Last updated: October 21, 2026

🪪 Age Verification Laws and Your Privacy: The 2026 Picture

Q: What are online age-verification laws?

They are laws requiring websites to confirm a visitor is old enough — usually 18 — before showing certain content, most commonly pornography. As of 11 October 2026, the Free Speech Coalition's state list shows 27 US states with such laws in effect for adult sites. The latest were West Virginia, the 26th, on 12 June 2026 and Iowa, the 27th, on 1 July 2026. The typical statute follows the Texas model: if a third or more of a site's content is 'sexual material harmful to minors,' the site must verify each visitor's age before granting access. A click-through 'I am 18' button no longer satisfies these laws for covered content — they require something closer to ID-grade proof. The reason this belongs on a site about surveillance and privacy is that verification means handing your identity to a website or a third-party checker in order to browse, which is a privacy question wearing a child-safety label.

Q: Is age verification constitutional in the US?

As of June 2025, yes — for sexual content specifically. In Free Speech Coalition v. Paxton, decided 27 June 2025, the US Supreme Court upheld Texas's HB 1181 in a 6–3 decision, rejecting a First Amendment challenge from the adult industry's Free Speech Coalition and the ACLU. The Court held, in Justice Thomas's words, that no person — adult or child — has a First Amendment right to access material obscene to minors without first proving their age. That settled the central constitutional question that had blocked these laws for two decades. But the ruling is narrower than it is often reported to be: the Court's reasoning applies to age-verification rules for certain sexual material, not to age limits in general. Courts have continued to block broader 'child safety' laws that try to age-gate social media or general-purpose websites, which raise different and harder First Amendment problems.

Q: Why do privacy advocates oppose these laws?

Because verifying age online almost always means collecting identity, and identity collection creates risk that did not exist before. The EFF's objection is not that protecting children is unimportant — it is that these laws force every adult user to surrender anonymity and hand sensitive personal data to websites or verification vendors just to access lawful content, creating honeypots of exactly the data that gets breached. When a site or its age-checking contractor logs that a specific identity accessed specific content, that record exists somewhere, and records leak. The concern is compounded by scope creep: a legal framework built for pornography is already being extended toward social media and app stores, where it would mean identity-gating far more of ordinary internet life. Privacy advocates see a mechanism that normalizes proving who you are to browse, which is a foundational shift in how the internet works.

Q: What happened in the UK with the Online Safety Act?

The UK offers the clearest real-world preview of what strict age verification does at scale, and it is not reassuring. The Online Safety Act's rollout produced immediate, documented side effects: journalistic and news content was caught and blocked by overbroad filters, and VPN usage in the UK spiked sharply as people refused to hand over identity documents to access online spaces. Rather than build compliant verification, some websites simply chose to block UK access entirely. The pattern — censored legitimate content, a surge in circumvention tools, and services geo-blocking an entire country rather than comply — is precisely what critics predicted, and it is the trajectory the US Supreme Court's Paxton decision arguably puts the United States on.

Q: Do people just use VPNs to get around it?

In large numbers, yes, and the data makes the circumvention undeniable. Every time a state's law takes effect or a country tightens its rules, VPN demand in that place spikes — the UK's Online Safety Act rollout is the most documented example, but the same pattern appears after US state laws. This is why some laws have started targeting the workaround itself: Utah's SB 73, aimed at VPN use, took effect on 3 September 2026. The state first agreed not to enforce it against Aylo, Pornhub's parent company, while Aylo's federal challenge was pending. Then, in late September, Judge David Barlow blocked the VPN provisions with a preliminary injunction (a temporary court order while the case continues). The circumvention is straightforward because a VPN makes a user appear to be somewhere the law does not apply — which also demonstrates the laws' core practical weakness. They are trivially avoidable by anyone motivated, meaning the people most reliably affected are ordinary adults who won't bother, not the determined minors the laws are meant to stop.

Q: Which platforms have blocked access instead of complying?

Pornhub, one of the most-visited sites in the world, has repeatedly chosen to block entire states rather than implement age verification — it suspended service in Texas, and its parent company Aylo has blocked access in most states with these laws rather than build verification systems. The company's stated position is that ID-based checks endanger user privacy and simply push users to less responsible sites that ignore the law entirely, which it argues makes children less safe, not more. Whether one accepts that reasoning or sees it as a company dodging compliance, the observable effect is real: in many states the major regulated platform is dark, while unregulated ones remain a click away, and the law's practical result is a redistribution of traffic rather than a wall.

Q: Is this spreading beyond pornography?

Yes, and that expansion is what privacy advocates watch most closely. The App Store Accountability Acts passed or advancing in states like Texas, Utah, Louisiana and California would push age verification down to the app-store and device level. California signed A.B. 1709 on 10 September 2026. From 1 January 2027 it bars covered platforms from giving under-16s addictive features such as algorithmic feeds and autoplay. Platforms must check age under the state's Digital Age Assurance Act before offering them. An April 2026 draft would have barred under-16s from holding accounts at all. The signed law lets them keep accounts without those features. The UK is separately moving toward restricting social media for young people. Each of these goes well beyond the sexual-content category the Supreme Court's Paxton ruling actually blessed — and courts have repeatedly found that age-gating social media or general-purpose sites is far harder to square with the First Amendment. The direction of travel, though, is unmistakable: from a narrow rule about pornography toward a general expectation that you prove your identity to use the internet.

Q: What does this mean for my privacy right now?

Practically, three things. First, if you are in a state with an active law, accessing covered sites may require handing ID or a face scan to a site or a third-party verifier — and you should assume that interaction can be logged, whatever the privacy promises. Second, the safest privacy posture is to minimize what you hand over: verification methods are not equal, and a system that checks age without retaining identity is far preferable to one that stores a copy of your license, though you rarely get to choose. Third, understand that the legal and technical landscape is moving fast and mostly in one direction, toward more identity-gating of more of the internet — so the broader defensive skills this site covers, from understanding what data brokers hold to reducing your overall footprint, are the durable response. Age verification is one instance of a general trend: the steady erosion of anonymous browsing. Treat it as such.

Q: How does Discord verify age in 2026?

Since the week of 22 September 2026, Discord sorts most accounts into an adult or teen age group automatically. It uses an age estimation model built on account signals such as account age, the servers and games you are connected to, and how active you are. Discord says the model does not look at messages, calls or other content, and that more than 90% of users will not be asked to confirm their age. Accounts in the teen group, or not yet classified, get teen protections by default: blurred sensitive media, no access to age-restricted servers and channels, message requests switched on, and no speaking on Stage. To confirm you are an adult you can use a credit-card check (k-ID passes the card to Stripe), an age range from the Apple App Store or Google Play, a Google Wallet passport ID pass, an AgeKey, an on-device video selfie, or an ID scan plus selfie. Discord says it receives only an age signal and that vendors must delete what you submit once the check is complete.

