Children's Online Privacy Laws by State (2026)

Federal COPPA protects children under 13 from online data collection, but at least 15 states have enacted children's online privacy or social media laws that go further. California, Utah, Texas, and Florida lead with requirements covering users under 18, adding parental consent, age verification, and data minimization obligations on top of the federal baseline.

Federal law through COPPA protects children under 13 from online data collection, but a growing number of states have decided that federal protections do not go far enough. Since 2022, state legislatures across the country have passed laws targeting social media access, age verification, data minimization, and platform design for young users.

These state laws vary widely in scope, enforcement mechanisms, and the ages they cover. Some focus narrowly on social media account creation. Others impose broad obligations on any digital service a child might access. This guide surveys the major state laws, compares their approaches, and tracks ongoing legal challenges. For the federal framework, see our COPPA Compliance Guide.

California: Age-Appropriate Design Code Act (AADC)

California enacted the Age-Appropriate Design Code Act (AB 2273) in September 2022, modeled after the United Kingdom's Age Appropriate Design Code. The law took effect on July 1, 2024, and applies to any online service, product, or feature "likely to be accessed by children" under 18.

The AADC requires covered businesses to:

• Complete a Data Protection Impact Assessment (DPIA) before offering any new feature or product likely accessed by children
• Configure all default privacy settings to the highest level for child users
• Provide privacy information in language suited to the age of the child
• Refrain from profiling children by default (unless profiling is necessary to provide the service and appropriate safeguards are in place)
• Refrain from using dark patterns to steer children toward options that lower their privacy

A federal judge in the Northern District of California issued a preliminary injunction against enforcement in September 2023 in NetChoice v. Bonta, finding that portions of the law likely violated the First Amendment. California appealed, and on August 16, 2024 the Ninth Circuit affirmed the injunction only as to the requirement that covered businesses assess and mitigate the risk that children are exposed to harmful material, plus the provisions not severable from it. It vacated the rest of the injunction and remanded.

On remand the district court enjoined the entire statute again, and the Ninth Circuit ruled a second time on March 12, 2026. That decision affirmed the injunction as to the AADC's data use and dark patterns restrictions on vagueness grounds, and vacated the remainder, including the blocks on the law's coverage definition and its age estimation requirement. The case is back before the district court, so the AADC is partly enjoined rather than wholly blocked.

California also strengthened its approach through AB 1394 (2023), which requires social media platforms to report apparent child sexual abuse material within specified timeframes, and SB 976 (2024), the Protecting Our Kids from Social Media Addiction Act, which prohibits platforms from providing addictive feeds to minors without parental consent.

For California's broader data privacy framework, see our California Data Privacy Laws page. For family law context, see California Child Support Laws.

Utah: Minor Protection in Social Media Act (SB 194)

Utah was among the first states to regulate minors' access to social media directly, but the law it passed first is no longer on the books. The 2023 Social Media Regulation Act (SB 152) was repealed by HB 464 (2024), which struck Utah Code Sections 13-63-101 through 13-63-701. In its place, SB 194 (2024) enacted the Utah Minor Protection in Social Media Act at Utah Code Sections 13-71-101 through 13-71-401, effective October 1, 2024.

Key provisions of the replacement act:

• Social media companies must run an age assurance system accurate to at least 95 percent to determine whether an account holder is a minor (Section 13-71-201)
• Minor accounts default to maximum privacy settings, and a minor cannot change that default without verifiable parental consent (Section 13-71-204)
• A minor account holder's personal information carries a presumption of confidentiality that only verifiable parental consent overcomes (Section 13-71-204)
• Platforms must provide supervisory tools and parental consent mechanisms on a minor's account
• The Utah Division of Consumer Protection enforces the act, and companies using approved age assurance and consent systems get a compliance safe harbor

Enforcement never began. On September 10, 2024, three weeks before the effective date, Chief Judge Robert J. Shelby preliminarily enjoined the Attorney General and the Division of Consumer Protection from enforcing any part of Utah Code Sections 13-71-101 to 401 in NetChoice v. Reyes, finding NetChoice substantially likely to succeed on its First Amendment claim. That injunction runs pending final disposition of the case.

For related Utah legal information, see Utah Child Support Laws and Utah Data Privacy Laws.

