US age verification laws: the 2026 map

Regime one: adult-content age gates

The oldest and widest family, and the one with the clearest judicial blessing: statutes requiring commercial websites with substantial sexual material harmful to minors to verify users are adults, pioneered by Louisiana in 2023 and now spanning roughly half the states, with the Supreme Court's Free Speech Coalition ruling confirming states may impose verification rather than relying on home filtering. The family's enforcement mix includes state attorney general actions and, in several states, private rights of action, and its operational teeth have been real: major adult platforms geo-blocked entire states rather than verify, while compliant operators adopted document checks, transaction-data methods, and increasingly facial age estimation as the low-friction route. The design lesson from three years of this regime: single-method compliance fails someone, documents exclude the undocumented adult, estimation needs an escalation path, so the statutes' "commercially reasonable method" language is converging in practice on layered menus.

Regime two: social media minor protections

The second family regulates platform relationships with known minors: parental-consent requirements for minor accounts, feature restrictions, curfews on notifications, and data-processing limits, enacted across a belt of states with varying survival rates in court, early versions in Arkansas and Ohio were enjoined on First Amendment grounds, while narrower drafting keeps later versions alive. The family's center of gravity is the knowledge problem: obligations attach to users the platform knows or should know are minors, which, as the federal debate's knowledge standards show, converts directly into age assurance pressure without mandating any method. Platforms operating nationally now treat the strictest live state standard as the floor, because maintaining fifty behavioral profiles is costlier than one compliant one, and because discovery in any one state's enforcement action reads the platform's conduct everywhere.

Regime three: California's bracket architecture

California runs its own layer and exports it. AB 1043 routes age through the operating system, device-level signals attesting one of four brackets, under 13, 13 to 15, 16 to 17, adult, to apps that must consume them; AB 1709 hangs the under-16 addictive-feed ban on that verification; and the chatbot audit law extends the logic to AI companions, with penalties reaching $50,000 per affected minor, the regime our bracket-law coverage details. The bracket design matters beyond California because it legislates the layered answer: the device signal is the cheap first tier, and the platform's duty begins where the signal is absent, implausible, or contested, exactly the signal-plus-session architecture regulators abroad are converging on.

Regime four: category rules with age at the core

Around the three general families sit the category regimes where age is a licensing condition. Online gambling and sportsbooks verify age and identity under state gaming law, the state-by-state sportsbook map this publication maintains; alcohol and cannabis delivery carry age-at-the-door duties; and app-store accountability statutes, led by Utah and Texas, push age assurance to the distribution layer, obligating stores to verify ages and obtain parental consent for minors' downloads, an architecture Australia's codes paralleled and app platforms are now building against. Category regimes are the least forgiving: age failure is a license event, not a fine, which is why gaming operators ran layered verification years before the content statutes existed.

The method expectations hardening

Across all four families, the method conversation has converged on a few hard-won standards. Single signals fail: card possession, self-declared birthdates, and bare device signals have each been found insufficient somewhere, by statute, regulator, or court. Estimation is accepted where anchored: facial age estimation with liveness underneath and buffer policies at the boundary has become the workhorse, with the verification-estimation-inference taxonomy supplying the shared vocabulary. Privacy constraints bind the design: several statutes mandate data minimization and prompt deletion for verification data, which favors estimate-and-discard flows and credential methods disclosing only the age fact. And evidence is the compliance artifact: per-decision records of method, signal, and outcome are what distinguish a defensible program in an AG inquiry, the posture the deepidv platform treats as a first-class output.

Building for the whole map

The architecture that serves every regime at once is the one this publication has described across jurisdictions: consume signals where they exist, OS brackets, account history, as the free tier; verify the present user with liveness-anchored estimation as the default gate; escalate to documents or credentials on contest, boundary, or category stakes; keep equal-assurance fallbacks so no legitimate adult is locked out; and write every decision into one evidence trail with the method named. A platform running that stack reads each new statute, state or federal, as configuration: a new threshold here, a reporting format there. The alternative, building per-statute, produces the compliance archaeology currently visible in the industry: five age systems, none of them defensible, and a map that adds a new rulebook every quarter.

The litigation layer: what survives and why

Three years of court tests have produced a usable pattern for what survives constitutional challenge, and platform counsel should know it cold. Adult-content verification statutes survived because the Supreme Court treated them as regulating minors' access to sexual material, a historically permissible aim, with verification as an incidental burden on adults, which is why the statutes that hew closely to the harmful-to-minors definition stand while broader content reaches invite trouble. Social media regimes fared worse where they conditioned adults' access to protected speech on identification, the ground on which early injunctions landed, and better where they regulated design features and data practices for known minors rather than gating speech. California's bracket architecture was drafted against exactly that map: the device signal mechanism burdens no adult's access, duties attach to platform design rather than content carriage, and penalties hang on knowing violations. The practical compliance read: statutes keep being drafted toward the surviving shapes, device signals, design duties, knowledge standards, estimation-friendly method language, so building for those shapes is building for the statutes that will exist in two years, not just the ones enforceable today. And the disclaimer pattern, bills denying they mandate verification while their liability structures reward it, is now the standard legislative texture on both coasts and in Washington.