The regulatory landscape on AI, online safety, and social media is evolving rapidly in the US, EU, and beyond. To support companies in navigating these currents, we have launched our Horizon Scan blog series to cover significant legal developments on key topics including age assurance, frontier AI, chatbots, and child safety. In these blogs, we will assess regulatory trends and provide practical guidance to help your organization prepare for what’s coming over the horizon. 

In the three decades since Congress passed the Children's Online Privacy Protection Act (“COPPA”) in 1998, the child safety regulatory landscape has expanded significantly in the United States. As part of that expansion, federal agencies and state legislatures have promulgated new rules and laws requiring technology companies to verify the age of their users (known as “age assurance” laws). As a result of these new age assurance laws, many technology companies must now consider how to build age assurance mechanisms into their product roadmaps as a key priority. 

This blogpost outlines current age assurance laws and enforcement trends in the United States (“US”), briefly compares them to corollary laws and enforcement trends in the European Union (“EU”) and the United Kingdom (“UK”), and concludes with predictions and key takeaways for companies.

A Brief Note on Taxonomy: Age Assurance vs. Age Verification

To properly frame a discussion of age assurance regulations, it is important at the outset to distinguish between “age assurance” and “age verification.” While the two terms are often used interchangeably, they represent two distinct approaches to regulation.

• Age assurance is a broad, umbrella term that encompasses any technical method used to evaluate or estimate whether a user meets an age requirement. Age assurance methods do not necessarily require identification of the underlying individual, but instead require at least reasonable confidence that an individual meets a specific age threshold or falls into a specific age band (e.g., under 13, 13 to 17, 18 and over). For example, methods in this category may include age estimation through facial recognition or voice analysis technology.
• Age verification refers to a stricter sub-category of age assurance methods that require actual proof of an individual’s age, through, for example, verification of a driver’s license or passport.

The Current US Regulatory & Enforcement Landscape

The age assurance legal landscape in the US consists of both federal and state laws. 

At the federal level, COPPA is the primary law for child safety and privacy, and is enforced by the Federal Trade Commission (“FTC”) through its implementation rules (collectively referred to as the “FTC COPPA Rule”). Broadly, COPPA generally prohibits platforms from collecting the personal information of users under 13 without first providing notice to and obtaining verifiable consent from parents. While COPPA does not impose explicit age assurance requirements, its privacy requirements inherently encompass data collected for the purpose of undertaking age assurance. 

At the state level, a patchwork of laws have emerged that impose various age assurance requirements throughout the technical lifecycle (i.e., from upstream app stores all the way downstream to user activity within an app). 

Below is an overview of these laws, as well as a brief discussion of current enforcement trends. 

Federal Regulation: FTC COPPA Rule and Recent FTC Policy Statement

Over the last two years, the FTC has taken two significant actions to account for an evolving age assurance landscape. 

First, in January 2025, the FTC announced amendments to its longstanding FTC COPPA Rule to, among other things, add new privacy protections for data frequently collected for the purpose of age assurance. The amendments expanded the definition of “personal information” to include biometric (e.g., facial templates, voiceprints) and government-issued identifiers, two types of data frequently collected by companies to undertake age verification. The updated Rule also clarified that the FTC’s longstanding guidance on neutral age-gating (that age gates should not default to a set age or encourage age falsification) applied not only to general audience and child-directed services, but also to “mixed audience” services – i.e., services directed to but not explicitly targeting children.

Second, in February 2026, the FTC issued a policy statement “promoting the adoption of age-verification technology” (“Age Verification Policy Statement”). The FTC’s intention in issuing the policy statement was to resolve a tension that had emerged between the FTC COPPA Rule and the growing patchwork of state age assurance laws. Namely, under the FTC COPPA Rule, companies are prohibited from collecting personal information without first providing notice and obtaining verifiable parental consent; however, many state laws now require that companies collect this information for the purpose of age assurance. The Age Verification Policy Statement clarified that the current FTC does not intend to bring enforcement actions under COPPA where a company collects, uses, or discloses personal information provided the data is collected solely for the purpose of age verification, including as mandated by state law, even if the company did not first obtain verifiable parental consent. Companies must retain only what is strictly necessary to confirm age and must promptly delete the data once verification decisions are made. 