Texas: Securing Children Online through Parental Empowerment Act (HB 18)

Texas Governor Abbott signed HB 18, the SCOPE Act, in June 2023. The law took effect on September 1, 2024, and creates a comprehensive framework for children's digital privacy.

The SCOPE Act requires:

• Parental consent for minors to create accounts on "digital services" (broadly defined)
• A ban on targeted advertising directed at known minors
• Restrictions on collecting, processing, or selling a known minor's personal data beyond what is necessary to provide the service
• Platforms to provide parents with tools to supervise their child's account settings, privacy preferences, and purchase capabilities

"Known minor" means the platform has actual knowledge or willful disregard that the user is under 18. The Texas Attorney General enforces the law with penalties up to $10,000 per violation.

A federal court in the Western District of Texas has reviewed First Amendment challenges to portions of HB 18. The litigation follows the same pattern seen in other states: industry groups argue that age verification and content restrictions burden protected speech. For more Texas-specific legal context, see Texas Child Support Laws and Texas Data Privacy Laws.

Louisiana: Secure Online Child Interaction and Age Limitation Act

Louisiana's Secure Online Child Interaction and Age Limitation Act, codified at Louisiana Revised Statutes 51:1751 and following, requires social media platforms to verify the age of Louisiana users and obtain parental consent for users under 18 to create accounts. The official code credits the chapter to Acts 2023, No. 456, and notes that Acts 2024, No. 656 moved its effective date to July 1, 2025.

The act mandates that platforms use "commercially reasonable" age verification methods. The law allows parents to request deletion of their minor child's account and prohibits platforms from using a minor's data for purposes unrelated to the service.

Louisiana's enforcement approach places responsibility on the platforms, not on parents or children. The state Attorney General can bring civil enforcement actions, with penalties structured per violation.

For Louisiana family law context, see Louisiana Child Support Laws.

Arkansas: Social Media Safety Act (SB 396)

Arkansas enacted the Social Media Safety Act (SB 396), Act 689 of 2023, in April 2023, requiring social media companies to verify the age of Arkansas users and obtain parental consent before allowing minors under 18 to create accounts. Platforms must use third-party age verification services.

A federal judge in the Western District of Arkansas blocked enforcement of the law in August 2023 in NetChoice v. Griffin, finding it likely violated the First Amendment. The court held that the law's age verification requirements burdened adult users' access to lawful speech and that less restrictive alternatives existed. That block became permanent on March 31, 2025, when Judge Timothy L. Brooks granted NetChoice summary judgment and permanently enjoined Act 689.

For Arkansas family law context, see Arkansas Child Support Laws.

Ohio: Parental Notification by Social Media Operators Act (Ohio Rev. Code 1349.09)

Ohio's law is widely described as a notification statute, and its official name invites that reading, but the operative requirement is consent. The Parental Notification by Social Media Operators Act was enacted in the 2023 budget bill, H.B. 33 of the 135th General Assembly, and is codified at Ohio Revised Code Section 1349.09, which applies beginning January 15, 2024 under Section 803.380 of that bill.

Under Section 1349.09(B)(1), an operator whose site targets children or is reasonably anticipated to be accessed by children must obtain verifiable consent from a parent or legal guardian before a user under 16 can register, sign up, or create a username. The statute lists the methods that count: a signed form returned by mail, fax, or email; a credit or debit card transaction that notifies the account holder; a call to a staffed toll-free number; a videoconference with trained personnel; or a check of government-issued identification against an identity database. The operator must also show the parent the site's content-moderation and censoring features and provide a link for reviewing that list later.

The act has been in litigation since it was enacted. A federal district court in the Southern District of Ohio ruled for NetChoice and blocked it, but on June 18, 2026 the Sixth Circuit reversed in NetChoice v. Yost, holding that NetChoice had not established the act to be facially unconstitutional, and remanded with instructions to enter judgment for the Ohio Attorney General.

For Ohio family law context, see Ohio Child Support Laws.

Florida: Social Media for Minors Act (HB 3)

Florida's HB 3, approved by the Governor on March 25, 2024 as Chapter 2024-42, prohibits social media platforms from allowing children under 14 to hold accounts and requires parental consent for users aged 14 and 15. It took effect on January 1, 2025 and is codified at Florida Statutes Section 501.1736.