Q: How does the Roblox face scan age check work, and is the photo kept?

Roblox has required an age check to use chat since early December 2025 in Australia, New Zealand and the Netherlands, and worldwide since early January 2026. The check uses your device camera for Facial Age Estimation run by the vendor Persona. Roblox says the images and video are deleted immediately after processing. The result places you in an age group from under 9 up to 21+, and by default you can chat only with your own group and the ones next to it. Users aged 13 and over who think the estimate is wrong can verify with a government ID instead, and a linked parent can change a child's birthday once. Roblox's help page does not say how long ID images are kept.

After the Supreme Court's Paxton ruling, 27 states require ID-grade age checks for adult sites, by the Free Speech Coalition's October 2026 list — and the framework is spreading to social media and app stores. What the laws demand, why privacy advocates call them surveillance, and what the UK's rollout already showed us.

By Ned Walsch

Key findings

As of 11 October 2026, the Free Speech Coalition lists 27 US states with age-verification laws for adult websites in effect. West Virginia became the 26th on 12 June 2026 and Iowa the 27th on 1 July 2026. Free Speech Coalition (accessed 11 Oct 2026) The constitutional question is settled for sexual content: in Free Speech Coalition v. Paxton (27 June 2025), the Supreme Court upheld Texas's law 6–3, ruling no one has a First Amendment right to access material obscene to minors without proving their age. But the ruling is narrower than reported — it covers sexual material, not age limits in general, and until October 2026 courts kept blocking attempts to age-gate social media. In mid-October the Eleventh Circuit let Florida and Georgia enforce their teen social-media laws while the cases continue. The privacy objection is concrete: verification means handing your identity to a website or third-party checker to browse, creating breach-prone honeypots. The UK's Online Safety Act is the preview — its rollout censored news content and sent VPN use soaring, with some sites geo-blocking Britain rather than comply. Pornhub blocks entire states rather than verify. Utah's VPN law (SB 73) took effect 3 Sept 2026, but a federal judge blocked its VPN clause on 24 September. The framework is now spreading to app stores and social media, through laws like California's A.B. 1709.

Age verification is usually framed as a child-safety measure. It is also, mechanically, a requirement to prove your identity in order to access lawful content — which makes it a privacy and surveillance story, and squarely in this site's lane. This page covers what the laws actually require after the 2025 Supreme Court ruling, the documented privacy fallout, and where the framework is heading next.

By Ned Walsch · Last updated October 2026 · Not legal advice

What the laws require

The template is Texas's HB 1181, and most states copied its shape: if a third or more of a site's content is "sexual material harmful to minors," the site must verify every visitor is 18+ before granting access. The critical shift is what counts as verification.

A click-through "I am 18" button is no longer enough for covered content. The laws require something closer to ID-grade proof — a government ID upload, a database check, or a face-based age estimate. That is the entire privacy problem in one sentence: the difference between asserting your age and proving it is the difference between anonymity and handing over your identity.

What the count of 27 covers. It is the number of states on the Free Speech Coalition's state list, all with effective dates on or before 1 July 2026. Free Speech Coalition (accessed 11 Oct 2026) These are laws aimed at sites with a set share of sexual material. The count leaves out social-media and app-store age laws. The list does not say which laws face court challenges. Iowa's HF 864 was signed on 2 June 2026 and took effect on 1 July 2026. Free Speech Coalition (accessed 11 Oct 2026)

The state map keeps moving. Recent developments worth noting:

Missouri HB 1839 took effect on 28 August 2026, codifying the attorney general’s 2025 age-verification rule into statute — third-party verification is required, and verifiers are barred from retaining ID data.
California AB 1856, which amends the Digital Age Assurance Act to add an operating-system-level age signal (with an open-source/Linux exemption), passed the Senate 40–0 on 26 August and the Assembly 69–0 on 27 August 2026. Governor Newsom signed it on 10 September 2026 Governor of California (10 Sep 2026). The underlying act takes effect on 1 January 2027.
Meta settled the state attorneys general’s social-media-addiction case on 26 August 2026 — 51 AGs, reported at roughly $17–18 billion — with teen-account restrictions and stronger age verification among the terms.

The Supreme Court settled it — narrowly

For two decades, the First Amendment blocked these laws. That ended on 27 June 2025. In Free Speech Coalition v. Paxton, the Court upheld Texas's HB 1181 in a 6–3 decision, rejecting the challenge brought by the adult industry's trade group and the ACLU. Writing for the majority, Justice Thomas held that no person — adult or child — has a First Amendment right to access speech obscene to minors without first submitting proof of age.

Read the ruling's limits, because they matter. The Court's reasoning applies to age-verification rules for certain sexual material — not to age limits in general. The EFF and others stress that this does not mean broader "child safety" laws, like those age-gating social media, are constitutional. Courts have continued to block those, because locking general-purpose websites behind identity checks burdens all users' rights to access lawful information and to be anonymous. Paxton opened one specific door. It did not open all of them — though many lawmakers are acting as if it did.

Why privacy advocates call it surveillance

The objection is not indifference to child safety. It is that verifying age online means collecting identity, and collected identity leaks. The mechanism creates risk that did not previously exist:

🎯 HoneypotsEvery ID upload or database check is sensitive data sitting somewhere — the exact kind that gets breached. A verifier that logs "this identity viewed this content" creates a record that can leak, subpoena, or be sold.

🕵️ End of anonymityThe right to read and browse without identifying yourself is foundational to how the internet has worked. Age gates replace it with "prove who you are first" — for an expanding set of content.

📈 Scope creepA framework built for pornography is already being pointed at social media and app stores. Each extension identity-gates more of ordinary online life.

⚖️ Chilling effectPeople self-censor lawful browsing when they know it is tied to their name — the documented result whenever anonymity is stripped from access to information.

The UK already ran this experiment

The clearest preview of strict age verification at national scale is the UK's Online Safety Act, and the results are documented rather than hypothetical:

→Legitimate content got censoredOverbroad filters caught and blocked journalistic and news content — the predictable overreach when automated systems gate access at scale.

→VPN use spikedUK users turned to VPNs in large numbers rather than hand over identity documents — an immediate, measurable rejection of the requirement.

→Sites blocked the whole countryRather than build verification, some services simply geo-blocked the UK — cutting off lawful access instead of complying.

This is the trajectory critics argue Paxton places the United States on: the same censored content, the same surge in circumvention, the same services choosing to go dark rather than verify.

