Portions of this blog were also co-authored by Taft Summer Associate Ashley Patriquin.

Businesses that provide a website or online services that collect data from or about minors or children should be aware of expanding legal requirements from U.S. states. These laws impose a range of obligations on businesses, including age estimation requirements, heightened privacy disclosures, limitations on data collection and profiling, and duties to act in the best interests of minors.

State legislatures have also recently begun directly regulating the privacy practices of companies that provide social media solutions to consumers, often with an eye to protecting underage users. Common amongst these new laws are age verification requirements and parental control and consent requirements. Some laws go further, such as requiring ‘deplatforming’ in certain circumstances and restricting ‘shadow banning’ practices. Many of these statutes define “social media” to broadly include any technologies that facilitate interactions among end users and can carry significant penalties for noncompliance.

Below is a summary of certain recent state laws regulating these topics.

Please note that we do not address so-called state comprehensive privacy laws, many of which also restrict processing of children’s data or regulate social media.

Certain laws and/or provisions of laws identified below were subject to legal challenges and injunctions as of the date of this article. Businesses that may be in scope of these laws should engage legal counsel to review the most current status and to help develop defensive strategies.

Alabama

HB 161 (effective January 1, 2027): This law requires application store providers to provide notifications to parents of minor accountholders each time the minor purchases an app or when the app undergoes “significant changes.” The disclosures must include accurate and full descriptions of what personal data will be collected or shared, if any, developer-side data protections, as well as age ratings and content descriptions. App store providers must allow developers to access age category data and parental consent status for each minor user. This law also requires app developers to limit their use of minors’ data to safety or compliance purposes.

Arkansas

SB 396 (effective 2023): This law requires certain social media companies to verify that all users are either at least 18 years old or have parental consent to create an account. Age verification must be performed by a third-party vendor and must adhere to prescribed verification methods.

SB 611 (effective 2025): This law requires social media platform owners to ensure their platforms are not addictive for minor users 16 or younger. Platform owners must ensure their default setting is to cease notifications during certain hours of the night, regularly audit their platform for addictive qualities, and create a parent dashboard to manage minor users’ privacy and platform access.

HB 1717 (effective July 1, 2026): This law requires online platforms targeting or knowingly collecting data from children under 13 or teens ages 13–16 to obtain consent (consent of parents for under 13, and either the teen or parent for 13-16). The law bans targeted ads to minors, limits data collection to what is necessary, and mandates clear privacy notices and security safeguards.

California

AB 587 (effective 2023): This law requires certain social media companies to post their terms of service in a specified manner and with specified content and to make a semiannual terms of service report to the California Attorney General describing how the company flags content, groups, or users, the company’s related response processes, and a list of actions the company may take such as removal, demonetization, or shadow banning. This report must include any definitions of hate speech, racism, extremism, radicalization, disinformation, misinformation, harassment, and foreign political interference, if the companies include such terms in their terms of service.

AB 2273 (effective 2024): This law requires businesses to configure default privacy settings to offer a high level of protection and to provide privacy notices, terms of service, policies, and community standards in a manner suited to the age of children likely to access the services. The law prohibits collecting, selling, or using children’s personal data in ways that are detrimental to their well-being, mandates age estimation and data protection impact assessments, and prohibits use of data for secondary purposes.

AB 1043 (effective January 1, 2027): Requires operating system providers to provide an interface at account setup that requires account holders over 18 years old or parents/guardians of minors to provide the birth date or age of the user of the device. Requires application developers to request a “signal” from the operating system provider (which the provider must thereafter send) regarding the age bracket of each user when the application is downloaded and launched. After obtaining “actual knowledge” of the user’s age bracket via the signal, the application developer shall be required to “comply with applicable law,” which we note could include COPPA and state laws.

AB 56 (effective January 1, 2027): This law requires certain social media platforms to provide a conspicuous warning denoting the “significant mental health harms” of the platform to users under the age of 17 after extended periods of use.

SB 976 (effective 2024): This law requires social media platforms with “addictive features” (e.g., personalized feeds, showing how many people liked a post, etc.) to obtain parental consent for a minor to use their service.

Colorado

SB 24-041 (effective 2025): This law (amending Colorado’s comprehensive consumer privacy law) prohibits companies from collecting or using data from individuals under 18 for targeted advertising, profiling, or selling without proper consent. The law limits data retention, bans manipulative design features, and requires risk assessments for services likely to be accessed by minors.