Federal Enforcement Trends & Legislative Activity

Congress has been the primary driver of federal enforcement activity related to age assurance in recent months. For example, Congress recently opened a series of investigations and held hearings related to child safety and age assurance mechanisms involving social media, gaming, and other technology platforms. 

Congress has also introduced multiple recent bills that either seek to explicitly mandate or inherently require technology platforms to implement age assurance mechanisms. For example, in February 2026, Representatives Anna Paulina Luna (R-FL) and Schrier (D-WA) and Senators Ted Cruz (R-TX) and Brian Schatz (D-HI) reintroduced the Kids Off Social Media Act, a bill which would restrict social media access for minors through mandatory blocks and safety measures. 

State Laws: A Patchwork

Similar to the privacy law landscape, age assurance laws in the US are a large and growing patchwork of state laws. Each of the 50 states have proposed and/or enacted at least one law related to age assurance over the last four years. 

This patchwork of state laws generally falls into three categories, each of which are discussed below: (1) restrictions on minors’ access to social media platforms and chatbots; (2) restrictions on minors’ access to websites containing adult or other “high-risk” content; and (3) restrictions on minors’ access to certain applications via app stores.

Social Media & Chatbot Laws

One area in which age assurance requirements have emerged in recent years is in the context of broader child safety laws seeking to regulate social media platforms and AI chatbots. In 2026 alone, over 125 chatbot-specific bills and over 300 social media-related bills have been introduced in state legislatures around the country, most of which include an age assurance provision or presume the company already has age assurance mechanisms to identify underage users. 

Below is a summary of the types of age assurance (or age assurance-dependent) provisions being passed:

Social Media Laws

• Parental Consent & Age Gates. Several states focus on obtaining parental consent before account creation or outright banning users under a specific age from platforms. (Compare TX (SCOPE Act) (parental consent required for users age 14 or 15) to FL (HB 3) (users under 14 are outright prohibited from social media)).
• Access Restrictions. Rather than restricting account access entirely, a growing number of states are using age assurance to identify minors and restrict their access to specific content (e.g., “addictive feeds”) or features (e.g., “autoplay”) without parental consent. (See, e.g., NY (SAFE for Kids Act) and VA (SB 854)).
• Curfews & Time Limits. Some state statutes pair age assurance requirements with other obligations, such as restricting night-time access or prohibiting notifications to users at night on verified minor accounts. (See, e.g., TN (Protect Kids Online Act) and AR (Social Media Safety Act)).

Chatbot Laws

• Transparent Disclosures. Many chatbot statutes require clear and transparent disclosures to users to remind them that they are engaging with AI rather than a human, and many require more frequent disclosures to minors. Some of these laws also require more frequent “break reminders” for minors during extended sessions. (See, e.g., CA (SB 243) and CT (SB 5)).
• Bans on "Anthropomorphic" Behavior: Many statutes also explicitly prohibit chatbots from engaging with minors in a way that intends to simulate human intimacy or romantic relationships or to offer therapeutic advice. (See, e.g., CO (HB 1263) and GA (SB 540)).
• Self-Harm Safeguards: Chatbot-specific bills increasingly mandate that companies implement real-time monitoring for signs of user distress, especially if the user is a minor. For example, if the company becomes aware of signs of self-harm or suicidal ideation involving a minor, the company may be legally required to intervene immediately with a crisis hotline referral and block harmful instructions. (See, e.g., CA (SB 1119) and WA (HB 2225)).

