Two state attorneys general took actions in September to protect kids by requiring businesses to, among other things, verify the ages of their users. Specifically, Florida Attorney General James Uthmeier sued certain pornography websites for violating Florida's Age Verification Law, and New York Attorney General Letitia James proposed rules pertaining to New York's SAFE for Kids Act.
Florida Age Verification Lawsuits
The Florida AG filed two complaints against pornographic video game and content providers' websites under its Age Verification Law. Violations of the law also constitute violations of the Florida Deceptive and Unfair Trade Practices Act. Both complaints allege that the respective websites did not have compliant age verification processes to prevent children from accessing the sites. Florida alleged that although the first website stated [PS1] [EC2] it was for adults only, it only asked users to click a button to confirm if they are 18 years or older. Once a user confirmed, the user immediately saw explicit content and could access pornographic games. The other complaint alleged that the websites at issue had no age verification at all, and that the account creation process required only an email address. These actions were filed not long after the Supreme Court sided with Texas in June, permitting its similar age verification law to remain in effect.
New York SAFE for Kids Act Rules
New York's Stop Addictive Feeds Exploitation (SAFE) for Kids Act generally prohibits covered platforms with an "addictive feed" from providing personalized material and nighttime notifications to minors without parental consent. The Act required the AG to promulgate regulations pertaining to reasonable and feasible methods to determine if a user is not a minor, methods of verifiable parental consent, and to generally enforce the Act. The AG's office issued an Advanced Notice of Proposed Rulemaking in August 2024 to gather information from stakeholders, and on September 15, 2025, issued this Notice of Proposed Rulemaking.
The proposed Rules clarify that verifiable parental consent (among other requirements) must be reasonably calculated in light of available technology to ensure the individual consenting is a parent; reasonably calculated to account for likelihood of circumvention, fraud, or misuse; and allow at least one option that does not require government ID or the parent to create an account or make a purchase. If the platform is a "website or online service directed to children" as specified under the FTC's COPPA Rule, the operator may be deemed compliant with the Act by using the methods of verifiable consent "approved by the FTC," so long as the operator's method also includes certain "limited clarificatory requirements" under the Act.
Moreover, New York's Act creates an actual knowledge standard for age which includes (i) the minor's self-declaration that they can reasonably associate with a user; (ii) use of an age assurance method that results in determination of age; (iii) possession of user data for commercial purposes that if applied to an age assurance method would provide age status; and (iv) good faith determination based on other reliable evidence or knowledge. The AG's office in its Regulatory Impact Statement explains there are now a robust variety of age assurance products available, and their goal is to "facilitate the adoption of effective age assurance methods while minimizing the associated risks and burdens." The Impact Statement gives examples of age assurance methods such as age estimation using a selfie and implementing "waterfall" methods that obtain age status through inferences that are the most minimally burdensome possible.
Additionally, operators are required to change a user's status to "minor" within 10 business days with actual knowledge and investigate reports or information of minor age status. Covered operators must also obtain an annual certification for age assurance methods which includes a specific testing regime including false positive or false negative rate reporting requirements, detecting method circumvention "consistent with a nationally or internationally recognized standard," or if unavailable, using and documenting "attack vectors weighted to reflect the most prevalent risks." The age assurance methods also must maintain specific privacy standards. Covered operators must retain age assurance data for at least 10 years.
The proposed Rules are very detailed, and these were just some of the highlights. New York's regulatory process requires a 60 day comment period before publishing the final Rules, so there is still time to submit feedback. State laws are increasingly focusing on age verification for a variety of reasons and companies will need to review and implement appropriate age verification processes to stay compliant.
The content of this article is intended to provide a general guide to the subject matter. Specialist advice should be sought about your specific circumstances.