The VPN workaround — and the laws targeting it

Every time a jurisdiction tightens age rules, VPN demand there spikes, because a VPN makes a user appear to be somewhere the law does not reach. This is the laws' central practical weakness: they are trivially avoidable by anyone motivated, so the people they most reliably affect are ordinary adults who won't bother — not the determined minors they target.

Some laws now target the workaround itself. Utah's SB 73, aimed at VPN use to evade age verification, took effect on 3 September 2026, and the state first agreed not to enforce it against Aylo, Pornhub's parent company, while the injunction request argued in July was pending. That carve-out covered Aylo alone. Then Judge David Barlow blocked the VPN provisions with a preliminary injunction EFF (1 Oct 2026); details are in the October 2026 update. Attempting to outlaw a general-purpose privacy tool because it can circumvent a content rule is a significant escalation — VPNs have countless legitimate uses, and banning them to enforce age-gating is a blunt instrument aimed at a foundational privacy technology.

Platforms blocking states instead of complying

Pornhub — among the most-visited sites in the world — has repeatedly gone dark rather than verify, suspending service in Texas and, through parent company Aylo, blocking most states with active laws. Its argument: ID checks endanger user privacy and simply push traffic to less responsible sites that ignore the law, making children less safe. Whether you accept that or read it as compliance-dodging, the observable effect is consistent — in many states the regulated platform is dark while unregulated ones are a click away. The law redistributes traffic more than it builds a wall.

Where it's heading: app stores and social media

The expansion beyond pornography is what deserves the closest watch:

App Store Accountability Acts (Texas SB 2420, plus Utah, Louisiana, California) push verification down to the app-store and device level — Apple has floated a "Declared Age Range" mechanism in response.
California A.B. 1709, signed on 10 September 2026, bars covered platforms from giving under-16s addictive features such as algorithmic feeds and autoplay. It takes effect on 1 January 2027. Platforms must check a user's age under the state's Digital Age Assurance Act before offering those features. Common Sense Media, sponsor (10 Sep 2026) An April 2026 draft would have barred under-16s from holding accounts at all. Assembly committee analysis (16 Apr 2026) EFF warns the bill will “force platforms to implement the strictest forms of age verification.” EFF (31 Jul 2026)
The UK is separately moving toward restricting social media for young people.

The honest tension. The goal — protecting children online — is real and widely shared, and "do nothing" is not a satisfying answer to genuine harms. Privacy-preserving age-estimation techniques exist in principle, and if verification could be done without retaining identity, much of the objection would ease. The problem is that those methods are immature, the laws mostly don't require them, and the burden falls on every adult's anonymity to address a problem VPNs let motivated minors sidestep anyway. A reader can hold both that children's safety matters and that identity-gating the internet is a heavy, leaky, easily-evaded way to pursue it. Both are true.

The federal picture moved too. There is still no federal age-verification mandate in force, but on June 29, 2026 the House passed the KIDS Act (H.R. 7757) 267–117. Unlike the earlier KOSA (which passed the Senate in 2024 but died in the House), the KIDS Act drops the “duty of care” standard and leans directly on age verification — requiring platforms to judge whether a user is “more likely than not” a minor and to act when they “know or should have known” a user is underage. The EFF warns this negligence standard would push platforms toward ID or passport checks, or facial and behavioral age-estimation, for all users. Its path through the Senate is uncertain, but it signals the state-by-state wave now has a federal echo.

How do Discord and Roblox verify age now?

Discord now sorts most accounts into an adult or teen age group automatically. It launched this worldwide in the week of 22 September 2026, using a model that reads account signals, not messages. Discord says more than 90% of users will never be asked to prove their age. Anyone left in the teen group gets teen settings by default. Discord (22 Sep 2026) Roblox has gone further. Since early January 2026, everyone who wants to use chat must pass an age check, usually a face scan run by the vendor Persona. Roblox (7 Jan 2026) Both companies say the face images are deleted or never leave the device. The breach of a Discord support vendor in October 2025 shows why people doubt that kind of promise. In that breach, government-ID photos sent in for age appeals were exposed.

Discord: from a February backlash to a September launch

9 February 2026: the first plan. Discord announced "teen-by-default" settings for all users worldwide, to start in early March 2026. Under them, sensitive media is blurred, age-restricted servers and channels are closed, messages from strangers go to a separate requests inbox, and only age-assured adults can speak on Stage. Adults could prove their age with a video selfie or an ID sent to "vendor partners". Discord press release (9 Feb 2026) Help Net Security (10 Feb 2026)
24 February 2026: delayed. After user backlash, much of it pointing to the vendor breach, Discord pushed the global rollout back to the second half of 2026. NBC News (Feb 2026) CTO Stanislav Vishnevskiy wrote that Discord "should have provided more detail about our intentions". He confirmed that Discord ran a UK-only test of Persona in January 2026 and dropped it because Persona "did not meet" Discord's rule that facial age estimation must run on the device. He also named k-ID as the vendor for adults verifying in the UK, Australia and Brazil. Discord blog (24 Feb 2026)
22 September 2026: what is live now. Discord's age estimation model places accounts into age groups. Discord says the model uses the communities, servers and games you are connected to, how old your account is, and how active you are, and that it "does not look at your messages, calls, or other content". The model is not used for accounts in the UK or Australia. An adult placed in the teen group by mistake can confirm their age group under User Settings > Account Status. Discord (22 Sep 2026) Discord's technical write-up lists the model's inputs as a "social graph" embedding, account metadata, aggregate activity counts, server categories and device or OS signals. It says the model never uses message content, uploaded media, usernames or bios. Discord gives no error rates, only the claim that accuracy "meets or exceeds" the methods used where age-assurance laws apply. Discord technical post (22 Sep 2026)

How adults confirm their age on Discord now. There are six options: a credit-card check (k-ID passes the card to Stripe, and Discord says "neither k-ID nor Discord ever sees the card details"), an age range shared by the Apple App Store or Google Play, a passport-based Google Wallet ID pass (passports from Brazil, Singapore, Taiwan, the UK and the US only), a reusable AgeKey, a video selfie, or an ID scan plus selfie. Discord says the selfie "stays on your device". Stripe keeps the last four card digits because it is a payment processor. Discord (22 Sep 2026) Discord's vendor page names k-ID as the "orchestrator" for the card, face, ID and AgeKey checks. It says vendors must delete submissions once the check is complete and may not use them to target ads or train models, and that "Discord only ever receives your age signal". The same page refers to per-method data tables that were missing when we read it on 10 October 2026. Discord vendor page (22 Sep 2026)

The October 2025 breach was in the appeals process. Discord said on 3 October 2025 that this was "not a breach of Discord". It was a breach of 5CA, a third-party customer-service provider. Discord said about 70,000 users worldwide "may have had government-ID photos exposed". 5CA had been using those images to review age-related appeals. Names, support messages, IP addresses and limited billing details may also have been exposed. Discord cut 5CA's access to its ticketing system. Discord (3 Oct 2025, updated 9 Oct 2025) In February 2026 Discord said it does not use that provider for age assurance and "no longer work[s] with them at all". Discord blog (24 Feb 2026) An age check can be private on paper and still leak, because the fallback path often runs on images that a person reviews.

