Online age verification explained (Part 3/3): Age-based restrictions, draft bills to watch, global complexity, and engaging with lawsuits

Imagine if every website had its own border crossing. Some would ask to see your passport before you entered. Others might simply ask you to confirm your age, while some wouldn’t stop you at all. Which checks you encounter depend not only on the service you’re using, but also on the country you’re logging in from. This approach is already shaping our experiences online. Around the world, governments are adopting different approaches to age verification, placing age barriers at different points across the internet, from app stores to websites to devices.

Welcome back to our online age verification blog post series! In Part One, we set the stage to better understand the worldwide online safety debate, and shared a timeline of the legal precedents to explain some of the reasons behind the global trend of laws that require age gating the internet. Later on, in Part Two, we defined terms related to age verification, explored the main technological methods of age assurance and estimation, and clarified why their impact on privacy and security online not only weaken, but also threaten, the human rights of adults and minors, including Wikimedia project volunteers and readers. This helped us clarify the structural challenges that the Wikimedia projects face regarding online age verification: the Wikimedia model is human-rights first, built to allow anyone to freely read and contribute to open knowledge.

In this blog post, Part Three, we’ll examine specific draft laws and regulations in more detail, so we can clarify the logistical challenges that online age verification presents to the Wikimedia projects. The global complexity of overlapping regulations is increasing, compliance creates a disproportionate burden for small nonprofit organizations and volunteer contributor communities, which can greatly vary in size. Country-by-country laws are fragmenting the internet, forcing us to ask: How will we comply everywhere, with everything, all at once? The last part of our discussion explains how and why the Foundation’s engagement with these proposals around the world is part of the answer.

Legislative proposals establishing age-based restrictions online

Age-based restrictions can generally be sorted into three categories of laws, depending on what they seek to restrict. Some seek to restrict access to certain types of content. Others aim to restrict access to certain types of platforms or design features. And some others seek to restrict access broadly, requiring minors to obtain parental consent to access app stores or even electronic devices.

Let’s dive into the particulars, considering actual laws and draft proposals to better understand the details.

Age-based restrictions based on content

The most common type of age-based, content-specific laws target explicit content: most refer to pornography, although some to adult content, obscenity, or a much broader category of “harmful content.”

Until recently, the US Supreme Court said that requiring adults to prove their ages to access speech protected by the First Amendment of the US Constitution, including pornography, was an unconstitutional burden on their rights. That precedent changed in 2025, the result of a legal challenge brought against a law from the state of Texas. The legislation requires age verification on websites hosting content where more than one third of it can be considered “sexual material harmful to minors.” In this lawsuit, Free Speech Coalition, Inc. v. Paxton, the Supreme Court held that states could restrict minors’ access to content that the states in question deem obscene for minors, even if that content is protected by the First Amendment for adults. The Court reasoned that age verification placed only an incidental burden on the speech rights of adults. As a result, the doors opened for other states to enact similar restrictions to access material that they deem harmful to minors.

In terms of compliance, the Texas law is not as simple as it may seem. Websites that consist primarily of pornography are clearly subject to the law, but other websites—like Reddit or X (formerly Twitter)—host a wide range of content. Since the law provides no instruction or guidance on how to count the applicable material, it is far more complex for other websites to determine whether more than one third of all the material that they host is “sexual material harmful to minors.” Should website operators count web addresses—i.e., URLs—or files? Do videos count the same as images? What about text? And can the operators rely on tags to correctly label relevant content? Given this uncertainty, many websites must either assume they are covered by the law and implement an identification (ID)-based age verification system proactively or take a chance and risk liability for noncompliance. At least one pornography website has chosen to block access entirely in states with laws like Texas—but it is not clear whether this is a decision based on the complexities of compliance or a statement against the laws themselves.

In the United Kingdom (UK), the Online Safety Act (OSA), also limits access to material deemed harmful to minors and requires that operators of websites and apps with such content prevent minors from encountering it. 

