For most of the last decade, online age verification was a hypothetical. Legislatures passed laws, courts blocked them, and nothing much changed for the person holding the phone. That period is over. In July the Supreme Court declined to block Texas from enforcing a law requiring app stores to verify the age of users and obtain parental consent for minors, which means Apple and Google are now doing it in one of the largest states in the country.
As of last month, 21 states have passed laws regulating how minors use online platforms. Some target app stores, some target social networks directly, some target adult sites. The details vary wildly and the courts have not settled on a coherent standard. What has settled is the direction of travel, and both the people cheering and the people alarmed are responding to something real.
What The Texas Law Actually Requires
The mechanism matters more than the headline. Rather than making every individual app verify ages, Texas put the obligation on the app stores, which already have payment relationships and account infrastructure. Apple and Google must confirm a buyer’s age and obtain parental consent before a minor downloads an app. Shifting the duty upstream is the clever part of the design, and it is also why the law survived where narrower attempts have struggled.
Why Supporters Think This Finally Works
The argument for it is straightforward and has broad public sympathy. Parents cannot realistically supervise dozens of separate platforms, each with its own settings buried three menus deep. A single choke point at the app store is enforceable, auditable and hard to route around casually. Supporters also point out that we already accept age gates for alcohol, tobacco, driving and gambling, and that treating the internet as categorically different has produced a generation of unsupervised access nobody actually voted for.
Why Critics Think It Backfires
The objection is not that children should see anything. It is that verification requires identity, and identity requires data. To prove you are over 18, somebody has to hold a record of who you are, which turns app stores into identity brokers and creates a breach target that did not exist before. Courts have struck down several federal attempts on First Amendment grounds precisely because burdening adult access to lawful speech is a constitutional cost, not a rounding error.
The Privacy Problem Is Not Hypothetical
This is where I think the strongest criticism lives. Every verification scheme creates a database, and databases leak. The industry answer is device level attestation and zero knowledge proofs, where a system confirms you are over a threshold without transmitting your documents. That technology exists and is genuinely promising. It is also not what most implementations currently use, and the gap between the privacy preserving version described in legislative hearings and the version shipped in production is where the harm accumulates.
Self Attestation Is Being Explicitly Ruled Out
One clear trend across the newer bills is the death of the checkbox. Legislation now frequently specifies that clicking a box claiming to be 18 does not count, and requires what the drafters call robust verification. That closes an obvious loophole. It also removes the polite fiction that let adults access lawful content without handing over documents, and it means compliance costs land hardest on small sites rather than the large platforms with legal departments.
Twenty One States, Twenty One Rulebooks
The practical mess is the patchwork. A developer now faces different verification duties depending on which state a user sits in, with different age thresholds, different definitions of a covered platform and different penalties. Rulings have gone in conflicting directions, leaving what one legal trade publication described as a trail of uncertainty. Congress has held hearings but has not produced a national standard, and a national standard is the only thing that resolves this cleanly in either direction.
Age Assurance And Age Verification Are Not The Same Thing
A distinction gets lost in almost every news story about this, and it changes the stakes. Age verification means proving exactly who you are, typically with a government document or a credit record. Age assurance means establishing only that you are probably above a threshold, using signals like device history, behavioral patterns or a facial age estimate that is never stored. The second approach carries a fraction of the privacy risk of the first. Most statutes are written loosely enough to permit either, which means the outcome depends less on what legislatures passed and more on what compliance vendors decide is cheapest to build. That is an enormous amount of policy being set by procurement decisions nobody votes on.
It also explains why two states with nearly identical laws can produce very different experiences for the person holding the phone. If you want to know how intrusive these rules will feel in practice, watch the vendor contracts rather than the bill text.
Where I Land, With Discomfort
I think the child safety case is strong enough that dismissing it as moral panic is lazy. I also think most current implementations are worse than their sponsors believe, because the privacy engineering has not caught up with the legislative ambition. The honest position is that this is a real tradeoff between two goods, not a fight between good and bad. Anyone presenting it as obvious in either direction is skipping the part that is actually hard.
Frequently Asked Questions
What did the Supreme Court decide in July?
It declined to block Texas from enforcing its app store age verification law while litigation continues. That is not a final ruling on the law’s constitutionality, but it allowed enforcement to begin.
How many states have these laws?
As of July 2026, 21 states have passed laws regulating minors’ use of online platforms. The requirements differ substantially from state to state.
Does this apply to app stores or to individual apps?
The Texas approach puts the duty on app stores like Apple’s and Google’s, which must verify age and get parental consent. Other state laws target platforms or adult sites directly.
Can I just say I am over 18?
Increasingly no. Newer legislation explicitly prohibits simple self attestation and requires stronger verification methods.
What are the main legal objections?
Chiefly the First Amendment burden on adults accessing lawful content, plus privacy risk from the identity data these systems collect. Several federal attempts have been struck down on those grounds.
Is there a federal law coming?
Nothing has passed. Congress has held hearings, but for now the rules are set state by state. Related reading: our look at school cellphone policy changes.
