Covered websites and apps must verify users are adults

Covered commercial websites and apps must verify that users are at least 18 before allowing access to certain sexual material. This applies when a commercial entity knowingly and intentionally publishes or distributes sexual material harmful to minors as more than 33.33% of its website or app content. Verification may use digital identification, government-issued identification, or a commercially reasonable method using public or private transaction data. The entity or verification provider may not keep identifying information collected for verification after access is granted, except for information already held for another reason. The entity must use current National Institute of Standards and Technology best practices to limit the personal information shared between entities. The requirement applies to violations occurring on or after June 12, 2026, which is 90 days after passage.

A person harmed by a violation may sue the commercial entity, and the Attorney General may seek a court order stopping the violation and civil penalties. A lawsuit may be brought by a minor, parent, guardian, or other legally authorized person harmed by a failure to verify age or by prohibited material or data handling. A successful individual plaintiff may receive $10,000 per violation, actual damages when proven, and reasonable attorney fees and court costs. The Attorney General may seek up to $10,000 per day for an age-verification violation, $10,000 per improper data-retention instance, and up to $250,000 when minors access covered material because of the violation. Civil penalties must consider the seriousness of the violation, past violations, deterrence, economic effect, and the entity's knowledge. Civil actions must be filed within five years after the violation is discovered or reasonably should have been discovered.

Commercial entities may not knowingly publish or distribute obscene material or material depicting or promoting child pornography, and they may face liability for keeping or sharing verification information after access is granted. The rules cover commercial entities that publish or distribute covered material and protect internet providers, search engines, app stores, browsers, and cloud providers that did not create the content. News organizations and public-interest broadcasts are excluded from the article. Internet and technology providers are not liable merely for transmitting, hosting, storing, or providing access to content they did not create. A business may be liable for retaining, using, sharing, or selling identifying information after access is granted. The text bars damages for violations occurring before June 12, 2026.