Age verification laws: 27 states, one ID database, and who gets paid

Short answer: What do age verification laws actually do? They make you prove who you are before you can read, watch or download parts of the internet, usually by handing a face scan or a government ID to a private company you have never heard of. Since Louisiana's law took effect on Jan 1 2023, 27 US states have put one in force, the Supreme Court blessed the model 6-3 in June 2025, and the UK, Australia and California have gone further. "Protect the kids" is the bow on the box. Inside the box is an ID check for the internet, and the companies selling the checks are among the few clear winners.

TL;DR: Federal lobbying filings that mention "age verification" went from 0 in 2021 to 31 in 2025 and 64 so far in 2026, while vendors raised big money: Persona closed a $200M round at a $2B valuation, and UK age-check firm Yoti grew revenue from £11.5M in 2023 to £29.0M in 2025. When Britain switched on its checks in July 2025, daily mobile VPN users more than doubled, from about 650,000 to over 1.4 million, so the motivated walked around the wall while everyone else got logged. Meanwhile, ID images collected to prove age leaked from Discord's vendor (about 70,000) and from the Tea app (13,000 selfies and IDs), which is the risk you inherit every time a law makes you upload one.

Key numbers

What	Number	Source, checked Oct 25 2026
US states with an adult-site age verification law in effect	27 (0 before Jan 1 2023)	Free Speech Coalition state AV law table, Tensorust count
States with a law in effect, by end of year	2023: 6, 2024: 15, 2025: 25, 2026: 27	Tensorust count from the FSC effective dates
Supreme Court, Free Speech Coalition v. Paxton	Texas law upheld 6-3, Jun 27 2025	Opinion, No. 23-1122
Federal lobbying filings mentioning "age verification"	2021: 0, 2025: 31, 2026 (to Oct 25): 64	Senate LDA API, Tensorust pull
UK daily mobile VPN users after age checks began	about 650k before Jul 25 2025, peak over 1.4M mid-Aug, about 900k in Nov	Ofcom, Online Nation 2025
UK visitors reaching age-assured adult services, per day	7.8 million	Ofcom, Online Nation 2025
Proton VPN UK sign-ups after the switch-on	up more than 1,400%	The Register, Jul 28 2025
Persona funding	$200M Series D at $2B valuation, Apr 30 2025	FinTech Global
Yoti revenue	£11.5M (2023), £17.9M (2024), £29.0M (2025)	Yoti CEO update, Jan 2026
ID photos exposed at Discord's age-appeal vendor	about 70,000	The Record, Oct 9 2025
Tea app verification selfies and IDs exposed	13,000 (72,000 images in all)	KTVU, Jul 26 2025
Australian under-16 accounts deactivated, removed or restricted	4.7 million, first month after Dec 10 2025	Prime Minister of Australia

The kids are the pitch. The ID layer is the product

Here is the flat claim: age verification is not a child-safety feature. It is the first national identity check for the internet, built state by state so nobody had to vote on it as one thing.

It started small. In 2022 Louisiana passed a law requiring sites where a third or more of the content is adult material to check government ID or "transactional data" through a commercial verification system. Three years later, the Free Speech Coalition's own table lists 27 states with a law in effect, from Louisiana on Jan 1 2023 to Iowa on Jul 1 2026.

Every one of those laws has the same quiet requirement in the middle: to prove you are old enough, you have to prove you are someone. The kid is the reason given. The adult is the one who gets carded.

The copy-paste spread, by the numbers

Six states had a law in effect by the end of 2023. Fifteen by the end of 2024. Twenty-five by the end of 2025. The FSC calls them "copycat legislation," and the dates back that up: a single model, cloned across red and purple states in under four years.

Then came the green light. On Jun 27 2025, in Free Speech Coalition v. Paxton, the Supreme Court upheld Texas's law 6-3 and ruled it only "incidentally" burdens adults' speech, so it needs to pass intermediate scrutiny instead of strict scrutiny. For two decades, courts had struck down this kind of law; in 2004 the Court killed the federal COPA partly because parents' filtering software was a less restrictive option. That door is now open.

And the scope is already moving past adult sites. Utah passed the first law making app stores verify ages, and Texas followed. California's Digital Age Assurance Act (AB 1043), signed Oct 13 2025 and effective Jan 1 2027, makes every operating system ask for your birth date at device setup and send an age signal to apps, with penalties of up to $7,500 per affected child. That is not a content rule. That is plumbing.

Follow the money: the lobby that did not exist in 2021

We pulled every federal lobbying disclosure whose issue text mentions "age verification." From 2019 through 2021 there were zero. In 2022 there was one. In 2025 there were 31, and 2026 already has 64 with two months left.