Roblox: a face check before you can chat

Roblox announced mandatory age checks for chat in November 2025. It enforced them from the first week of December 2025 in Australia, New Zealand and the Netherlands, then worldwide from early January 2026. The check uses the device camera for Facial Age Estimation by Persona. Users aged 13 and over can choose ID verification instead. The result places you in an age group from under 9 up to 21+, and by default you can chat only with your own group and the ones next to it. Roblox (Nov 2025) On 7 January 2026 Roblox said "tens of millions of daily active users" had completed a check. It also said the estimation reached a mean absolute error of 1.4 years for under-18s in UK Age Check Certification Scheme testing. That figure is Roblox's own claim about its vendor. Roblox (7 Jan 2026)

Roblox's help centre says checks now gate all chat, Restricted Content, unfiltered chat with trusted friends, and Team Create in Studio. Roblox says "We delete your images and video after processing for facial age estimation". If the estimate puts you at under 13, Roblox removes your email and phone number from the account. Roblox may ask for a new check if your behaviour does not match your estimated age. The help page does not say how long ID images are kept. Roblox Support (read 10 Oct 2026) From early June 2026, the check also decides which type of account a child gets: Roblox Kids for ages 5 to 8, with communication off by default, or Roblox Select for ages 9 to 15. Users who skip the check get limited games and no communication. Roblox (13 Apr 2026)

What about YouTube, Google, Xbox and VRChat?

The table below compares what each platform says it collects and who processes it. It uses only the platforms' own statements.

Platform	How it checks age	Who processes the face or ID	What the platform says it keeps
Discord	Automatic estimate from account signals. Adults can confirm with a card, an app-store age range, Google Wallet, AgeKey, a selfie or an ID. Discord (22 Sep 2026)	k-ID coordinates the vendors. The selfie is analysed on the device. Discord (22 Sep 2026)	Discord keeps only the age signal. Vendors must delete submissions after the check, except that Stripe keeps the last four card digits.
Roblox	Face scan or ID (13+) to use chat. Roblox (Nov 2025)	Persona, the vendor.	Face images and video are deleted after processing. No retention period is stated for ID images. Roblox Support
YouTube / Google (US)	A machine-learning estimate from searches, YouTube viewing categories and account age. It started with "a small set of users" in July 2025. YouTube (29 Jul 2025)	Google itself. Users wrongly flagged as under 18 can correct it with a government ID or a selfie, or on YouTube with a credit card. Google (30 Jul 2025)	Google says the estimate "does not involve collecting additional data". Its post gives no retention period for the ID or selfie.
Xbox (UK)	A one-time check for UK adults. Unverified accounts are limited to friends-only social features from early 2026. Xbox Wire (28 Jul 2025)	Not named. The options are a government ID, age estimation, a mobile-provider check or a credit-card check.	Data is "not stored or used for any other purpose", according to Xbox.
VRChat	Optional, but needed for 18+ spaces. An ID plus a selfie through Persona, offered to VRC+ subscribers. VRChat A free UK phase was announced in June 2026, with no release dates. VRChat (Jun 2026)	Persona. VRChat says it "will not receive any images or face scans".	VRChat keeps your birth date and a one-way hash. Persona is told to delete personal information after verification.

What this means for your privacy. The platforms that checked age this year mostly avoid storing faces themselves. Discord requires face estimation to run on the device, and Roblox and VRChat say images are deleted after processing. Your exposure moves to the vendor and to the fallback routes: ID uploads, appeals and support tickets. Those are exactly where the 5CA breach happened. Before you choose a method, check two things. First, does the face analysis run on your phone or on a vendor's server? Second, does the platform name the vendor and say how long it keeps your ID? Methods that reuse an age signal you already have, such as an app-store age range, a card check or a reusable credential, avoid sending a new image of your face anywhere.

October 2026 update: a VPN clause blocked, and a retention claim survives

21 October 2026: added Ofcom’s investigation into Pornhub’s use of Apple age signals for UK users.

11 October 2026: two items higher up still read as pending and are now corrected. California AB 1856 was signed on 10 September, and Utah’s VPN clause is enjoined. The state count now follows the Free Speech Coalition’s list (27, with Iowa the latest), and A.B. 1709 is described as signed.

Two US rulings in September matter more for privacy than for access, because both turn on what the verification itself costs you.

Utah: the “actually located” clause is enjoined

On 24 September 2026 Judge David Barlow of the US District Court for Utah preliminarily enjoined Utah Code § 78B-3-1002(3), the provision requiring adult sites to age-verify every user “actually located” in Utah regardless of VPN use or location masking. The court held it likely violates the dormant Commerce Clause, finding the amended statute “essentially imposes strict liability… when it comes to determining the location of its websites’ users” because it contains “no requirement of reasonableness.” Courthouse News, Free Speech Coalition.

Read the scope carefully before concluding anything: the rest of Utah’s age-verification statute remains in effect. What was blocked is the clause that would have made VPN use the site’s legal problem — a provision that, had it stood, would have pushed operators toward more invasive location inference rather than less.

Tennessee: the retention and re-verification claims go forward

In mid-September Chief Judge Sheryl Lipman (W.D. Tenn.) denied Tennessee’s motion to dismiss the Free Speech Coalition’s challenge in full, letting every claim proceed — First and Fourteenth Amendment, Supremacy Clause preemption, vagueness and overbreadth, and specifically the privacy claims over the law’s seven-year retention of verification data and the burden claims over its requirement to re-verify every 60 minutes. FSC. Those two features are the ones this page has flagged as the real privacy exposure in age-verification regimes, and this is the first time a court has let that theory past the pleadings. The exact ruling date is not stated in available reporting — FSC’s 24 September post says “last week” — so treat it as roughly 14–19 September pending the docket.

