Surveillance watch · online age-verification & ID laws
Color shows each jurisdiction's strongest age-verification status (any law type). Toggle layers to overlay social-media laws (diagonal stripes) and VPN restrictions (dots). Active laws are shaded by intrusiveness.
How far a law reaches once it's in force. VPN News' assessment, not an official rating.
&
28 states enforcing on this date. Drag to watch the wave build, or push past Jan 2027 to see California switch on.
Most shared
The most-shared reporting on age checks and digital-ID laws right now.
One state at a time, America is building a system that makes you prove who you are to use the internet. It starts with adult sites. It doesn't end there. This map tracks the spread, and advances on its own as each law takes effect.
Data last reviewed 2026-09-23 · Laws requiring age verification to access adult / sexually-explicit websites (the post-Free Speech Coalition v. Paxton wave). Social-media and app-store age laws are tracked separately.
The case against
Age verification sounds simple. In practice it forces every adult to hand sensitive identity documents to private companies, ends anonymous access to lawful speech, and lays the track for a papers-please internet. Here's why we oppose it.
To reach lawful content you upload a government ID or submit to a face scan, often handed to a third-party vendor. That creates a record tying your real name to what you looked at. Such records get breached, subpoenaed, and sold. The risk isn't hypothetical.
The Supreme Court that upheld these laws conceded they burden adults' speech. Reading and watching without showing your papers is part of free expression. Strip it away and lawful behavior is chilled far beyond the stated target.
The same age-and-ID machinery is already spreading to social media, app stores, and anything a legislature labels "harmful to minors." Each new law normalizes an identity checkpoint for one more corner of the internet.
Mandatory age checks are the on-ramp to an internet where access to ordinary services depends on proving who you are. That's a civil-liberties problem dressed up as a parenting tool, and it lands on everyone, not just the people lawmakers name.
And it doesn't even work. A determined teenager reaches a VPN or an offshore site in seconds. The lasting effect isn't safer kids. It's law-abiding adults surveilled, and traffic pushed toward sites with fewer safeguards, not more.
The spread, 2022 to today
These laws are spreading across the country like a virus. Year by year, state by state, watch the map turn red.
0 states enforcing ID checks
Federal / National
Laws and bills that would apply nationwide rather than in one state. On the map these sit at Washington, D.C., marked Federal / National. They're tracked apart from the state choropleth and aren't counted in the states-enforcing totals.
S. 1586 / H.R. 3149 (119th Congress)
Would require app stores to verify the age category of every user and obtain verifiable parental consent before a minor can download an app or make a purchase, with enforcement by the Federal Trade Commission and the states. Introduced in May 2025 and considered in committee, including a House Energy and Commerce markup, it has not been enacted. Supporters say it puts age checks and parental consent at the app-store level; privacy and free-expression critics say it would make everyone verify their age to use an app store, putting sensitive ID data at risk and burdening access to lawful speech.
S. 737 / H.R. 1623 (119th Congress)
Would require websites that make available content harmful to minors, such as pornography, to use technology to verify that users are adults and block minors, enforced by the Federal Trade Commission. It bars simple click-to-confirm age checks and would route user IP addresses, including known VPN and proxy addresses, through the verification system. Introduced in February 2025 and referred to committee, it has not been enacted. Supporters say it shields minors from explicit content by the least restrictive means; privacy and free-expression critics warn it forces adults to verify identity to view lawful content and sweeps in VPN users.
S. 278 (119th Congress)
Would bar children under 13 from holding social-media accounts, require platforms to delete existing under-13 accounts and their data, ban personalized recommendation feeds for users under 17, and require schools that receive federal E-Rate funds to block social media. It would be enforced by the Federal Trade Commission and state attorneys general. The Senate Commerce Committee advanced it in February 2025 and a House companion followed, but it has not been enacted. Supporters cite youth mental health; critics, including digital-rights groups, say it cuts young people off from lawful expression and pushes platforms toward more age verification.