The law defines covered "social media platforms" based on specific features: algorithmic content curation, addictive features (infinite scroll, push notifications, auto-play), and the ability to upload content visible to other users. Platforms that primarily provide email, messaging, streaming, news, or shopping are excluded.

The law survived its first constitutional test on appeal. On June 3, 2025, Chief Judge Mark E. Walker of the Northern District of Florida granted a preliminary injunction in Computer and Communications Industry Association v. Uthmeier, barring the Attorney General from enforcing the core account-restriction provisions of Section 501.1736. Florida appealed and asked the Eleventh Circuit to stay that injunction, and in November 2025 the Eleventh Circuit granted the stay, allowing Florida to enforce the law while the appeal proceeds. The appeal was argued in March 2026 and remains pending, so the account restrictions are currently enforceable.

For Florida family law context, see Florida Child Support Laws and Florida Data Privacy Laws.

Virginia: Age Verification Requirements

Virginia requires age verification for online material harmful to minors under Virginia Code Section 8.01-40.5, enacted by Chapter 811 of the 2023 Acts of Assembly. A commercial entity that knowingly or intentionally publishes or distributes material harmful to minors from a website containing a substantial portion of such material must verify that anyone attempting to access it is 18 or older, using either a commercially available database regularly employed for age and identity verification or another commercially reasonable method. While primarily aimed at adult content, that verification infrastructure has implications for children's privacy, because any system collecting government IDs or biometric data creates its own risks.

Virginia also reaches children's data directly through its Consumer Data Protection Act. Virginia Code Section 59.1-578(F) bars a controller from processing a known child's personal data for targeted advertising, for sale, or for profiling that produces legal or similarly significant effects; from processing it beyond what is reasonably necessary to provide the service; and from collecting a known child's precise geolocation without a signal that runs for the whole collection period. Each of those is permitted only with parental consent obtained under COPPA.

Virginia's approach illustrates a tension present in many state laws: the tools used to protect children online can themselves create data collection risks. See Virginia Data Privacy Laws for the state's broader privacy framework.

Maryland, Minnesota, and Emerging State Laws

Maryland passed the Maryland Kids Code (Maryland Age-Appropriate Design Code) (SB 571) in 2024, modeled after California's AADC and the UK code. It requires data protection impact assessments, default high privacy settings, and prohibitions on profiling children.

Minnesota enacted the Minnesota Age-Appropriate Design Code in 2024, similarly requiring DPIAs and default privacy protections for services likely accessed by children under 18.

New York has been considering the SAFE for Kids Act and the Child Data Protection Act, which would restrict algorithmic feeds for minors and limit data collection from users under 18.

Connecticut, Georgia, Mississippi, Montana, and New Jersey have also introduced or passed children's online privacy bills during their 2024-2025 legislative sessions.

State Comparison Table

Age Verification: Methods and Challenges

States have taken varying approaches to age verification, and each raises distinct privacy and constitutional questions.

Government ID upload provides strong age verification but creates a database of identification documents linked to online activity. Louisiana initially used this model for its age verification law covering adult content sites.

Commercial age estimation uses AI and facial analysis to estimate a user's age without collecting an ID. California's AADC contemplated this approach, and the UK's Information Commissioner's Office has endorsed age estimation as a proportionate method.

Self-declaration (entering a date of birth) is the simplest method but the least effective, since children can easily enter false dates. The FTC has criticized age gates that allow repeated attempts.

Parental verification requires confirming the parent's identity before granting consent for the child. Methods parallel COPPA's VPC options: credit card, knowledge-based questions, or government ID.

The core challenge is that any age verification system robust enough to reliably identify children also collects sensitive data from everyone who uses the service. Courts evaluating these laws have repeatedly noted this tension when assessing First Amendment challenges.

What These Laws Mean for Families

Parents navigating children's online privacy face a patchwork of protections that depend on where they live and which platforms their children use. Federal COPPA protections apply nationwide for children under 13, but state laws add layers that cover older teens and address platform design.

Families in states with active laws can expect:

• Social media platforms to ask for age verification during account creation
• Options to review and manage a child's account settings and data
• Restrictions on targeted advertising and algorithmic content curation for child accounts
• The ability to request deletion of a child's data and account

Where courts have blocked state laws, the federal COPPA baseline and the platform's own policies remain the primary protections.

