:

• Up to $10,000 per day that the site operates without compliant verification.
• Up to $10,000 per instance of retaining identifying information in violation of 129B.002(b).
• Up to $250,000 additional if, because of the failure to verify, a minor accesses covered material.
• Attorney's fees, court costs, and investigative costs on top.

The $250,000 figure gets the headlines, but the daily penalty is what makes delay expensive: a site that argues for a year while non-compliant has already built up a seven-figure theoretical exposure before any minor-access claim is added.

The 26 states that copied Texas

Louisiana actually moved first. Act 440 took effect on 1 January 2023 and gave the model its shape: the one-third threshold, the government-ID-or-transactional-data methods, and the retention ban. Texas, Utah, and Virginia followed in 2023, and the wave has not stopped.

By September 2026 the Free Speech Coalition tracker listed 27 states with adult-site age verification laws: Alabama, Arizona, Arkansas, Florida, Georgia, Idaho, Indiana, Iowa, Kansas, Kentucky, Louisiana, Mississippi, Missouri, Montana, Nebraska, North Carolina, North Dakota, Ohio, Oklahoma, South Carolina, South Dakota, Tennessee, Texas, Utah, Virginia, West Virginia, and Wyoming.

Three variations matter if you serve several of those states:

• Scope. Indiana, South Dakota, Tennessee, and Missouri apply their laws to all covered sites, not just commercial entities.
• Residency. Florida, Indiana, Kansas, Kentucky, and Wyoming apply only to residents of the state. Florida also requires you to offer visitors a choice between an anonymous method and a standard method.
• Who sues. Texas is Attorney-General-only. Louisiana, Utah, Virginia, and North Carolina let parents (and, in North Carolina, anyone whose data was retained) bring private lawsuits.

Do not confuse this lane with the social-media-minor laws from Utah, Arkansas, Florida, and Virginia, or with New York's SAFE for Kids Act and California's design code. Those target accounts, feeds, and under-18 design duties, and several are blocked in court. The adult-content laws are the ones that are in force and being enforced. The US state age verification laws hub keeps both lanes separate with current court status.

What "may not retain identifying information" means for your architecture

This is where compliance stops being a legal question and becomes a system design question. The retention ban applies to the verifier as much as to you, so the cheapest way to comply is also the safest: never take possession of the identity data in the first place.

The pattern that fits the statute looks like this:

1. Gate before content. The visitor hits your landing page, blurred preview, or paywall. No covered material is rendered until the gate clears.
2. Hand off to a verifier. The visitor completes a document check and a liveness check in the verifier's flow. The ID and the selfie are processed there, not on your servers.
3. Receive a result, not a person. The verifier returns a signed result: 18+ passed, timestamp, threshold, policy version, and an Audit ID. No name, no date of birth, no document image.
4. Store the receipt. Keep the result and Audit ID against the session or account. That is your evidence that you verified, and it contains nothing the statute forbids you to hold.
5. Let returning users back in. Bind the result to a session or a signed token so adults are not asked to re-upload an ID on every visit. Re-verify when the token expires or your policy changes.

The adult content age verification guide goes deeper on the operational side: where to place the gate, how to handle creator uploads and paid areas, and what a defensible audit record looks like. For the token mechanics, see reverification vs full verification for returning users and how an audit trail proves verification to regulators.

Conversion: the part the statute does not care about but you must

Age verification costs you traffic. Every extra step before content loses a share of visitors, and adult sites feel it more than most because the visit is impulsive and the alternative is a click away. The statute does not weigh this. You have to.

Three things keep the drop-off manageable:

• One check, many visits. The retention ban does not prohibit a signed age token or session binding. Verify once, then reuse the proof for the token's lifetime instead of forcing a fresh ID upload on every return.
• Fast flow. A document plus liveness check that completes in under a minute on a phone converts far better than a flow that asks for account creation first.
• Clear framing. Tell visitors what is checked (age, not identity), what is stored (a pass/fail receipt), and what is not (their ID). Privacy anxiety is the biggest reason adults abandon an age gate on adult content.

Why store only an age token, not IDs and faces explains the storage model behind the first two points.

Implementation checklist

• Measure whether more than one-third of your material is sexual material harmful to minors. If the answer is close, get a legal opinion; if it is obviously yes, proceed.
• Pick a verifier that uses government ID plus liveness, returns a signed 18+ result, and discards documents after the check.
• Place the gate before any covered material renders, including previews, thumbnails, and embedded players.
• Store only the result, timestamp, threshold, policy version, and Audit ID. Audit your database for stray identity fields.
• Implement a signed token or session binding for returning adults, with an expiry you can defend.
• Document the retention policy of your verifier and your own, and keep both ready for an Attorney General inquiry.
• Map your traffic by state. If you serve Florida, offer both an anonymous and a standard method. If you serve Louisiana, Utah, Virginia, or North Carolina, expect private suits as well as state action.
• Review the US state hub quarterly; court status in the social-media lane changes often, and the adult-content list keeps growing.

How AgeOnce fits

AgeOnce is built for exactly the architecture HB 1181 points toward. The visitor completes a document and liveness check in our flow; your site receives a signed 18+ result and an Audit ID, and never touches the ID or the selfie. The result can be bound to a session or token so returning adults are not re-verified on every visit. The US compliance overview summarizes all four lanes of US law on one page. Start with the demo, see the pricing, and if your site runs on WordPress, the AgeOnce WordPress plugin wires the gate into your pages without custom code.