HB 26-1263 (effective January 1, 2027): This law requires AI chat service operators to disclose to minor users that their chatbot is not human. Additionally, operators must provide account management tools for the parents of minor users. The tool must allow users and parents to decide if the AI can retain and train on their personal data and conversations.

Connecticut

§ 42-528 (effective 2024): This law requires social media platforms to unpublish minor accounts within 15 days or delete them within 45 days at the minor or legal guardian’s request.

SB 3  (effective 2024): This law (amending Connecticut’s comprehensive consumer privacy law) prohibits data controllers from selling minors’ personal data, processing such data for targeted advertising, or engaging in profiling without complying with certain consent requirements. The law prohibits collection of precise geolocation data without notice and consent. Data controllers must implement safeguards to prevent unsolicited messages from adults to minors and are required to take reasonable steps to protect minors from privacy violations, manipulative design, and other online harms. Data controllers are required to conduct data protection assessments when processing minors’ data.

SB 1295 (effective July 1, 2026): Section 13 amends § 42-528 by prohibiting social media platforms from requiring parents of minor users to download their platform in order to submit an unpublish or delete request.

Florida

SB 7072 (effective 2022): This law requires certain social media platforms to apply censorship and deplatforming standards in a consistent manner, to notify a user before shadow banning them, and to allow users to opt out of algorithm-driven feeds, allowing users the option of having a purely chronological feed. Additionally, social media platforms cannot censor, deplatform or shadow ban political candidates during their candidacy nor censor, deplatform, or shadow ban “journalistic enterprises” on the basis of their content. Social media platforms must also, upon request, provide a user with the number of other users who were shown the requesting user’s content or posts.

HB 3 (effective 2025): This law requires social media platforms to delete accounts of users that are younger than (or that the platform “treats or categorizes” as belonging to an account holder who is “likely younger than”) 14 years old. For users that are 14 and 15, the platform must acquire parental consent to allow such users to make an account.

Georgia

SB 351 (effective 2025): This law requires certain social media companies to implement age verification practices and prevents children under the age of 16 from creating social media accounts without parental consent.

Idaho

HB 542 (effective July 1, 2026): This law requires social media platforms to estimate the age of minor users based on their use habits and the data collected in the platform’s regular course of business. If the user is younger than 16 years of age, downloading the platform or major updates in terms, conditions, or data collection policies must be approved by the user’s parent.

SB 1297 (effective July 1, 2027): This law requires AI chatbot or conversational AI operators to offer account management tools to the parents of minor users aged 13 or younger. In addition, operators must regularly disclose to minor users that their service does not offer human conversation or interaction.

Iowa

SF 2417 (effective July 1, 2026) This law requires AI chatbot and conversational AI operators to conspicuously and regularly disclose to minor users that their models are not human. Additionally, operators must provide parental account management tools for users under the age of 13.

Louisiana

HB 61 (effective 2024): This law requires age verification, and no “interactive computer service,” broadly defined to encompass social media companies, may allow a minor to create an account without the consent of a legal representative of the minor.

HB 577 (effective 2025): This law prohibits certain social media companies from sending targeted advertisements to minor account holders and from selling certain personal data of the minor account holder. Such restricted data includes the account holder’s race, religion, gender, citizenship status, medical history, biometric data and geolocation data.

SB 162 (effective 2025): This law requires social media companies to verify the age of Louisianan users; minor users are prohibited from using a social media platform unless the company received parental consent. Social media companies also must provide parents of minor users with account management permissions and are prohibited from targeting ads to minor users based on anything other than age and location.

HB 37 (effective June 1, 2026): Establishes that owners and operators of a covered platform that contracts with a minor, including the creation of an online account, owes a duty of care to the minor, which requires the platform to prioritize the privacy of the minor’s account and establish certain default privacy settings.

HB 570 (effective July 1, 2026): Requires that application stores implement and utilize age verification procedures to identify when users are minors and to obtain parental consent before applications can be downloaded by minors. Requires accurate age ratings and prevents application stores and developers from enforcing exploitative terms of service without parental approval.

HB 977 (effective July 1, 2027): This law requires application stores to provide detailed consents to parents or legal guardians when their minor children download apps. The consents must include the app’s age rating (if any), the content description, as well as an overview of the data collected from the user. Additionally, this law prohibits developers from enforcing their terms of service against minor users unless the parent of the minor gave the requisite parental consent.