That curve is what an industry being born looks like. A trade body already exists to speak for it: in a 2022 submission to the UK Parliament, the Age Verification Providers Association described itself as the global trade body for 25 of the main age-assurance suppliers. And the money followed the mandates:

• Persona, an identity verification company, raised $200M at a $2B valuation on Apr 30 2025, led by Founders Fund and Ribbit Capital.
• Yoti, the British face-scan age checker, grew revenue 62% in 2025 to £29.0M, up from £11.5M in 2023, says it has run over 1 billion age checks in seven years, and has been EBITDA profitable every month since March 2025.
• k-ID, which sells age-compliance plumbing to game developers, raised a $45M Series A in June 2024 led by Andreessen Horowitz and Lightspeed.

None of that is a crime. It is a market doing what markets do when a law creates guaranteed demand. Our point is simpler: when every new statute is also a new sales channel, the people selling the checks are not neutral witnesses about whether the checks are needed.

Meta's move: make Apple carry the ID

The most revealing player is not a vendor. It is Meta.

Bloomberg reported, citing three people familiar with the funding, that Meta helps fund the Digital Childhood Alliance, the coalition pushing the App Store Accountability Act model bill in the states; Meta said it has "collaborated" with the group. Those bills move the age check off Instagram and onto Apple and Google's app stores. Apple's side answered through the App Association, which ran ads in Texas, Alabama, Louisiana and Ohio against the bills, and the Wall Street Journal reported that Tim Cook personally lobbied Texas Governor Greg Abbott to veto. Abbott signed it anyway, and Meta, X and Snap applauded.

Read that as a business fight, because it is one. Whoever runs the check owns the liability and the identity rail. Meta wants Apple to hold it. Apple wants nobody to. Neither side is arguing about whether you should have to show papers.

The moral coalition writes the pitch. The FSC lists the groups it says pushed the adult-site bills, including the American Principles Project, which calls itself "a leading group pushing for the adoption of age verification laws." But pitches do not build infrastructure. Vendors build it, platforms decide who has to install it, and lawmakers make it mandatory.

The strongest case for the laws, and why it fails

Here is the other side at its best. Kids really are hitting hardcore content and predatory spaces far too young. Parents are outgunned by platforms engineered for engagement. The Supreme Court found a legitimate state interest. And the checks do something measurable: Ofcom found Pornhub's UK unique visitors fell 31% in the first month after Britain's checks began, with xHamster down 28% and XVideos down 24%.

Now take it apart.

First, the drop is not the same as protection. Ofcom's own 2026 follow-up says traffic fell at sites that added checks while traffic at services that never added them stayed broadly stable, and it lists migration to unchecked services and uncounted VPN use as possible causes. Moving a teenager from a moderated giant to an unmoderated corner of the web is not a safety win.

Second, the wall leaks by design. Britain's daily mobile VPN users more than doubled, from about 650,000 to over 1.4 million in mid-August 2025, and were still near 900,000 in November, per Ofcom. Proton reported UK sign-ups up more than 1,400%. Lawmakers in Michigan and Wisconsin have already floated restricting VPNs, which tells you where this goes when the first wall fails: the next wall.

Third, the people who comply carry all the risk. Ofcom counts 7.8 million UK visitors a day reaching adult services that now run age assurance. Every one of those is a check, and checks create records. The record is the asset, and assets leak.

The breach list is the real cost of the law

The vendors promise they delete your face and your license. The incident record says the data sticks around long enough to be stolen.

• AU10TIX, which verifies users for TikTok, X and Uber, left administrative credentials to a logging system exposed for more than a year; researchers found it surfaced names, birthdates and images of ID documents, as 404 Media reported in June 2024.
• Tea, a dating-safety app, confirmed in July 2025 that 72,000 images were exposed, including 13,000 selfies and photo IDs submitted for verification.
• Discord said in October 2025 that about 70,000 users may have had government ID photos exposed at a vendor it used to review age-related appeals.

Note the Discord detail. Those were not even the primary checks. They were the appeals, the people who got wrongly flagged as kids and had to send a passport to get their account back. The system punishes its own errors with a data grab.

Every new law multiplies this. Twenty-seven states, an app-store layer, an operating-system layer in California, an under-16 ban in Australia that has already touched 4.7 million accounts. Each one is another place your ID or your face gets processed by someone who will eventually make a mistake.

