The Kids Online Safety Act — the bill that would require covered platforms to act with the highest care for minors, enable parental tools and default to the safest settings — passed the U.S. Senate 91-3 in July 2024 and never received a House vote, despite bipartisan framing and an energetic advocacy campaign after the 2024 election pressed Speaker Johnson to move it. The obstacle was not partisanship but a coalition of strange allies: civil-liberties groups and some LGBTQ organizations warned the duty-of-care standard would incent platforms to suppress sensitive content, while the tech industry ran a quiet campaign raising the same First Amendment objections. With KOSA stalled, the operative child-safety law of the United States is now a state patchwork, whose constitutional footing was settled — surprisingly — in the states' favor.
What did the Supreme Court decide about age verification?
In Free Speech Coalition v. Paxton, decided June 2025, the Supreme Court upheld Texas's law requiring age verification for access to adult websites, rejecting the argument that the requirement's burden on adults' anonymous access rendered it unconstitutional under the intermediate scrutiny of Ashcroft v. ACLU (2004). The Court's majority treated verification as a permissible means of enforcing an already-lawful restriction — keeping minors from adult content — rather than a restriction on adult speech itself, with Justice Thomas writing that the burden of verification is modest relative to the state's interest. The practical reading across the industry: age verification, as a technology applied to content-access gating, survives constitutional challenge, which converts it from a contested mechanism into compliance infrastructure.
Which states have enacted what?
Two families of statutes. Age-verification mandates for sites with material harmful to minors — pioneered by Louisiana in 2022 and adopted by Texas, Utah, Arkansas, Mississippi, Montana and others, typically enforced by attorney-general penalties — were validated in their core mechanism by Paxton. Social-media-specific minors' bills — Florida's House Bill 3, effective 2025, which bars accounts for children under 14 and requires parental consent for 14- and 15-year-olds, alongside Utah's and Tennessee's variants — remain in earlier litigation stages, and their distinct theory (addictive design rather than adult content) is not automatically covered by the adult-site precedents. The result heading into 2026 is a compliance map: roughly a third of states requiring some verification form, platforms applying it state by state, and VPN circumvention as the shared implementation reality everyone quietly accepts.
How do platforms verify age without identity disaster?
The engineering options are narrower than the debate suggests. Document-based verification — scanning an ID — is accurate and maximally privacy-invasive, which is why several state statutes, Florida's among them, were amended to permit alternative methods. Third-party verification services issue tokens confirming over-threshold age without forwarding identity — the model Louisiana's statute built. Facial age-estimation, offered by verification vendors and deployed by major platforms for European Union rules under the Digital Services Act, adds biometric risk that privacy regulators have flagged. Declared age plus device-level signals — the App Store age-attestation framework Apple and Google announced for their ecosystems in 2025 — shifts the duty to the operating-system layer, which is where the industry's institutional preference now lies: one OS attestation, inherited by every app, is cheaper and less litigable than fifty state-by-state web gates.
What does this mean for news sites?
A specific and under-discussed exposure. News content routinely includes material states may classify as harmful to minors — war reporting, health coverage — and a verification mandate written for adult sites can sweep news archives into its perimeter. Media organizations' amicus practice in the age-verification cases has argued precisely this: that journalism is not adult content, and that treating it as such forces an age gate between readers and public-interest reporting. Where statutes include news exemptions, the definitions are doing quiet load-bearing work, and the exemptions' durability will be tested as enforcement matures.
The trajectory is legible regardless: Congress's flagship stalled; the Supreme Court cleared the states' preferred mechanism; the operating-system attestation layer is consolidating the compliance market. The next congressional attempt — KOSA's successors in the current Congress — will inherit a world where verification is no longer constitutionally contested, which changes the bargaining: the fight has moved from whether to check ages to who holds the records when the check is done.
For more context, read Media literacy is becoming state law — and curriculum fights follow it in.
For more context, read digital services act enforcement.
For more context, read net neutrality status 2025.