Adequately Tailoring Age Verification Regulations

AI summary

Overview

Research area: AI safety, ethics, and technology law — specifically the regulation of online age verification for minors' access to pornography in the United States, and the technical trade-offs of the verification methods those laws require.

Technical level: Intermediate. The paper is written to be accessible to non-legal experts in technical and engineering domains, and it combines legal doctrine (First Amendment scrutiny standards) with technical analysis (OCR, cryptographic credentials, facial age estimation).

Scope (1 sentence): The paper maps current U.S. state age-verification legislation, proposes an analytical model for interpreting the constitutional requirement of "adequate tailoring," and evaluates three widely used age-verification approaches and one state statute against that model.

What This Paper Is About

In June 2025, the U.S. Supreme Court's decision in Free Speech Coalition v. Paxton upheld Texas H.B. 1181 and held that age-verification laws face "intermediate scrutiny," under which a regulation must be "adequately tailored" — meaning the government's interest would be achieved less effectively without it, and it does not burden substantially more speech than necessary. The ruling left unresolved how "adequate tailoring" should actually be interpreted and applied. This paper builds an analytical model that turns that legal concept into concrete, comparable variables so that policymakers, engineers, and the public can evaluate whether specific age-verification laws and technologies are appropriately tailored.

Key Contributions

1. First comprehensive evaluation combining both state-level age-verification laws and technical age-verification approaches in a single analysis, mapping the current U.S. legislative landscape.
2. An analytical model for interpreting "adequate tailoring" that pairs categories of governmental goals/interests with four measurable properties of age-assurance systems, with potential applicability beyond age verification to other online regulatory contexts such as digital IDs.
3. A technical analysis of the three main age-verification approaches (direct ID submission, verifiable digital credentials, and facial age estimation), covering their infrastructure, standards, industrial implementations, and privacy/security properties.
4. A focused case study applying the model to the Tennessee Protecting Children from Social Media Act to show how one particular law can be evaluated in the context of adequate tailoring.

Main Findings

• Twenty-five states have active age-verification laws as of January 2026. Louisiana became the first state to require pornography websites to verify users' ages beyond self-attested age, with its law effective January 1, 2023; the paper notes this sparked what some have called "the New Pornography Wars."

• The regulatory landscape is dominated by ID-based methods. Sixteen states explicitly require age verification through "submission of government-issued identification." Excluding the general "reasonable commercial method" language, sixteen states (including Arizona and South Dakota) accept traditional IDs, and thirteen states (including Arkansas, Georgia, and Indiana) accept digital IDs.

• Non-ID methods are rarely specified in statute. Only three states (Nebraska, South Dakota, Wyoming) accept financial documents; eighteen states (including Virginia) accept commercial systems based on transactional data or other databases; nine states (including Florida) accept other methods. Eighteen states permit any "reasonable commercial method."

• Privacy requirements are near-universal but vary in strength. All states except Virginia have at least some form of privacy requirement. Eighteen states (including Alabama, Arkansas, and Florida) prohibit retention of personal information after an age verification check is completed; five states (Arizona, Indiana, Missouri, South Dakota, Texas) prohibit retention of verification data at any time.

• The four-property model reveals inherent tensions. Assurance, Business Convenience, Consumer Convenience, and Data Protection are not independently optimizable; improving one tends to sacrifice another.

• Statutory vagueness is itself a burden. Most statutes permit compliance via "reasonable" or "commercially reasonable" methods without specifying accuracy thresholds or error tolerances, leaving Assurance legally indeterminate and shifting legal risk onto platforms and vendors, which lowers Business Convenience.

• Residency and location predicates strain online reality. Kentucky's framework, for example, applies to those sojourning for over 31 consecutive days, which maps poorly onto online access models, and common technical proxies such as IP-based geolocation do not reliably establish residency.

• Age-verification mandates conflict structurally with state privacy law. Enforcing age-gated access often requires processing the very data that privacy laws seek to minimize; even where non-retention or anonymization is required, initial collection may conflict with data-minimization and necessity principles.

• Verifiable digital credentials reduce data exposure relative to ID upload. Selective disclosure limits the claims revealed, and zero-knowledge proofs can prove only compliance with a threshold, potentially reducing linkability. However, they introduce accessibility, interoperability, and usability challenges.

• Facial age estimation is low-friction but faces accuracy and access barriers. Accuracy is "strongly influenced by algorithm, sex, image quality, region-of-birth, age itself, and interactions between those factors," and users with certain disabilities, atypical facial features, facial paralysis, or assistive devices may face higher failure rates.

• Verification location matters for privacy. On-device verification (Case 1) keeps raw ID images and selfies from leaving the device, reducing network exposure and third-party retention risk, but may constrain assurance by lacking issuer-side status services and being more susceptible to tampering on compromised devices. Remote verification servers (Cases 2a and 2b) improve assurance through stronger document checks and centralized fraud detection, but increase data leakage and illegal retention risks.

• Device-binding versus people-binding changes who is actually checked. Device-binding ties authorization to a device identifier, browser token, or account session, and is vulnerable to shared-device and shared-account bypass (a minor using a parent's logged-in browser or a borrowed verified device). People-binding anchors the decision to evidence that the individual present satisfies the age requirement; stronger people-binding reduces these "friendly fraud" pathways but can add friction, create accessibility challenges, and raise privacy sensitivity if biometrics are involved.