HB 427 (effective January 1, 2027): This law states that when minors create an account or otherwise contract with social media platforms, those platforms owe the minor users a duty of care with regard to preserving their privacy. The law requires social media platforms to provide parental account management and supervision tools and mandates heightened privacy settings for minor users.

Maryland

HB 603 (effective 2024): This law requires companies offering online services “reasonably likely to be accessed by children” to complete data protection impact assessments and set high privacy settings by default. The law requires covered companies to provide privacy information, terms of service, policies, and community standards using language suited to the age of children likely to access the company’s online products. The law prohibits profiling, data collection, or sharing unless strictly necessary for the relevant service and in the child’s best interest. The law prohibits dark patterns, restricts features like autoplay that encourage excessive use, and allows parental monitoring without notifying the child.

Minnesota

HF 4138 (effective July 1, 2026): This law establishes transparency requirements for social media platforms by requiring them to disclose the types and respective amounts of content on their platform, their notification practices, and an explanation of how they estimate the age of platform account holders using their data. Additionally, this law mandates that social media platforms must set minor user accounts to the highest possible privacy settings, disclose minor users’ platform usage data to their parents, and timely delete the accounts of minor users when requested.

SF 4097 (effective July 1, 2027): This law requires social media platforms to warn users of the potential mental health harms of social media when they first open the app. The warning screen must appear every time they access the platform. The precise contents of the warning label have not yet been outlined.

Mississippi

HB 1126 (effective 2024): Under this law, certain “digital service” providers must require account holders to register their age and must prevent minors from obtaining an account without express parental consent. Such providers must limit the collection and use of the minor’s personal information to what is necessary for providing the service. Such providers are prohibited from collecting precise geolocation data, showing targeted ads with harmful content, or sharing the minor’s personal data, subject to certain exceptions.

Montana

SB 297 (effective 2025): This law (amending Montana’s comprehensive consumer privacy law), requires controllers to exercise a duty of reasonable care to avoid a “heightened risk of harm” concerning minors. Requires consent of a minor (or parental consent for minors under 13) before the controller may: sell the minor’s data or share the data for targeted advertising or profiling; use the data for secondary purposes; use design features to extend use; or collect precise geolocation data. Limits the ability of adults to send unsolicited messages to minors. Requires a privacy impact assessment and a mitigation plan for processing that represents a heightened risk of harm to minors.

Nebraska

LB 504 (effective January 1, 2026): This law mandates privacy-by-design features such as limiting data collection, prohibiting targeted advertising, restricting geolocation tracking, and disabling features that promote excessive use, like infinite scroll or push notifications. The law requires clear notices when utilizing tracking features and tools to restrict adult-to-minor communication. The law prohibits using minors’ data for purposes beyond what is necessary to deliver the service.

Sec. 26-30 of LB 383 (effective July 1, 2026): This law requires social media companies to verify the age of account holders and obtain parental consents when a minor creates an account. Social media companies must provide account management and supervision tools to the parents or legal guardians of minor account holders.

New York

S 7694 (effective 2024): This law makes it illegal to provide an “addictive feed” without utilizing age verification to confirm that the relevant individual is not a minor or without first obtaining parental consent for minors and prohibits certain social media platforms from withholding non-addictive feed products or services where that consent is not obtained. The law prohibits “addictive social media platforms” from sending certain notifications to minors between midnight and 6:00AM.

S 7695 (effective 2025): For minors under 13, covered businesses may only process personal data in compliance with COPPA. For users 13 to 17, the law restricts processing except if a teenager expressly opts in or if the processing is strictly necessary for certain purposes. The law prohibits the sale of minors’ data and requires certain contract provisions with third parties/service providers. The law prohibits targeted advertising, profiling, and engagement-driven content feeds without opt-in consent from teens and unless COPPA-compliant for users under 13.

Ohio

Section 803.380 of HB 33 (effective 2023): This law requires social media (“online service”) operators that primarily market to or could reasonably be expected to attract children to obtain parental consent before the minor can use the online service and to make an account. The online service operator must verify the identity and age of the parent or legal guardian of the minor users and provide them with informational material and account management tools.

Oregon

HB 2008 (effective January 1, 2026): This law requires online service operators to limit their data collection only to what is necessary and to implement guardrails for data collection and use. Additionally, the law prohibits targeted advertising and sale of personal or geolocation data for minor users under the age of 16.