Why it feels like nothing happened

Attention tells the story. Hacker News, where engineers argue about this for sport, ran 14 stories matching "age verification" in 2022. In 2025 it ran 180, and 2026 has 295 so far. On Wikipedia, the Online Safety Act article went from 260 human views on Jul 18 2025 to 17,615 on Jul 26, the day after Britain's checks began.

Spikes like that fade. That is the trick. Each law arrives as a local story about one state and one category of site, the outrage burns for a week, and the infrastructure stays. Nobody voted on "should the internet require ID." Voters were asked, 27 separate times, whether they were against kids seeing porn.

Our bet, stated plainly: within five years the age signal becomes the identity signal. California already requires the operating system to know your age bracket and tell every app. Vendors already sell reusable age credentials. The short step from "this device belongs to an adult" to "this device belongs to this adult" is a product decision, not a legal one, and the incentive to take it is the same per-check revenue that built the industry. Nobody has proven that is the plan. The pattern says it is the path of least resistance.

The fix that actually protects kids is the one nobody sells

We are pro-builder and pro-parent, so here is the alternative we would ship. Do the check on the device, under the parent's control, and never send it anywhere.

• On-device controls: the parent sets the age once on the kid's phone, and filters run locally. That is the "less restrictive alternative" the Supreme Court pointed to in 2004, and it is cheaper now than ever.
• Prove, do not reveal: if a site needs an answer, it should get one bit ("over 18: yes") from a credential that stays on your phone, never an image of your license.
• Delete by default, provably: any law that mandates checks should ban storing ID images at all, with penalties bigger than the per-check fees.

Notice who loses money under that plan: the vendors whose business is processing your documents, and the platforms that want the liability parked elsewhere. That is exactly why it is not the plan.

For the wider pattern, read how America already runs a private social credit score, how your employer feeds Equifax your pay history, and why AI agents threaten the app store toll booth at the center of this fight. More in Opinion and AI industry.

What this means for you

If you are a person: set age limits on your kids' devices yourself, and treat any site that asks for a photo of your ID as a breach waiting to happen. Prefer methods that run on your phone and say so. If a check offers face estimation that deletes on the spot or a card check, pick that over uploading a passport.

If you ship an app or a site: this lands on you whether you sell adult content or not. Plan now to read an age-bracket signal from the operating system (California's starts Jan 1 2027), collect the least you can, and never store an ID image. If you are not sure what your app collects, leaks or keeps, that is the first thing to find out.

That is what our $49 Launch Check is for: we read your live app the way an attacker does, list what it collects and exposes, worst first, with the exact fix. If a problem we checked turns up later, we keep fixing it at no extra cost until it does what it promises. Run a $49 Launch Check.

Sources

• Free Speech Coalition, State Age Verification Laws (effective dates), checked Oct 25 2026
• Free Speech Coalition, Age Verification Bill Tracker, checked Oct 25 2026
• Free Speech Coalition, Who's Behind Age Verification Legislation?, checked Oct 25 2026
• US Supreme Court, Free Speech Coalition, Inc. v. Paxton, No. 23-1122, Jun 27 2025
• California AB 1043, Digital Age Assurance Act, signed Oct 13 2025
• US Senate Lobbying Disclosure Act API, filings whose specific issue text matches "age verification", 2019 to 2026, pulled Oct 25 2026
• Ofcom, Online Nation 2025 report, Dec 10 2025
• Ofcom, Report on the use of age assurance, 2026
• The Register, UK VPN demand soars after debut of Online Safety Act, Jul 28 2025
• EFF, Lawmakers Want to Ban VPNs, Nov 13 2025
• FinTech Global, Persona hits $2bn valuation following $200m funding round, Apr 30 2025
• Yoti, Thoughts from our CEO, Jan 2026
• GeekWire, k-ID raises $45M, Jun 2024
• Age Verification Providers Association, written evidence to the UK Online Safety Bill committee, May 2022
• Pixel Envy on Bloomberg's report, Lobbying firms funded by Apple and Meta are duelling on age verification, Mar 19 2026
• Business Standard (Bloomberg), Meta clashes with Apple, Google as US states push age verification laws, Jul 26 2025
• The Record, Discord says government IDs exposed in vendor breach, Oct 9 2025
• KTVU, Tea app suffers major data breach, Jul 26 2025
• Malwarebytes on 404 Media's AU10TIX report, Jun 2024
• Prime Minister of Australia, 4.7 million accounts deactivated, removed or restricted, Jan 2026
• Wikimedia REST API, pageviews for Online Safety Act 2023 and Virtual private network, pulled Oct 25 2026
• Hacker News Algolia search API, story counts by year, pulled Oct 25 2026