• Tennessee's statute illustrates compounding operational burdens. The Tennessee Protecting Children from Social Media Act has been effective since January 13, 2025, and imposes (1) real-time photo matching between the active user, captured on the access device between the access attempt and viewing, and the photo on a valid state-issued ID, and (2) a verification session limit of no more than 60 minutes, after which verification must be refreshed. The paper's description of a third requirement is cut off in the provided content.

• The paper takes no advocacy position. It explicitly states its purpose is not to advocate for or against age verification, any specific statute, or any particular technology, but to examine how policymakers should practically "adequately tailor" regulations involving speech, privacy, and identity.

Methodology in Plain English

The authors start by reading the 25 state statutes that impose age-verification requirements and tabulating what verification methods each law accepts and what privacy or data-retention rules each imposes. They then develop a framework that separates two things: (a) the governmental goals the statutes pursue, and (b) the properties of the technical systems used to satisfy them.

Four governmental goals are identified: preventing children's access to harmful or pornographic material, generalized child protection, privacy and security, and consumer rights protection. Four system properties are identified: Assurance (how reliably the mechanism correctly identifies who is at the point of access, especially avoiding falsely classifying minors as adults), Business Convenience (how easily platforms can implement or procure the mechanism, including lost legitimate users), Consumer Convenience (how much friction or exclusion lawful adults experience), and Data Protection (how well information privacy and data security are preserved).

The authors then categorize the three main technical verification approaches, describe their infrastructure and standards, and assess each across the four properties. They add two further layers: where verification logic executes (on-device or on a remote server) and whether credentials bind to a device or to a person. Finally, they apply the whole model as a case study to the Tennessee statute.

Why This Matters

Impact on research: The paper introduces a structured, reusable model for translating a constitutional standard into comparable technical variables, and it is described as the first comprehensive evaluation of both state age-verification laws and technical age-verification approaches together. It bridges two communities — law and engineering — that typically analyze these questions separately.

Real-world applications:

• Legislatures drafting or amending age-verification statutes can use the four-property model to see which goals a proposed verification method actually serves and which it undermines.
• Platforms and vendors choosing an age-verification implementation can evaluate trade-offs among Assurance, Business Convenience, Consumer Convenience, and Data Protection rather than optimizing for a single dimension.
• Courts and litigants assessing whether a regulation burdens "substantially more speech than is necessary" gain a systematic vocabulary for the practical burdens that constitutional analysis must weigh.
• Privacy regulators and advocates can use the framework to identify where age-verification mandates conflict with existing state privacy statutes.

Industry relevance: The paper reviews concrete standards and products already in deployment, including AAMVA PDF417 barcodes on U.S. driver's licenses, ISO/IEC 18013 selective disclosure, the W3C Verifiable Credentials data model, SD-JWT VC, OpenID for Verifiable Presentations, Apple Wallet, Google Wallet, Dock Wallet, Microsoft Entra, myColorado, Yoti Digital ID, Self, FS'24, RWG+'23, ZKPassport, and LS'25. This makes the analysis directly actionable for identity, wallet, and platform engineering teams. The authors also note that more changes are likely coming to verify other attributes in a similar way, and that these will likely also be considered under intermediate scrutiny.

Future Directions

• Extending the model beyond age verification. The authors state the framework can apply to other access restrictions, such as verifying that someone is not a bot or that someone is a resident in a particular area, and to future laws verifying non-age attributes.
• Applying the model under different scrutiny levels. The four-layer model remains useful even if the applicable level of scrutiny shifts, for example to strict scrutiny or to rational-basis review — an explicit claim the authors offer but do not fully work through.
• Resolving the legally indeterminate meaning of "reasonable." Statutes permit "reasonable commercial methods" without accuracy thresholds or error tolerances, leaving open what level of under- or over-inclusiveness will later be deemed sufficient.
• Building fallback mechanisms that avoid exclusion. The paper raises the need for alternatives such as in-person verification or non-ID methods for users without qualifying state IDs, with limited digital literacy, or without modern devices, but does not specify how these should be designed.

Target Audience

This paper is aimed at non-legal experts in technical and engineering domains who must interpret age-verification laws in the context of technical trade-offs, including verification implementers, platform engineers, and product teams building age-assurance systems. It is equally useful for policymakers and legislative staff drafting or revising statutes, legal scholars and litigants working on First Amendment and online-speech questions, and privacy researchers studying the tension between age gating and data-minimization principles. The paper notes explicitly that its purpose is to examine how regulations involving speech, privacy, and identity should be practically tailored, not to advocate for any side of the debate.

Authors’ abstract

The Supreme Court decision in Free Speech Coalition v. Paxton upheld the constitutionality of Texas H.B. 1181, one of the most constitutionally vulnerable of these age verification laws, holding that it was subject to and satisfied intermediate scrutiny and the requirement that age verification regulations be "adequately tailored". However, the decision leaves unresolved practical challenges. What is the current state of age verification legislation in the United States? How can "adequate tailoring" be interpreted in a way that is accessible to non-legal experts, particularly those in technical and engineering domains? What age verification approaches are used today, what infrastructures and standards support them, and what tradeoffs do they introduce? This paper addresses those questions by proposing an analytical model to interpret "adequate tailoring" from multiple perspectives with associated governmental goals and interests, and by applying that model to evaluate both current state laws and widely used verification methods. This paper's major contributions include: (1) we mapped the current U.S. age-verification legislative landscape; (2) we introduce an analytical model to analyze "adequate tailoring" for age verification and potential application to other online regulatory policies; and (3) we analyze the main technical approaches to age verification, highlighting the practical challenges and tradeoffs from a technical perspective. Further, while we focus on U.S. State laws, the principles underlying our framework are applicable to age-verification debates and methods worldwide.