California: two more statutes, one of them about who may ask

Both chaptered 10 September 2026:

AB 1856 (Chapter 184) amends the Digital Age Assurance Act, which itself takes effect 1 January 2027. It deletes the DAAA’s definition of “user,” clarifies that the OS-provider interface duty applies where the operating system has an account-setup feature, requires the age-bracket signal to be provided to a covered app store or developer, and — the clause worth knowing — prohibits anyone from requesting an age signal about a particular user from an OS provider or app store unless required to do so by law. Bill text
AB 1709 (Chapter 183) prohibits covered platforms from providing an “addictive feature” to users under 16 and requires reasonable measures to ensure they are not offered one, with Attorney General rulemaking, civil penalties, and a new e-Safety Advisory Commission in the DOJ. Bill text

Outside the US

Ofcom fined the operator of xgroovy.com £730,000 on 4 September under the Online Safety Act — £700,000 for failing to have highly effective age assurance between July and November 2025, £30,000 for ignoring a statutory information request, plus £200 a day until it complies or 3 November 2026, whichever comes first. The site has since deployed age checks and geoblocked the UK. Ofcom

Ofcom is investigating Pornhub’s age checks. On 23 September 2026 it opened an investigation into Aylo, Pornhub’s operator, under the Online Safety Act. In May 2026 Pornhub began relying on age signals from Apple for some UK users. Ofcom says it is concerned that Aylo “may not have conducted sufficient due diligence and testing”. It will not rule on how Apple runs its own checks. Fines can reach £18 million or 10% of worldwide revenue. Ofcom (23 Sep 2026) Ofcom bulletin (15 Oct 2026)

The European Commission proposed the “EU KIDS Act” on 17 September: no social media under 13, “mini accounts” with parental management and a one-hour daily limit for 13–15s, independent accounts from 15. On verification the Commission says services “will have to use tools to check users’ ages, while protecting their privacy,” pointing at the EU age verification app, “which does not retain identity documents or biometric data.” It now goes to Parliament and Council. European Commission. Secondary summaries describe the age thresholds differently from the Commission’s own wording; the figures above are the Commission’s.

Update, 20 October 2026: a state-by-state table now lists all 27 adult-site laws, 20 social media laws for minors with their court status, and seven app-store and device laws. It also records that Nebraska’s social media law was partly blocked in June and that Ohio’s is on hold while NetChoice asks the Supreme Court to review it.

Update, 18 October 2026: the Eleventh Circuit lets two teen social-media laws take effect

Florida HB 3. A three-judge panel lifted the injunction against Florida’s law, which bars under-14s from accounts on platforms with “addictive features” and requires parental consent at 14 and 15. Judge Newsom wrote: “We hold that HB3 is likely constitutional as applied to CCIA’s members.” Florida can enforce it while the case continues Florida Phoenix (14 Oct 2026).
Georgia SB 351. On 15 October the same court vacated the injunction in NetChoice v. Carr. It said NetChoice had not proved the law unconstitutional and rejected the vagueness claim; the case returns to the district court Atlanta News First (16 Oct 2026).

These rulings are about teen social-media accounts, not adult-site age checks. The adult-site list is unchanged at 27 states.

Two things that did not happen

No US appellate or Supreme Court activity on age verification surfaced between 1 September and 3 October 2026. That changed in mid-October (see below).

Connecticut did not bring age verification into force on 1 October. A widely circulated law-firm summary says Public Act 26-15 did. Checking the act’s structure, its 1 October 2026 provision is AI consumer transparency; the minor-user protections take effect 1 January 2028. If you are building a compliance calendar from secondary summaries, this one is wrong in both directions.

Which states have age-verification laws? (checked 20 October 2026)

27 states require adult sites to verify age, and the count has held since July. Four trackers list the same 27: Free Speech Coalition AVPA (Sep 2026) RecordingLaw (18 Oct 2026) State of Surveillance (28 Sep 2026). West Virginia (12 June 2026) and Iowa (1 July 2026) were the latest to join; Missouri turned its attorney general’s rule into a statute on 28 August. Wisconsin’s bill was vetoed in April and New Hampshire’s died in May.

State	Law	In force since	Status (Oct 2026)	Source
Alabama	HB 164 (2024)	1 Oct 2024	In force	FSC list AVPA
Arizona	HB 2112 (2025)	26 Sep 2025	In force	FSC list RecordingLaw SoS
Arkansas	SB 66 / Act 612 (2023)	31 Jul 2023	In force	FSC list AVPA
Florida	HB 3 (2024), Fla. Stat. §501.1737	1 Jan 2025	In force; porn provisions not challenged (AVPA)	FSC list AVPA
Georgia	SB 351 (2024), adult-content part	1 Jul 2025	In force; adult portion unchallenged (RecordingLaw). The social-media portion is in Table B	FSC list SoS
Idaho	H 498 (2024), Idaho Code §§6-3801–3809	1 Jul 2024	In force; unchallenged	ungovr FSC list
Indiana	SB 17 (2024), Ind. Code 24-4-23	1 Jul 2024; FSC revised to 16 Aug 2024	In force; injunction vacated, case dismissed (RecordingLaw)	FSC list RecordingLaw
Iowa	HF 864 (2026)	1 Jul 2026	In force. Pornhub urged repeal (Axios, 6 Aug 2026)	WOWT Axios
Kansas	SB 394 (2024)	1 Jul 2024	In force	FSC list RecordingLaw
Kentucky	HB 278 (2024)	15 Jul 2024	In force	FSC list AVPA
Louisiana	Act 440 / HB 142 (2022); HB 77 (2023)	1 Jan 2023	In force	FSC list AVPA
Mississippi	SB 2346 (2023)	1 Jul 2023	In force	FSC list AVPA
Missouri	AG rule 15 CSR 60-18 (MMPA). Statute HB 1839 (HCS HBs 1839, 2921 & 3015), signed 9 Jul 2026	Rule 30 Nov 2025 (KCUR reports "December"); statute 28 Aug 2026	In force	KCUR FSC list
Montana	SB 544 (2023; amended 2025), MCA §30-14-159	1 Jan 2024	In force	FSC list RecordingLaw
Nebraska	LB 1092 (2024), Online Age Verification Liability Act	18 Jul 2024 (FSC). Trackers differ: 15/18/19 Jul	In force	FSC list AVPA
North Carolina	HB 8 (2023), G.S. Ch. 66 Art. 51	1 Jan 2024	In force	FSC list AVPA
North Dakota	SB 2380 (2025), NDCC §51-07-32. FSC lists "HB 1561 / SB 2380"	1 Aug 2025	In force; no lawsuit found as of Aug 2026	RecordingLaw FSC list
Ohio	HB 96 (budget, 2025), "Innocence Act", ORC §1349.10	30 Sep 2025	In force. RecordingLaw notes a drafting gap: "interactive computer service" providers are exempt, which lets sites evade the law	FSC list RecordingLaw
Oklahoma	SB 1959 (2024)	1 Nov 2024	In force	FSC list RecordingLaw
South Carolina	H.3424 (2024), S.C. Code §37-1-310	1 Jan 2025	In force	ungovr FSC list
South Dakota	HB 1053 (2025), SDCL 22-24-69 to -72	1 Jul 2025	In force	FSC list RecordingLaw
Tennessee	SB 1792 / HB 1614 (2024), Protect Tennessee Minors Act	1 Jan 2025; FSC revised to 13 Jan 2025	In force. 6th Cir. vacated the preliminary injunction (post-Paxton); merits litigation continues	Mealey's FSC list
Texas	HB 1181 (2023), CPRC ch. 129B	1 Sep 2023 (FSC: 19 Sep 2023)	In force. *Upheld 6–3 in Free Speech Coalition v. Paxton* (27 Jun 2025)**	CRS FSC list AVPA
Utah	SB 287 (2023); SB 73 (2026), which adds VPN/location rules and a 2% tax	3 May 2023; SB 73 signed 19 Mar 2026	Base law in force. The SB 73 actual-location (VPN) rule was preliminarily enjoined on 24 Sep 2026	KPCW FSC list
Virginia	SB 1515 (2023)	1 Jul 2023	In force	FSC list AVPA
West Virginia	HB 4412 (2026)	12 Jun 2026	In force	Free Speech Coalition WV Legislature
Wyoming	HB 43 (2025), Wyo. Stat. §§14-3-501–504	1 Jul 2025	In force	FSC list RecordingLaw