Adult & High-Risk Content Laws

Age assurance requirements have also emerged in the context of adult and high-risk content (e.g., pornography, online gambling). Louisiana started this trend in 2022, when it enacted legislation that requires commercial websites with more than one-third content harmful to minors to verify that visitors are at least 18 years old before granting access. Since then at least 26 other states have enacted statutes imposing obligations on platforms to restrict minors’ access to this type of content.

These statutes typically impose mandatory age verification, although the accepted methods for verification vary across states. For example, Wyoming (HB 43) permits use of a wide range of government-issued IDs or payment cards, whereas Virginia (SB 1515) permits the use of “a commercially available database that is regularly used” for age assurance purposes or any other “commercially reasonable method.” 

These statutes also consistently impose restrictions on the retention of identifying information collected and used for age verification. Violations of such provisions are generally enforceable by the relevant state Attorney General (“AG”) and may also involve civil penalties or a private right of action. 

App Store Accountability Laws

The regulatory debate has also shifted with respect to where in the technical stack age assurance should occur. A major trend in the 2025–2026 legislative session was a shift away from imposing age assurance obligations on individual web operators and instead towards imposing them directly on mobile operating system (“OS”) providers, app stores, and devices. 

For example, California, Colorado, Louisiana, Texas, and Utah have each enacted legislation requiring upstream age verification (e.g., app store providers verifying age when an individual first creates an account with the app store). These laws enumerate several permitted verification methods, ranging from directly requesting age information from the user to transmitting/ingesting API-signals regarding the user’s age band. 

State Enforcement & Litigation Trends

State AGs have used their authority to enforce COPPA to bring at least one recent enforcement action implicating age assurance. Further, multiple state AGs have pursued enforcement actions under new age assurance laws in recent months. State AGs have also increasingly turned to traditional consumer protection statutes; unfair, deceptive, or abusive acts or practices (“UDAAP”) laws; and products liability theories to police age assurance on technology platforms.

The expansion of state age assurance laws has also invited significant legal challenges, including from industry coalitions and trade associations. Challengers most commonly argue that broad age assurance requirements violate the First Amendment by restricting access to online expression. They also frequently argue that these laws are void for vagueness under the Fourteenth Amendment’s Due Process Clause, and several courts have agreed, pointing to undefined standards such as “commercially reasonable” age verification and to unclear definitions of which platforms the laws cover. More recently, challengers have also invoked the Dormant Commerce Clause, arguing that requirements to verify a user’s age or location effectively regulate online activity beyond the enacting state’s borders.

Global Regulatory Cross-Currents

Europe's Emerging Model: Age Assurance Meets Safety by Design

Likewise, the EU is gradually developing a more harmonized approach to age assurance through a combination of online-safety, privacy, and child-protection measures. Under Article 28 of the EU Digital Services Act (“DSA”), online platforms accessible to minors must ensure a high level of privacy, safety and security for minors. The European Commission’s corresponding 2025 guidelines recommended that platforms use age assurance measures that are effective, reliable, robust, non-intrusive and non-discriminatory, while adopting broader safety-by-design protections for child users. 

However, age thresholds for digital services are not yet generally harmonized across the EU. The GDPR adds a further dimension to the age-assurance debate: where consent is the legal basis for processing in connection with information society services offered directly to a child, Article 8 GDPR sets the default age for the child’s own consent at 16, while allowing Member States to lower that threshold to no less than 13. Alongside these rules, the European Commission has developed an “Age Verification Blueprint” designed to enable users to prove that they satisfy a relevant age threshold without disclosing their precise age or identity.

The recently proposed EU KIDS Act, published in September 2026, would further develop this framework by establishing EU-wide age assurance rules, moving beyond age-verification requirements alone. The proposal would combine age-based access rules with broader "safety by design" obligations for online services used by children, including social networking platforms, video-sharing services, app stores, online games and certain AI chatbots. For example, the proposal would restrict autonomous account creation by users under 15 on specified social networking and video-sharing platforms, require the use of certified privacy-preserving age-verification solutions, and impose obligations relating to recommender systems, addictive design features, contact by strangers and child-facing AI functionalities. Although still progressing through the EU legislative process, the proposal reflects a broader European trend of combining age assurance with product-design obligations and child-safety requirements.

