U.S. State Age Verification Laws Update: 27 States and Counting (Late 2026 Tracker)

Tracker checked September 24, 2026. 

A visitor opens an adult website in Louisiana, then another in Kansas. Both states require an age check. The details, however, differ: Kansas uses a lower threshold for how much covered content brings a site within its law, and the states describe acceptable verification methods differently. A business operating nationwide has to account for those differences before it decides what to ask its users to do.

That is why a national count is useful as a starting point, but a poor implementation plan.

In its July 8, 2026 update, the Free Speech Coalition (FSC) listed 27 states with age verification laws targeting adult websites and identified their requirements as currently in effect. Its separate bill tracker displays a different count. For this article, the dated 27-state list supplies the scope; each law’s text and current court status remain the sources to check before publication or deployment.

What does “27 states” mean?

These laws generally address access to material a state defines as harmful to minors. Most require covered sites to establish that a visitor is 18 or older before showing that material. Many apply when roughly one-third of a site’s content falls within the statutory definition. Others use a different test.

Kansas, for example, sets its trigger at covered material appearing on at least 25% of webpages viewed in a calendar month. Ohio, South Dakota, and Wyoming do not use the familiar one-third minimum in the FSC’s comparison. The definitions of covered content, the entities responsible, and the methods a site may use also vary.

A count may change because a new law takes effect, a court blocks enforcement, a legislature amends a statute, or a tracker counts enacted laws alongside effective ones. Social media and app store measures are separate categories. Calling all of them “age verification laws” without saying what they cover obscures the question a business needs answered: Does this particular rule apply to this particular service and user?

State-by-state adult website tracker

The table below summarizes the 27 states on FSC’s effective-law list. All dates are the dates FSC lists for the adult website requirement taking effect, including dates affected by earlier court orders. “ID” means government-issued or qualifying digital identification; “transactional data” means an age check using qualifying public or private records. “Private action” means that an eligible person may sue under the law. These are short descriptions, not a substitute for the linked statutes.

Status as of September 24, 2026: FSC lists each requirement below as in effect. That status describes the adult website requirement; it does not establish that every provision is enforceable or that litigation has ended. The notable Texas and Tennessee proceedings are discussed after the table. The table does not claim a complete docket search for every state.

The differences extend to data handling. A business must inspect the applicable law’s limits on retaining, sharing, or using information gathered for an age check, because collecting sensitive verification data increases data liability and raises privacy concerns when retention rules are unclear. Many age verification requirements for age-restricted online services are satisfied, depending on the state, through methods used to verify age such as uploading a government ID or biometric checks. Louisiana’s law, for instance, prohibits retaining identifying information used for verification. Florida’s statute requires a choice between standard and anonymous verification and points to separate requirements for the verification process. Neither rule should be assumed to describe every state’s privacy obligations.

For a production compliance register, add a direct link to each state’s current statutory text, its precise deletion and disclosure provisions, the responsible party, and a dated check of relevant orders and regulations. FSC links to the underlying laws from its state-law FAQ. Robust age verification methods support compliance and help reduce legal issues, while non-compliance can trigger severe penalties. Those checks matter particularly where a state permits a “commercially reasonable” method: that phrase does not, by itself, approve every age estimation technique.

What Free Speech Coalition v. Paxton changed

On June 27, 2025, the U.S. Supreme Court upheld Texas HB 1181 against the First Amendment challenge before it. The Court held that the adult website age verification requirement was subject to intermediate scrutiny and survived that review. Before that ruling, the texas law had already been upheld by a federal court at the appeals level in 2025. For operators of covered adult sites, the ruling resolved a major challenge to Texas’s requirement and has influenced litigation elsewhere.

It did not decide that every age check for every online service is constitutional. Adult content laws can require age verification to prevent minors from accessing sexually explicit material, and those age verification mandates are meant to restrict access by minors while still facing constitutional limits. A social network’s account rules or an app store’s parental-consent system presents different facts and legal questions. Challenges to those measures need to be followed on their own terms.

Nor does “law in effect” mean “no lawsuit.” FSC describes its challenge to Tennessee’s adult website law as ongoing while listing that law as in effect. Its litigation page also retains a Texas case timeline that predates the Supreme Court’s final 2025 ruling, another reason to check dated court decisions rather than relying on a page’s status label alone. Across multiple states, such laws face legal challenges on First Amendment grounds, with opponents arguing they can increase censorship, burden online speech, and limit adults’ access to protected speech even when legislatures mandate age verification to curb youth access.