Social media laws for minors

The courts are split, and October tipped toward the states. The Eleventh Circuit let Florida and Georgia enforce their laws on 14 and 15 October. Ohio’s law is upheld but on hold while NetChoice asks the Supreme Court to review it. Arkansas, Louisiana, Utah and Virginia remain blocked, and Nebraska is partly blocked. Mississippi and Tennessee are enforceable while the cases continue.

State	Law	What it requires	Effective	Court status (Oct 2026)	Source
Arkansas	SB 396 / Act 689 (2023), Social Media Safety Act	Third-party age verification; parental consent under 18	Sep 2023 (never took effect)	Permanently enjoined (Mar 2025, NetChoice v. Griffin); appeal in 8th Cir.	Wikipedia Reclaim The Net
Arkansas	Acts 900 & 901 (2025)	Act 900: age verification for new accounts, minors defined as under 16, parental dashboard, $10k per violation. Act 901: parents may sue over harms such as addiction	Enjoined before taking effect	Preliminarily enjoined: Act 901 on 15 Dec 2025, Act 900 on 20 Apr 2026. 8th Cir. appeals consolidated	Reclaim The Net
California	SB 976 (2024), Protecting Our Kids from Social Media Addiction Act	No addictive feeds for minors without parental consent; notification limits; age assurance	1 Jan 2025; age assurance by 1 Jan 2027	9th Cir. (Sep 2025) largely upheld it; the like-count provision fell. Some provisions remain enjoined	AVPA
California	AB 1709 (2026), Ch. 183	Platforms must disable "addictive features" (algorithmic feeds, autoplay, etc.) for under-16s or delete those accounts. Creates an e-safety commission. No age-verification mandate is described	Most provisions 1 Jan 2027	Signed 10 Sep 2026; no litigation found	Pearl Cohen News 3 LV
Florida	HB 3 (2024), Fla. Stat. 501.1736	Under-14s barred from accounts on platforms with "addictive features"; parental consent for ages 14–15	1 Jan 2025	PI granted Jun 2025; stayed by 11th Cir. on 25 Nov 2025 (law took effect). On 14 Oct 2026 the 11th Cir. (Newsom, Luck, Tjoflat) vacated the PI: likely content-neutral and survives intermediate scrutiny. Enforceable; case continues	Florida Phoenix Wikipedia
Georgia	SB 351 (2024), Protecting Georgia's Children on Social Media Act	Platforms verify age; parental consent for under-16s; school social-media rules	1 Jul 2025 (blocked until now)	PI granted 26 Jun 2025 (Judge Totenberg). On 15 Oct 2026 the 11th Cir. vacated the PI: the facial challenge failed on the evidence, and the court reversed the vagueness and §230 rulings. Remanded. The AG says the law can now take full effect	Georgia AG reason.com
Idaho	HB 542 (2026), Stop Harms from Addictive Social Media Act	Platforms with ≥$1B ad revenue: reasonable age estimation; parental consent for users 16 and under; no addictive features	1 Jul 2026	In force; no litigation reported (as of Jul 2026)	ungovr
Illinois	HB 5511 / P.A. 104-0664 (2026)	Age verification for under-18s; no notifications 10pm–7am; OS-level age signal	1 Jan 2028	Signed 31 Jul 2026; AG enforcement, up to $50k per violation	closednetwork tracker
Indiana	HEA 1408 (2026)	Determine age; verifiable parental consent or age estimation for under-16s; parental controls; feature limits	1 Jan 2027	Not yet in force; AG enforcement under the deceptive-acts statute	Hoodline
Louisiana	Act 456 / SB 162 (2023), as amended by HB 577 (2024)	Platforms with >5M users: age verification; parental consent for under-16s	Was 1 Jul 2025	Permanently enjoined in Dec 2025 (NetChoice v. Murrill). 5th Cir. (No. 26-30016) heard argument on 1 Sep 2026; no decision found	Reclaim The Net Louisiana Illuminator
Minnesota	HF 4138 (2026)	Parental approval for under-16 accounts; maximum privacy defaults; no infinite scroll, autoplay or push notifications for minors	Jul 2027	Signed 26 May 2026; NetChoice has said it will sue	News From the States
Mississippi	HB 1126 (2024), Walker Montgomery Protecting Children Online Act	"Commercially reasonable" age verification; parental consent for under-18s	1 Jul 2024	PI stayed by 5th Cir. on 17 Jul 2025; SCOTUS denied vacatur on 14 Aug 2025. Enforceable. 5th Cir. argued 3 Feb 2026; no decision found	NetChoice
Nebraska	LB 383 (2025), Parental Rights in Social Media Act	Age verification; parental consent for under-18s; parental monitoring dashboard	1 Jul 2026	Partially enjoined on 27 Jun 2026 (Judge Gerrard): the age-verification and consent provisions are blocked; the parental dashboard may be enforced	KWIT NetChoice
New York	SAFE for Kids Act (S7694A, 2024)	Age determination; no algorithmic feeds or overnight notifications for under-18s without parental consent	25 Jan 2027 (AG rules final 28/29 Jul 2026)	No lawsuit reported	AVPA social-media page
Ohio	HB 33 (2023), Social Media Parental Notification Act (ORC 1349.09)	Verifiable parental consent for under-16 accounts	15 Jan 2024 (never enforced)	Permanently enjoined in Apr 2025. 6th Cir. reversed 2–1 on 18 Jun 2026. En banc denied 5 Aug 2026. Mandate stayed on 17 Aug 2026 pending a NetChoice cert petition, so the law remains on hold	Pearl Cohen NetChoice
South Carolina	H.3431 (2026), Age-Appropriate Design Code (Act 96)	Design code, not an account-consent law: protective defaults, limits on addictive features and notifications, audits	5 Feb 2026	In force; NetChoice v. Wilson PI motion pending (no ruling reported as of Jul 2026)	ungovr
Tennessee	HB 1891 (2024), Protecting Children from Social Media Act	Age verification; parental consent for under-18s; parental supervision tools	1 Jan 2025	In force; PI denied Jun 2025. On 28 Aug 2026 the 6th Cir. vacated that denial 2–1 and remanded for the district court to weigh the merits. The law is not blocked	Courthouse News
Texas	HB 18 (2023), SCOPE Act	Users register their age; parental tools/consent; filtering of "harmful" content; ad limits	1 Sep 2024	Filtering/monitoring provisions enjoined. The 5th Cir. (Jul 2026) affirmed that injunction, partly on §230 preemption, but held that the age-registration requirement is enforceable	Biometric Update
Utah	SB 194 / HB 464 (2024), Minor Protection in Social Media Act (replacing SB 152/HB 311)	Age assurance; parental consent for minors; default limits	1 Oct 2024	Preliminarily enjoined on 10 Sep 2024 (NetChoice v. Reyes/Brown). 10th Cir. argued 20 Nov 2025; no decision found	Wikipedia
Virginia	SB 854 (2025)	Determine whether the user is under 16; 1 hour/day per app unless a parent changes it	1 Jan 2026	Preliminarily enjoined (Judge Giles, Feb/Mar 2026). 4th Cir. denied stays on 10 Apr and 24 Aug 2026 (2–1). 4th Cir. argument set for 28 Oct 2026	MediaPost closednetwork tracker

