The debate over age verification laws escalated this summer when two major decentralized social networks took opposing but telling approaches. Bluesky announced it was pulling out of Mississippi altogether after the state implemented a law requiring age verification for social media users, citing the impossibility of compliance without compromising user privacy. Mastodon followed with a statement of its own, explaining that it does not track its users, does not want to rely on IP-based blocking, and has no built-in system for age checks. Instead of attempting to comply, the nonprofit behind Mastodon said it would leave such decisions to the administrators of individual servers that make up the decentralized network.
These responses highlight the broader challenge at the heart of age verification requirements in the United States. Whether it is even feasible for platforms of different sizes, structures, and philosophies to meet state-level demands, and whether the risks outweigh the intended benefits.
How the Current Wave Began
While the idea of restricting minors’ access to harmful online material dates back decades, the latest push for mandatory age verification laws gained traction through state efforts to regulate adult websites. Louisiana was among the first to pass a law requiring visitors to such sites to prove their age using government-issued identification. Utah, Arkansas, and other states soon followed with their own laws extending the idea to social media platforms, often in the name of protecting youth mental health.
These laws build on the precedent of the Children’s Online Privacy Protection Act (COPPA), which has been in place since 2000 and restricts how companies collect data from children under 13. Unlike COPPA, however, these new laws focus on enforcement at the access level, mandating direct checks rather than relying solely on company policies or parental consent.
The Feasibility Problem
Mandatory age verification faces an uphill battle when it comes to practical enforcement. VPNs allow users to mask their location, making it relatively easy to bypass state-based restrictions. Even without VPNs, borrowed credentials or falsified information can undermine the systems. For teenagers familiar with technology, these barriers may prove to be only minor inconveniences.
This raises doubts about whether such laws can actually achieve their stated goals. They may place pressure on platforms, but determined users can often find workarounds.
Responsibility and Oversight
Another key issue is responsibility. Advocates of age verification argue that it is the state’s role to protect children from harmful content, but critics say this duty belongs primarily to parents. Household rules, device controls, and open conversations about safe online behavior have long been considered the first line of defense. Shifting this burden onto private companies risks eroding parental authority while expanding corporate liability.
Security Risks of Verification
Perhaps the most significant drawback is the security hazard introduced when users are asked to provide sensitive information, such as driver’s licenses or other government documents. If platforms are required to collect and store this data, they become attractive targets for hackers. A breach could expose personal information on a massive scale, creating risks far greater than the problem of underage internet access the laws seek to address. Even companies that promise not to retain the data still require users to trust that the verification process is being handled safely.
The Road Ahead
The differing responses of Mastodon and Bluesky show that platforms are already grappling with the practical and philosophical challenges of state-imposed verification systems. The push for age verification will likely continue as lawmakers respond to concerns about children’s exposure to online content and the influence of social media. But the underlying problems remain: enforcement is limited, circumvention is easy, and the security risks are high.
As states push forward, the U.S. internet finds itself at a crossroads. The balance between protecting minors, respecting parental responsibility, and safeguarding user privacy is delicate, and it is not yet clear whether mandatory age verification laws can deliver on their promises without creating more problems than they solve.
—By Greg Collier