Kids Internet and Digital Safety Act (KIDS Act), H.R. 7757, 119th Congress -- revised KOSA + SCREEN Act + SAFE BOTS Act + COPPA 2.0
On June 29, 2026 the U.S. House passed the KIDS Act 267-117 under a fast-track suspension vote and sent it to the Senate -- the first time a version of the Kids Online Safety Act (KOSA) has cleared the House floor. The package bundles a revised KOSA with the SCREEN Act, the SAFE BOTS Act, a COPPA update for teens, and other internet bills. The revised KOSA drops its 'duty of care' but requires covered platforms to enforce policies addressing broad content categories -- drugs, tobacco, cannabis, gambling, alcohol, and financial fraud -- whenever a service 'knows or should have known' a user is a child (under 13) or teen (13 to 16). The SCREEN Act piece forces adult-content sites to verify users are adults; SAFE BOTS restricts AI chatbot features for minors; other provisions reach direct, disappearing, and encrypted messages and tighten data brokers' use of minors' data. It sets a federal floor that can override weaker state laws while still letting states pass stricter ones. Supporters say it protects minors; EFF and other critics warn it pressures services to age-check everyone, pushes platforms to police lawful speech, and undermines encryption. It now faces an uphill fight in the Senate, where the dropped 'duty of care' standard is a sticking point. UPDATE Aug 5, 2026: the Senate Commerce Committee advanced its OWN version of KOSA (S. 1748) unanimously by voice vote, alongside the SCREEN Act, the Youth AI Privacy Act and the CHATBOT Act, setting up a Senate floor vote -- and a direct collision with the House. The House package dropped KOSA's duty-of-care provision; Senate co-authors Blackburn and Blumenthal called the House version dead on arrival, and the Senate bill keeps the duty of care that a platform must exercise reasonable care to prevent enumerated harms to minors. Chairman Cruz predicts floor passage and a conference fight. Opponents (ACLU, FIRE, Fight for the Future, CDT, NetChoice) warn both versions drive age verification, reduce anonymity and incentivize content removal; backers now include OpenAI, Apple, Microsoft, X and Snap, some of whom shaped the Senate text. Calendar risk cuts both ways: the committee acted one day before August recess, and few legislative days remain before the midterms.
H.R. 8250 (119th Congress)
Would require operating-system providers to verify the age of every user at account setup and, for users under 18, require a parent or guardian to verify the user's date of birth, while giving app developers an interface to confirm a user's age category. The Federal Trade Commission would enforce it and issue rules on data security and parental controls. It places age verification at the device/OS level rather than on individual sites.
H.R. 6488 (119th Congress)
The Reducing Exploitative Social Media Exposure for Teens Act (RESET Act) would prohibit covered platforms from allowing anyone they know to be a minor -- defined as under 16 -- to create or maintain an account. Platforms would have to identify known minor accounts within 60 days of enactment, notify those users within 180 days, terminate the accounts within 30 days of notice, and delete the minors' personal data. Introduced in the House in the 119th Congress and taken up among a slate of online-safety bills at a House Energy and Commerce subcommittee hearing, it has not been enacted.
H.R. 6333 (119th Congress)
The Parents Over Platforms Act (POPA), introduced December 1, 2025 by Reps. Jake Auchincloss (D-MA) and Erin Houchin (R-IN), would split age-assurance duties between app stores and app developers. App stores (application distribution providers) would determine or estimate a user's age category and pass an age signal to developers with the user's or a parent's consent; developers would then block minors from adult-only apps, obtain consent for age-restricted content, and not serve minors personalized ads. Parents could block minors from acquiring apps. The FTC would enforce it, and it would preempt conflicting state laws. Forwarded by subcommittee to full committee; not enacted.
Guidelines for User Age-verification and Responsible Dialogue Act (GUARD Act), S. 3062 + House companion, 119th Congress
The GUARD Act would impose federal age verification on all users of AI chatbots and ban minors from AI 'companions' -- chatbots designed to simulate friendship, emotional support, or therapeutic conversation. Covered companies would have to verify age via government-issued ID or another commercially reasonable method, block minors from companion bots, repeatedly disclose that the user is talking to a machine, and face civil and criminal penalties if their systems expose children to sexual content or encourage self-harm. It gives parents no opt-out. Introduced by a bipartisan group led by Sens. Josh Hawley and Richard Blumenthal (with Katie Britt, Mark Warner, and Chris Murphy) and a House companion from Reps. Blake Moore and Valerie Foushee, it advanced out of the Senate Judiciary Committee in 2026. Critics including EFF and Reason warn it would push ID checks onto everyone and chill lawful speech.
FTC 2026 COPPA Policy Statement
The FTC's 2026 COPPA Policy Statement effectively grades age-verification technology, and the grading matters more than any single state statute because it shapes what vendors build nationwide. The Commission says it will exercise enforcement discretion for tools that are accurate, secure, give clear notice and MINIMISE DATA RETENTION; tools that quietly accumulate identity data are not favoured. Self-declared birth years are insufficient where a statute requires effective assurance, while photo-ID matching with liveness detection, accredited digital identity and validated age estimation are accepted where statutes permit. Several state adult-content laws separately forbid verifiers from retaining identifying information from a check. The practical convergence -- prove the threshold, keep almost nothing -- is the one design that reduces the breach exposure this site tracks elsewhere: an ID vault that is never built cannot leak. COPPA's own scope is unchanged, covering services directed at under-13s, but enforcement has become markedly more active.
Every state, tracked
All 50 states plus Washington, D.C. Open any state for its laws, bills, effective dates, intrusiveness, and primary sources.
No match. Try a different spelling.
Don't want to hand over your ID just to get online?
vp.net is a privacy network built to keep your connection yours. Hardware-verified, not policy-promised.
Visit vp.net →
Email that can't read your mail.
bmail is verifiably private email, so the contents of your inbox stay between you and the people you write to.
Visit bmail.ag →