South Carolina

HB 3431 (effective February 5, 2026): This law requires certain social media (“online service”) providers to allow users and the parents or legal guardians of minor users to easily access account and data management tools. Additionally, they must limit the amount of data they collect from users. Providers must also audit and report a description of their service’s features, personal data collection policies, and its standard course of business relating to minor users. The law prohibits features like dark patterns.

HB 4591 (effective January 1, 2027): This law requires certain social media platforms to estimate the age of users in addition to collecting their self-reported age during the account formation process. A platform cannot create an account for a minor without the consent of a parent or legal guardian, who must have access to account and data management tools. Social media platforms must timely delete the accounts of minors if requested by a parent or legal guardian. Any contract created between the platform and a minor account holder is invalid unless there was parental consent for the account’s creation.

Tennessee

HB 1891 (effective 2025): This law requires certain social media companies to verify the age of account holders and requires parental consent before a minor is allowed to become an account holder. Such social media companies are also required to allow parents to view privacy settings, set daily time restrictions, and implement periods in which the minor cannot access the account.

Texas

HB 18 (effective 2024): This law requires digital platforms to develop and implement a strategy (using certain specified controls) to prevent minors’ exposure to harmful or unsuitable material and to verify users’ ages and obtain parental consent before allowing minors under 18 to create accounts. The law prohibits the collection, sale, or use of minors’ personal and geolocation data, and bans targeted advertising to minors. The law mandates that platforms provide parental tools to monitor, limit, or delete a child’s account and data.

SB 2420 (effective January 1, 2026): This law requires application stores to verify the age of users. If a minor user downloads or purchases an app, the app store must obtain the consent of a parent or legal guardian in order to complete the sale. Additionally, app stores must notify parents of minor users of any major changes or updates in the apps they have downloaded (subject to the app developers providing the requisite notice of changes to the app store). App developers must give their apps an age rating.

Utah

SB 194 (effective 2024): This law requires social media companies to verify the age of all users and requires companies to take certain steps to maintain the privacy of minors and to restrict collection of minors’ data. The law requires parental consent to bypass its requirements.

SB 142 (effective 2025): Requires certain age verification and account management practices for application store providers and application developers. Application stores must verify user ages when users create accounts and obtain parental consent for minors before allowing users to download an app or make in-app purchases. Developers must: verify user age categories and verify that parental consent has been obtained for minors; notify app store providers of significant changes to the app; use age category data to comply with applicable law; and request personal age verification or parental consent before its app is purchased or downloaded.

HB 498 (effective March 18, 2026; some developer provisions effective May 6, 2027): This law amends SB 142 by eliminating the requirement that developers use age category data to comply with applicable law. Additionally, it expands application store age verification requirements by requiring the attestation of a parent or legal guardian as to a minor user’s age.

HB 418 (effective July 1, 2026): Requires social media companies to facilitate data portability functionality for users’ personal data, including “social graphs,” which include connections, created content, and comments or other post interactions. Requires social media companies to implement interoperability interfaces that allow users to share data across social media platforms. The law also adds a right of correction to the Utah Consumer Privacy Act.

Vermont

SB 69 (effective January 1, 2027): This law prohibits the use of privacy-intrusive design features in online services and requires online services providers to set default privacy settings to a high level. The law prohibits companies from collecting, sharing, or retaining any personal data from minors unless it is strictly necessary to provide the relevant services. Covered businesses may not use previously collected data for new purposes and may not use design features that cause emotional distress, compulsive use, or discrimination. The law requires covered businesses to use age-assurance methods to be specified by the Vermont Attorney General.

Virginia

SB 854 (effective January 1, 2026): This law requires social media companies to perform age verification to determine if users are minors and to limit such minors to one hour per day of use. Only verified parental consent can increase or decrease the one-hour limit.

Washington

Sec. 4 of HB 2225 (effective January 1, 2027): This law requires certain AI chatbot operators to notify minor users that their services do not offer genuine human interaction. This law also requires operators to limit their AI models’ abilities to mimic human relationships, produce inappropriate outputs, or anything that might encourage isolation or negative mental health in the minor user.

Last updated: July 2026

---

Taft’s Privacy, Security & AI attorneys are available to assist with questions related to these issues. As always, please sign up to receive emails of our latest posts on our blog, Privacy and Data Security Insights, and follow us on LinkedIn for the latest in privacy, security and artificial intelligence legal news.