App-store and device age checks

Texas is the only app-store law in force. The Supreme Court declined on 6 July 2026 to lift the appeals court’s stay, so Texas’s law applies while the case continues. Utah and Louisiana pushed theirs to 2027. California, Colorado and Illinois chose a different model: the phone’s operating system sends apps an age bracket instead of checking ID.

State	Law	Takes effect	What it requires	Status (Oct 2026)	Source
Texas	SB 2420 (2025), App Store Accountability Act	1 Jan 2026 (blocked until 28 May 2026)	App stores verify age at account creation, sort users into 4 age bands, and get parental consent for minors' downloads and purchases; developer duties	In force. PI issued 23 Dec 2025 (CCIA; SEAT). 5th Cir. administrative stay 28 May 2026, stay pending appeal 4 Jun 2026. SCOTUS denied the application to vacate the stay on 6 Jul 2026. Merits argued 4 Aug 2026; no merits decision found	digitalpolicyalert.org Hoodline RecordingLaw
Utah	SB 142 (2025), amended by HB 498 (2026, signed 18 Mar 2026)	Originally 6 May 2026; most provisions moved to 6 May 2027	Same app-store model; also covers existing accounts	Not yet enforceable; the CCIA suit was voluntarily dismissed on 21 Apr 2026	Loeb & Loeb RecordingLaw
Louisiana	HB 570 (2025); delayed by HB 977 (signed 15 May 2026)	Was 1 Jul 2026; now 1 Jul 2027	App-store model	Not yet in force; no lawsuit. Note: closednetwork still shows 1 Jul 2026, which is out of date	Alston & Bird
Alabama	HB 161 (2026), signed 17 Feb 2026	1 Jan 2027 for new accounts; existing accounts by 1 Oct 2027	App-store model; covers new and existing accounts	Not yet in force; no litigation found	RecordingLaw
California	AB 1043 (2025), Digital Age Assurance Act; amended by AB 1856 (Ch. 184, signed 10 Sep 2026)	1 Jan 2027 (transition to 1 Jul 2027 per closednetwork)	OS providers collect age at device setup and send an age-bracket signal (<13, 13–15, 16–17, 18+) to apps that request it. Self-declared, not a verification gate. AB 1856 divides duties among OS, store and developer and adds an open-source carve-out	Signed; not yet in force	Pearl Cohen RecordingLaw
Colorado	SB26-051 (2026), Age Attestation on Computing Devices Act	1 Jul 2028	OS-level age attestation/signal; open-source exception	Signed 3/4 Jun 2026 (sources differ)	Wikipedia (Online AV laws page); closednetwork
Illinois	HB 5511 / P.A. 104-0664 (2026)	Manufacturer interface 1 Jan 2028; operator signal 1 Jul 2028	OS/device age verification and signal (bundled with the social-media law in B)	Signed 31 Jul 2026	closednetwork; Wikipedia

Statuses come from the sources in each row and the four trackers above. Some details come from trackers rather than the statute text; court statuses change quickly. This is general information, not legal advice.

Frequently asked questions

What are online age-verification laws?

They are laws requiring websites to confirm a visitor is old enough — usually 18 — before showing certain content, most commonly pornography. As of 11 October 2026, the Free Speech Coalition's state list shows 27 US states with such laws in effect for adult sites. The latest were West Virginia, the 26th, on 12 June 2026 and Iowa, the 27th, on 1 July 2026. The typical statute follows the Texas model: if a third or more of a site's content is 'sexual material harmful to minors,' the site must verify each visitor's age before granting access. A click-through 'I am 18' button no longer satisfies these laws for covered content — they require something closer to ID-grade proof. The reason this belongs on a site about surveillance and privacy is that verification means handing your identity to a website or a third-party checker in order to browse, which is a privacy question wearing a child-safety label.

Is age verification constitutional in the US?

As of June 2025, yes — for sexual content specifically. In Free Speech Coalition v. Paxton, decided 27 June 2025, the US Supreme Court upheld Texas's HB 1181 in a 6–3 decision, rejecting a First Amendment challenge from the adult industry's Free Speech Coalition and the ACLU. The Court held, in Justice Thomas's words, that no person — adult or child — has a First Amendment right to access material obscene to minors without first proving their age. That settled the central constitutional question that had blocked these laws for two decades. But the ruling is narrower than it is often reported to be: the Court's reasoning applies to age-verification rules for certain sexual material, not to age limits in general. Courts have continued to block broader 'child safety' laws that try to age-gate social media or general-purpose websites, which raise different and harder First Amendment problems.

Why do privacy advocates oppose these laws?