UK: Age assurance, regulatory enforcement and an upcoming social media ban

The UK has introduced stringent age assurance requirements under the Online Safety Act 2023 (“OSA”), designed to tackle content considered harmful to children. Under the OSA, self-declaration of age is not enough to bypass additional child-focused content moderation safeguards. Many user-to-user services must use “highly-effective” age assurance to prevent users under 18 from accessing harmful content. Ofcom’s non-exhaustive list of methods capable of being highly-effective include ID verification, facial age estimation, and financial institution data. The process must be implemented in a way that is technically accurate, robust, reliable, and fair.

For search services likely to be accessed by children, Ofcom’s Code recommends blurring or downranking harmful results unless the provider has reasonable grounds to establish that the user is an adult (which does not include self-declaration). Large general search services should additionally filter out identified “primary priority” content (e.g., pornography) for users identified as children (e.g., through age inference measures). 

The UK GDPR also provides that children must be at least 13 to consent to the processing of their data by an information society service under the UK GDPR, although the recent Children’s Wellbeing and Schools Act empowers the Secretary of State to raise the age threshold up to 16. The Information Commission’s Office (“ICO”) also expects services to enforce their minimum-age policies through effective age checks. Its Children’s Code calls for a risk-based approach to age assurance: services should calibrate how robust their age checks are to the level of risk the service poses to users, or apply the ICO’s protective standards to all users. 

In their March 2026 joint statement, the ICO and Ofcom emphasized that age assurance must satisfy both online safety and data protection requirements. They state that their approach is technology-neutral, but age check methods must be effective, necessary, and proportionate to the level of risk on a service.

The Government has also announced plans to implement a social media ban for under-16s. It has stated that it plans to introduce the relevant regulations by the end of 2026, and for these to take effect in spring 2027. Ofcom has carried out a rapid assessment of age assurance measures for enforcing the ban, has noted the important role that apps stores could play, and is developing draft guidance that will support the regulations.

Predictions & Key Takeaways

Several key trends are likely to shape the age assurance landscape in the coming year:

• The Shift Upstream. Recent enforcement and legislation have increasingly targeted mobile OS and app stores, adding pressure not only to downstream platforms, but also to upstream services.
• Constitutional Challenges. Statutes imposing mandatory age verification and parental consent for minors to access social media platforms are likely to face ongoing constitutional challenges, including for violations of the First Amendment, Due Process, and the Dormant Commerce Clause.
• A Fractured Global Baseline. The definition of “minors” is splintering globally, from age 13 (the US baseline via COPPA) to age 15 (proposed EU rules) and ages 16 and 18 (UK - depending which set of rules apply), ending the era of one-size-fits-all user onboarding.

To navigate this rapidly evolving regulatory environment, companies should consider the following when designing age assurance product solutions and related compliance programs:

• Map out the Patchwork of Laws. Given the disparate and distinct age assurance laws emerging across the US and abroad, companies may benefit from mapping out all relevant laws to understand where the legal requirements converge and where they might differ.
• Assess the Durability of Laws. With some statutes facing constitutional legal challenges in the court, companies may want to undertake their own legal assessments of the durability of laws potentially applicable to their business to inform their compliance strategy. 
• Design Age Assurance with Privacy in Mind. When developing age assurance mechanisms, especially those that will require collection of sensitive data, companies should design them with privacy in mind. For example, companies should consider how to collect the minimum data required for verification and retain that data for the shortest time possible. Where using third-party vendors for identity verification, companies should have clear policies for the sharing and retention of that data.

To receive the latest insights on US legal developments, subscribe to the Freshfields A Fresh Take Blog.