These laws have a direct effect on privacy, but they can also have incidental effects on the ways people keep their identities private and their browsing safe online. People across the world commonly use virtual private networks (VPNs) to encrypt their internet traffic and mask their location. They can do this for a number of legitimate reasons, including privacy and online security concerns, to have the ability to access information their governments have forbidden, and to avoid retaliation for their online activities from the powers that be. In the UK and many US states with age restrictions, people can generally avoid age verification by using a VPN so that websites view their traffic as coming from a location other than where they reside and the laws are enacted. In response to this form of legal circumvention, lawmakers in the UK have discussed prohibiting VPN use and, in the US, the state of Utah recently enacted a VPN ban. Such laws undermine privacy and security for many people in the state regardless of the websites and content that they access.

Age-based restrictions based on platform or design features

A second type of age-based restrictions is based on categories of websites, apps, and particular design features (including auto-play, infinite scrolling, and algorithmic systems that recommend content expected to prolong a user’s engagement with the platform).

For example, Australia’s social media age restrictions determine whether a given platform must prevent minors under 16 years of age from establishing accounts. This is done by taking into account the following criteria:

• The sole purpose, or a significant purpose, of the service is to enable online social interaction between two or more end-users;
• The service allows end-users to link to, or interact with, some or all of the other end-users;
• The service allows end-users to post material on the service;
• The service has a “recommender feature” and/or a “logged in feature,” as defined in the legislative rules.

The Foundation’s Global Advocacy team, alongside volunteers from Wikimedia Australia, engaged with the Australian eSafety Commissioner to ensure that Wikimedia projects were not subject to these age-based restrictions. The Commissioner is still making final determinations about which platforms are subject to the minimum age requirement.

(We will provide updates in this series if the status of Wikimedia projects changes in Australia.)

Similarly, the Kids Off Social Media Act (KOSMA), introduced in the US Senate, would prohibit minors under 13 years of age from accessing social media platforms, and ban algorithmic recommender systems for minors under 17. This proposed federal law—which means it would apply in every state of the country—insists that companies are not required to implement any form of age assurance to determine users’ ages. Rather, it relies instead on a murky standard for assessing whether a company “would have known that a user was a child or teen.” This bill has not yet become law, but the current text includes an exemption for “crowd-sourced reference guides such as encyclopedias and dictionaries” and limits the definition of social media platform to those that primarily derive their income from advertising or the sale of personal data, putting Wikimedia projects out of scope.

Broad age-based restrictions: App stores and operating systems

Finally, other types of age-based restrictions are neither related to either content, platform type nor design features; in that sense, they are even broader, restricting access to app stores and even to electronic devices.

In the US, laws like the App Store Accountability Act require that app stores or marketplaces, such as Google Play and Apple’s App Store, assign anyone creating a new account to one of four age brackets: under 13 years of age, 13–15, 16–17, or 18 and up. In some cases, these requirements extend further and encompass operating systems or setting up new electronic devices. Such laws have been proposed both at the federal and state levels, and are already enacted in US states including Texas, Utah, Louisiana, California, and Alabama.

These laws seek to make sure that minors must obtain permission from a parent or legal guardian to create app store accounts and also obtain consent for each app they wish to download. To implement this, these laws require that the app store operators provide age bracket information to app developers—through an application programming interface—who must in turn request the age bracket of the user requesting each download. Developers must then take steps to provide an age-appropriate experience for each app user, including preventing access to the app entirely if a parent or guardian revokes consent for their child or ward. Adults who, for whichever reason, cannot verify their age remain subject to the same restrictions as minors.

So far, US courts have been generally skeptical about laws requiring age assurance outside of the context of “sexual material harmful to minors.” Many of these laws have been put on hold while courts consider whether they are constitutional or not; many more are simply not being enforced while the legal challenges play out. It is most likely that the validity of such US laws will remain an open question for the next few years.