Because verifying age online almost always means collecting identity, and identity collection creates risk that did not exist before. The EFF's objection is not that protecting children is unimportant — it is that these laws force every adult user to surrender anonymity and hand sensitive personal data to websites or verification vendors just to access lawful content, creating honeypots of exactly the data that gets breached. When a site or its age-checking contractor logs that a specific identity accessed specific content, that record exists somewhere, and records leak. The concern is compounded by scope creep: a legal framework built for pornography is already being extended toward social media and app stores, where it would mean identity-gating far more of ordinary internet life. Privacy advocates see a mechanism that normalizes proving who you are to browse, which is a foundational shift in how the internet works.

What happened in the UK with the Online Safety Act?

The UK offers the clearest real-world preview of what strict age verification does at scale, and it is not reassuring. The Online Safety Act's rollout produced immediate, documented side effects: journalistic and news content was caught and blocked by overbroad filters, and VPN usage in the UK spiked sharply as people refused to hand over identity documents to access online spaces. Rather than build compliant verification, some websites simply chose to block UK access entirely. The pattern — censored legitimate content, a surge in circumvention tools, and services geo-blocking an entire country rather than comply — is precisely what critics predicted, and it is the trajectory the US Supreme Court's Paxton decision arguably puts the United States on.

Do people just use VPNs to get around it?

In large numbers, yes, and the data makes the circumvention undeniable. Every time a state's law takes effect or a country tightens its rules, VPN demand in that place spikes — the UK's Online Safety Act rollout is the most documented example, but the same pattern appears after US state laws. This is why some laws have started targeting the workaround itself: Utah's SB 73, aimed at VPN use, took effect on 3 September 2026. The state first agreed not to enforce it against Aylo, Pornhub's parent company, while Aylo's federal challenge was pending. Then, in late September, Judge David Barlow blocked the VPN provisions with a preliminary injunction (a temporary court order while the case continues). The circumvention is straightforward because a VPN makes a user appear to be somewhere the law does not apply — which also demonstrates the laws' core practical weakness. They are trivially avoidable by anyone motivated, meaning the people most reliably affected are ordinary adults who won't bother, not the determined minors the laws are meant to stop.

Which platforms have blocked access instead of complying?

Pornhub, one of the most-visited sites in the world, has repeatedly chosen to block entire states rather than implement age verification — it suspended service in Texas, and its parent company Aylo has blocked access in most states with these laws rather than build verification systems. The company's stated position is that ID-based checks endanger user privacy and simply push users to less responsible sites that ignore the law entirely, which it argues makes children less safe, not more. Whether one accepts that reasoning or sees it as a company dodging compliance, the observable effect is real: in many states the major regulated platform is dark, while unregulated ones remain a click away, and the law's practical result is a redistribution of traffic rather than a wall.

Is this spreading beyond pornography?

Yes, and that expansion is what privacy advocates watch most closely. The App Store Accountability Acts passed or advancing in states like Texas, Utah, Louisiana and California would push age verification down to the app-store and device level. California signed A.B. 1709 on 10 September 2026. From 1 January 2027 it bars covered platforms from giving under-16s addictive features such as algorithmic feeds and autoplay. Platforms must check age under the state's Digital Age Assurance Act before offering them. An April 2026 draft would have barred under-16s from holding accounts at all. The signed law lets them keep accounts without those features. The UK is separately moving toward restricting social media for young people. Each of these goes well beyond the sexual-content category the Supreme Court's Paxton ruling actually blessed — and courts have repeatedly found that age-gating social media or general-purpose sites is far harder to square with the First Amendment. The direction of travel, though, is unmistakable: from a narrow rule about pornography toward a general expectation that you prove your identity to use the internet.

What does this mean for my privacy right now?

Practically, three things. First, if you are in a state with an active law, accessing covered sites may require handing ID or a face scan to a site or a third-party verifier — and you should assume that interaction can be logged, whatever the privacy promises. Second, the safest privacy posture is to minimize what you hand over: verification methods are not equal, and a system that checks age without retaining identity is far preferable to one that stores a copy of your license, though you rarely get to choose. Third, understand that the legal and technical landscape is moving fast and mostly in one direction, toward more identity-gating of more of the internet — so the broader defensive skills this site covers, from understanding what data brokers hold to reducing your overall footprint, are the durable response. Age verification is one instance of a general trend: the steady erosion of anonymous browsing. Treat it as such.

How does Discord verify age in 2026?

Since the week of 22 September 2026, Discord sorts most accounts into an adult or teen age group automatically. It uses an age estimation model built on account signals such as account age, the servers and games you are connected to, and how active you are. Discord says the model does not look at messages, calls or other content, and that more than 90% of users will not be asked to confirm their age. Accounts in the teen group, or not yet classified, get teen protections by default: blurred sensitive media, no access to age-restricted servers and channels, message requests switched on, and no speaking on Stage. To confirm you are an adult you can use a credit-card check (k-ID passes the card to Stripe), an age range from the Apple App Store or Google Play, a Google Wallet passport ID pass, an AgeKey, an on-device video selfie, or an ID scan plus selfie. Discord says it receives only an age signal and that vendors must delete what you submit once the check is complete.

How does the Roblox face scan age check work, and is the photo kept?

Roblox has required an age check to use chat since early December 2025 in Australia, New Zealand and the Netherlands, and worldwide since early January 2026. The check uses your device camera for Facial Age Estimation run by the vendor Persona. Roblox says the images and video are deleted immediately after processing. The result places you in an age group from under 9 up to 21+, and by default you can chat only with your own group and the ones next to it. Users aged 13 and over who think the estimate is wrong can verify with a government ID instead, and a linked parent can change a child's birthday once. Roblox's help page does not say how long ID images are kept.

Do YouTube and Google use AI to estimate my age?

Yes, in the US. In July 2025 YouTube and Google said they would start using machine learning to estimate whether a signed-in user is under 18, beginning with a small set of users. The estimate uses signals already tied to the account, such as the kinds of things searched for, the categories of YouTube videos watched, and how long the account has existed. If you are estimated to be under 18, personalised ads are switched off, YouTube wellbeing reminders and recommendation safeguards turn on, Maps Timeline is disabled, and adult-restricted Google Play apps are blocked. Adults who are wrongly flagged can verify with a government ID or a selfie, and YouTube also accepts a credit card. Google says the estimate does not involve collecting additional data, but its announcement does not say how long an uploaded ID or selfie is kept.

Is OSINT legal?The other big privacy-vs-access legal question — CFAA, GDPR and the FCRA trap.Max Intel guide Remove yourself from people-search sitesReduce the footprint that identity-collection systems can draw on.Max Intel guide OSINT OpSecThe durable response to a more identity-gated internet: minimize what you expose.Max Intel guide Flock Safety 2026Surveillance in physical space — the offline half of the same story.Max Intel guide