Social media and app stores: a separate set of rules

The adult website tracker answers a narrow question. Many states in the U.S. now target minors’ access to social media accounts, including nine states that enacted age verification laws for social media in 2025. A social media service may instead face rules about a minor’s account, parental permission, time limits, or particular features under broader online safety laws. An app store law may place an age-check obligation on the store and set separate duties for app developers. The National Conference of State Legislatures tracks these developments across its social media and children legislation pages.

Florida’s HB 3 illustrates why the distinction matters: it contains provisions addressing both adult material and social media, with different operative requirements, and Florida became the first state to enforce a ban on certain social media accounts for minors under 14 in November 2025, with requirements continuing into June 2026 and parental consent required for minors aged 14 or 15. Texas likewise has an app store law separate from the adult website statute decided in Paxton. The Supreme Court declined to block the app store law at an interim stage in July 2026; that was not a final ruling on its constitutionality. Texas also became the first state to enforce app store age verification in 2026, including checks for creating Apple accounts since June 2026. Internationally, the Australian government began enforcing a ban on social media platforms for users under 16 in December 2025, required age verification for those users, and blocked or deactivated more than 310,000 accounts, yet 7 in 10 young people still accessed banned platforms, underscoring that age verification laws often fail to keep minors off online content. The UK applied its online safety bill through the Online Safety Act on July 25, 2025, and Brazil followed with a proposed law model in its Digital Statute for Children, mandating verification starting March 17, 2026. In practice, age assurance often means services must verify users ages and obtain parental consent from a parent or legal guardian before certain online services are available.

For businesses, the first question is therefore about classification. Do you publish covered adult material, operate a social platform, distribute apps, sell an age-restricted product, or do more than one of these? Each answer points to a different legal review. California law adds another signal: the Digital Age Assurance Act takes effect on January 1, 2027, showing that operating system level and platform-level rules are expanding.

How to build an age check that meets age verification requirements and works for users

A sound flow begins with the requirement, then chooses the technology, because an effective age verification process has to balance privacy with compliance.

1. Decide when access needs to stop. If a law requires verification before covered material is displayed, a check after the content loads will miss the point. Place the step at the actual access boundary, including direct links and returning sessions, to help protect children from harmful content and, in some contexts, cyberbullying.

2. Match the method to the state. An ID check, a qualifying database query, and facial age estimation do different jobs. A state that specifies ID or transactional data may not accept a standalone face estimate. Where a method must meet a named assurance standard, document how it meets that standard before making it the route to access.

3. Give uncertain users a route forward. An estimate close to the minimum age should lead to an appropriate second check, not an automatic assumption that the person is an adult. Explain the result plainly and provide an accessible alternative for users who cannot complete the first method.

4. Keep only what is needed. Design age gating so it answers only the question the service needs answered—such as “18 or older”—and minimizes data collection while maintaining user privacy. Check the applicable rules before storing an image, ID number, birth date, or verification record, and apply the same scrutiny to vendors and retention settings.

5. Make the result trustworthy. Validate verification results on the server, protect tokens from reuse, and record which policy and method produced a decision. Reverification may also be required: Tennessee’s 60-minute session rule and Ohio’s rule for ongoing accounts show why a permanent “verified once” flag deserves a closer look.

A low-friction experience is valuable. It still has to satisfy the specific law governing the user’s access.

Where Agemin fits

Agemin offers facial age estimation, an ID-document option, and SDK and API integration for adding an age check to a website or app, and those age verification systems may rely on biometric estimation or government ID upload depending on the legal requirement. Its developer documentation describes server-side validation of verification results and an ID flow that returns an age decision without sending the business the document holder’s name, birth date, document number, or document image.

Those capabilities give a business options when designing its flow. Some laws now expand age verification to the operating system level, so a business may need to verify age through os level age verification, match its age assurance target, and use the most technologically feasible methods or other technologically feasible methods accepted in that jurisdiction. An age estimate may suit a use case where the applicable rules accept it; a jurisdiction specifying another method may call for a different route. The practical task is to map the law, choose an appropriate level of assurance, configure the user journey, and check what data the entire process retains.