US age verification compliance without becoming an ID database
Twenty-seven states now require adult sites to verify visitors are 18+, the Supreme Court has upheld the model, and most of those laws forbid you from keeping the ID. AgeOnce verifies with a government ID and liveness, returns a signed result and Audit ID, and retains nothing that identifies the visitor.
27 states
As of September 2026. Most forbid retaining identifying information.
Texas HB 1181 upheld by the Supreme Court, 27 June 2025
NY SAFE for Kids in effect 25 January 2027
California app-store age signals from 1 January 2027
US age verification in October 2026
What is in force now
Adult-content age verification in 27 states, led by Texas, Louisiana, Tennessee, Utah, Virginia, and Florida. Florida is also enforcing its under-14 social media ban while the appeal runs.
What is coming
New York SAFE for Kids (25 January 2027), California AB 1043 app-store age signals (1 January 2027), Colorado SB 26-051 (1 July 2028).
What is blocked
Arkansas Act 689 (permanently, on appeal), Virginia SB 854 and Utah's social media act (preliminary injunctions). Comply with what is in force; watch the rest.
The design the statutes expect
Verify 18+ or 21+ with a government ID before access, store a signed result and Audit ID, retain no identifying information. That is both the Texas rule and the lowest-risk architecture.
Four lanes, four very different risk levels
US age verification is not one law. Adult-content statutes are in force and court-tested; social-media rules are split by circuit; app-store signals arrive in 2027; restricted-goods rules are federal. Find your lane first.
Adult content: 18+ before access
Texas HB 1181 and 26 copycat states. One-third content test, government ID or transactional-data method, retention ban. Upheld by SCOTUS.
Social media for minors
Florida HB 3 (enforceable), Utah and Virginia (enjoined), Arkansas (struck down). New York SAFE for Kids targets feeds and notifications from January 2027.
App-store and OS age signals
California AB 1043 (January 2027) and Colorado SB 26-051 (July 2028) make operating systems expose an age bracket that app developers must request.
Restricted goods: vape, tobacco, alcohol
Federal Tobacco 21 and the PACT Act for remote vape sales (database verification, adult signature, ATF registration). Alcohol shipping is state by state at 21.
How the US got here, and what is next
From Louisiana's first statute to the Supreme Court ruling, and on to the 2027 and 2028 start dates for New York, California, and Colorado.
- 1 Jan 20231 Jan 2023
Louisiana Act 440 takes effect
The first adult-content age verification law and the template every other state copied.
- 27 Jun 202527 Jun 2025
Supreme Court upholds Texas HB 1181
Free Speech Coalition v. Paxton, 6-3. Intermediate scrutiny; 18+ checks on adult content are constitutional.
- Nov 2025Nov 2025
Tennessee and Florida move forward
Sixth Circuit vacates the Tennessee injunction (4 Nov). Eleventh Circuit stays the Florida HB 3 injunction (25 Nov); enforcement begins.
- 1 Jan 20271 Jan 2027
California AB 1043 operative
Operating systems collect age at setup and expose an age-bracket signal; app developers must request it.
- 25 Jan 202725 Jan 2027
New York SAFE for Kids in effect
Final rules released 28 July 2026. Age determination before algorithmic feeds or overnight notifications to under-18s.
- 1 Jul 20281 Jul 2028
Colorado SB 26-051 in effect
OS and app-store age signals; up to $2,500 per affected minor for negligent violations.
An "I am 18" button is not on the list
Texas-model laws name the accepted methods: a digital ID, or a commercial system that checks a government-issued ID or transactional data. They also name what you may not do: keep the identifying information afterwards.
Checkbox or birth-date field
Not an accepted method in any state statute
No evidence for an attorney general inquiry
Does nothing against the $10,000-per-day exposure
Does not stop a parent's private lawsuit in LA, UT, VA, or NC
Statute-grade verification
Government ID + liveness before covered content loads
Signed 18+ or 21+ result returned to your platform
No identifying information retained by you or the verifier
Audit ID stored per verification for regulator review
$10,000/day
plus $10,000 per retained-data instance and up to $250,000 if a minor gets through (Texas)
The daily penalty is what makes waiting expensive. Florida's Attorney General has already filed suits against adult sites under HB 3, and Louisiana, Utah, Virginia, and North Carolina let parents sue directly. Holding ID images on your own servers does not reduce any of this; under Texas law it adds a separate $10,000-per-instance exposure.
US guides by law and by industry
Pass the Texas test in every state that copied it
Verify 18+ or 21+ with a government ID and liveness. Receive a signed result and Audit ID. Retain nothing that identifies the visitor. Start on the free plan and scale per verification.
US age verification FAQ
As of September 2026, 27 states do, including Texas (HB 1181), Louisiana, Tennessee, Utah, Virginia, Florida, and North Carolina. Most apply when more than one-third of a site is sexual material harmful to minors, require proof that the visitor is 18 or older, and forbid the site or its verifier from retaining identifying information.
Yes, for adult content. In Free Speech Coalition v. Paxton (27 June 2025) the Court upheld Texas HB 1181 6-3 under intermediate scrutiny. The Sixth Circuit then lifted the injunction against Tennessee's law in November 2025. Social-media laws for minors have fared worse: Arkansas's was permanently struck down, and Virginia's and Utah's are enjoined, while Florida's HB 3 is enforceable pending appeal.
They vary by state. Texas allows up to $10,000 per day of non-compliance, $10,000 per instance of retained identifying information, and up to $250,000 more if a minor accesses covered material. New York's SAFE for Kids Act allows up to $5,000 per violation. Louisiana, Utah, Virginia, and North Carolina add private lawsuits by parents.
Texas-model statutes accept a digital ID or a commercial age verification system that checks a government-issued ID or relies on transactional data. Florida requires sites to offer both an anonymous and a standard method. A checkbox or self-declared birth date is not accepted anywhere.
Yes, and most of the statutes push you there by forbidding retention of identifying information. Use a third-party verifier that checks the ID and liveness, returns a signed 18+ or 21+ result with an Audit ID, and discards the document. Store the result, timestamp, and policy version, not the ID image or selfie.
New York's SAFE for Kids Act takes effect on 25 January 2027 after final rules on 28 July 2026. California's Digital Age Assurance Act (AB 1043) is operative from 1 January 2027 and requires operating systems to expose an age-bracket signal that app developers must request. Colorado's SB 26-051 follows on 1 July 2028.