What Happened

California Governor Gavin Newsom signed the Digital Age Assurance Act (AB 1043) into law in October 2024, requiring operating systems and app developers to implement age verification systems by January 2027. The law mandates that when users download and launch applications, developers must request age signals from operating system providers, who then share users’ age ranges: under 13, 13-16, 16-18, or 18 and older.

This California law represents a unique approach compared to other states. Rather than requiring rigid parental consent frameworks like those enacted in Texas and Utah, California’s system relies on self-reported age information provided during account setup. Violations carry civil penalties of up to $2,500 per affected child for negligent violations and $7,500 for intentional ones.

California also passed AB 3030 in September 2024, requiring AI providers to verify users’ ages before granting access to generative AI systems, effective January 2026.

Why It Matters

These laws fundamentally change how the internet operates for anyone under 18. For the first time, age verification becomes a standard feature built into operating systems themselves, not just individual websites or apps. This affects everything from downloading apps to creating social media accounts to accessing AI chatbots.

The global scope is unprecedented. Australia banned social media for users under 16 entirely, with platforms like Facebook, Instagram, TikTok, and YouTube facing monetary penalties for non-compliance. The UK’s Online Safety Act requires “highly effective” age verification by July 2025, with fines reaching 10% of companies’ global revenue.

For parents, these laws promise greater control over children’s digital experiences. For tech companies, they represent massive compliance costs and technical challenges. For privacy advocates, they raise concerns about requiring personal identification for internet access.

Background

The push for age verification stems from growing evidence of social media’s impact on youth mental health and children’s exposure to inappropriate content. Congressional hearings featuring testimony from parents whose children died by suicide after social media bullying created political momentum for action.

Half of U.S. states have now adopted some form of age verification requirements since 2023, primarily targeting adult content websites. Texas’s HB 1181 requires sites with more than one-third “harmful to minors” content to verify all users’ ages through government-issued ID or comparable systems.

Utah initially required parental consent for all social media users under 18, but federal courts struck down key provisions as unconstitutional violations of free expression. This legal pushback influenced California’s decision to use a less restrictive, self-reported model.

The technical infrastructure for age verification has evolved rapidly, with companies developing facial recognition systems, ID verification services, and device-based signals that don’t require uploading personal documents for every app or website.

What’s Next

Implementation timelines vary significantly. Australia’s social media ban took effect in December 2024, making it the world’s first comprehensive prohibition. California’s laws phase in between 2026-2027, giving companies time to develop compliance systems.

Tech companies face enormous technical and legal challenges. Operating system providers like Apple, Google, and Microsoft must build age verification into their core products. App developers must integrate these age signals into their software. Social media companies must develop new account creation processes.

Legal challenges are inevitable. Free speech organizations argue these laws violate First Amendment protections, while privacy advocates warn about creating surveillance infrastructure that could be misused. The Supreme Court will likely determine which approaches survive constitutional scrutiny.

International coordination is emerging as a priority. The EU is developing its own age verification frameworks under the Digital Services Act. Countries are sharing best practices through forums like the Global Partnership for Action on Gender-Based Online Harassment and Abuse.

The technology itself continues evolving. Companies are investing in privacy-preserving age verification that doesn’t require storing personal documents. Blockchain-based identity systems and zero-knowledge proofs may eventually enable age verification without compromising user privacy.