For related family law topics, visit our United States Child Support Laws hub page, which covers state-by-state child support guidelines, enforcement, and parental rights.

This article provides general legal information about children's online privacy laws by state. It does not constitute legal advice. Consult an attorney for advice specific to your situation.

Related Privacy Guides

• U.S. Data Privacy Laws: the state and federal consumer-privacy framework.
• COPPA Compliance Guide: the federal children's online privacy baseline.
• Biometric Privacy Laws by State: another category of sensitive personal data.

Frequently Asked Questions

Which states require parental consent for minors to use social media?

Utah (SB 194), Texas (HB 18), Louisiana (Revised Statutes 51:1751 and following), Arkansas (Act 689), and Florida (HB 3) have all passed laws requiring some form of parental consent for minors to create social media accounts. Their current status differs sharply. Arkansas's law was permanently enjoined in March 2025 and Utah's has been preliminarily enjoined since September 2024, while Florida's is enforceable after the Eleventh Circuit stayed the district court's injunction in November 2025.

Can states pass children's privacy laws that are stricter than COPPA?

Largely, but not without limits, and the limit runs the opposite way from how it is often described. 15 U.S.C. § 6502(d) is a preemption provision captioned 'Inconsistent State law.' It says no state or local government may impose liability for covered commercial activities by operators that is inconsistent with the treatment of those activities under that section. It is a ceiling on inconsistent state rules, not a savings clause granting states extra authority. States have legislated in the space COPPA does not occupy, regulating minors aged 13 to 17, platform design and default settings, and social media account creation, which is why California, Utah, and Texas laws reach ages beyond COPPA's under-13 threshold.

What is the California Age-Appropriate Design Code?

The California AADC (AB 2273), enacted in 2022, requires online services likely to be accessed by children under 18 to conduct data protection impact assessments, configure default privacy settings to the highest level, and refrain from profiling children by default. A federal court preliminarily enjoined the law in 2023. The Ninth Circuit has since ruled twice, in August 2024 and again on March 12, 2026, each time upholding the injunction only in part. The data use and dark patterns restrictions remain blocked, while the blocks on the coverage definition and the age estimation requirement were vacated, and the case is back before the district court.

Why have courts blocked some state children's privacy laws?

Federal courts have blocked laws in Arkansas and Utah and partially in California, primarily on First Amendment grounds. Courts have found that age verification requirements burden adult users' access to lawful speech, that account bans restrict minors' own speech rights, and that states have not demonstrated these laws are the least restrictive means of achieving their goals. Not every challenge has succeeded, though: the Eleventh Circuit stayed the injunction against Florida's HB 3 in November 2025, and the Sixth Circuit reversed the judgment against Ohio's act in June 2026.

How do states verify a user's age online?

States have used or authorized several methods: government ID upload, commercial age estimation technology (AI-based facial analysis), self-declared date of birth, and parental identity verification. Each method involves tradeoffs between accuracy and privacy, since stronger verification requires collecting more personal data.

Does Ohio require parental notification or parental consent?

Consent, despite the name. The Parental Notification by Social Media Operators Act, enacted in H.B. 33 of the 135th General Assembly and codified at Ohio Revised Code Section 1349.09, requires a covered operator to obtain verifiable consent from a parent or legal guardian before a user under 16 can register or create a username, and it lists the verification methods that qualify. A federal district court blocked the act, but the Sixth Circuit reversed that judgment on June 18, 2026 in NetChoice v. Yost and directed entry of judgment for the Ohio Attorney General.

Do these state laws apply to all websites or only social media?

It varies by state. Utah, Arkansas, Louisiana, and Florida target social media platforms specifically, defined by features like user-generated content and algorithmic curation. California's AADC and Maryland's Kids Code apply broadly to any online service 'likely to be accessed by children,' which covers a much wider range of websites, apps, and digital products.

What should parents do if their state does not have a children's online privacy law?

Federal COPPA still protects children under 13 nationwide. Parents can use platform-specific parental controls, review privacy settings on their children's devices and accounts, and opt out of data collection where platforms offer that choice. The FTC also provides resources at ftc.gov for parents seeking to protect their children's data online.