Engaging with legal challenges to age-based restrictions as a “friend-of-the-court”

As part of our work protecting the privacy and free expression rights of volunteer contributors and readers, the Foundation has continued to participate in important lawsuits worldwide. This includes filing “friend-of-the-court” or amicus curiae briefs in key US lawsuits affecting essential digital freedoms. This work is often done in partnership between the Foundation and other leading voices for digital rights, and is vital to maintain key protections for the Wikimedia model, volunteer communities, and mission.

Examples of briefs from the last year, which we wrote about in Diff, include:

• Patterson v. Meta, in the New York Appellate Division, where we argued that an appeal should succeed because the original decision made platforms choose between excessive censorship or allowing harmful content. 
• NetChoice v. Brown, in the US 10th Circuit Court of Appeals, where we maintained that a new law in the state of Utah risked imposing costly age assurance and content restrictions that would hurt open access and community-led content models.
• Snap v. Pina, in the Supreme Court of the state of California, where we urged the court to maintain a longstanding, privacy-protective interpretation of the US Stored Communications Act (SCA), after a lower court watered down the protection it offered to user data.

(Be on the lookout for other Diff blog posts about friend-of-the-courts briefs, as well as updates on the above-mentioned cases when their statuses change.)

Struggling with global complexity

The US state of Utah has four different laws requiring online age verification. Let that sink in as you zoom out to consider the other 49 states in the country, each with their own laws and differing approaches. Then zoom out again, and consider the complexity of the world’s nearly 200 countries writing their own rules for an internet designed to be borderless. It is difficult to predict how many different age gating laws will be enacted in the coming years, but even with the handful of examples we have examined, it’s easy to understand how complicated online age verification is becoming on a global scale.

Public interest, nonprofit organizations like the Foundation, which host open knowledge projects, face multiple logistical challenges in this context. The most obvious ones, compared to large commercial platforms, are that they operate with less staff and smaller budgets—the latter coming from donations instead of profits. However, there is an even greater challenge: since legislators want to show results quickly, they draft one-size fits-all regulations that treat all platforms the same, regardless of their purpose, model, and risk level. This is why in our engagement with lawmakers and regulators we recommend that they consider the Wikipedia Test: a public policy tool that helps them identify whether new laws would harm Wikipedia and similar public interest internet projects.

To be clear, the fact that the wave of age gating restrictions is global raises challenges for governments, platforms, and users alike, wherever they might be. For instance, speech that is protected in the US by the First Amendment may not enjoy the same legal status elsewhere. Even if content is deemed legal in the US, the website that hosts online it might be put in scope for age gating laws in another country, whose government deems the same content “harmful” to minors. As such, platforms’ global operations face a multitude of national legislations and regulations. Websites and app developers around the world are struggling to interpret and comply with an increasingly complex regulatory environment, born from a multitude of country-level legal requirements. As a result, the experience of using the internet will likely change for nearly everyone, everywhere.

However, despite this complexity, the Foundation’s goals remain the same: to protect and defend the Wikimedia projects, their volunteer communities, and readers, so that everyone can safely contribute free and open knowledge to the world from wherever they are.

Some final thoughts

We hope this series has helped you understand the global scope of age verification mandates, some of the concerns with their implementation, the risks that they can impose on the Wikimedia projects, volunteers, and readers, as well as the challenges with compliance in a global patchwork of national laws.

Age verification legislation is reshaping the internet, one country at a time. The decisions being made today will influence how billions of people—including you—access information, participate online, and protect their rights. We encourage you to stay informed and engaged.

We welcome discussions with the Wikimedia volunteer communities about relevant laws and/or regulations in their regions, including at upcoming community events, for instance, during Wikimania 2026, to be held 21–25 July 2026 in Paris, France.

_______

Subscribe to our newsletter to stay informed on digital policy, Wikipedia, and the future of the internet.

For media inquiries, please contact or direct members of the press to press@wikimedia.org.