Denise (![[staff profile]](https://www.dreamwidth.org/img/silk/identity/user_staff.png)
denise) wrote in ![[site community profile]](https://www.dreamwidth.org/img/comm_staff.png)
dw_advocacy2026-03-09 04:22 am
denise) wrote in dw_advocacy2026-03-09 04:22 am
The List of Shame
People frequently ask us about whether their specific US state is trying to enact a social media age verification law so they can call their state representatives and yell at them about it! I have had "build a system that will let me easily update this without having to do so manually, categorizing these bills by status, what problems they have, and what we'd do about them if they pass" on my want-to-do list for a really long time, but until I can, here's the current list of bills I know about.
This (very long, sigh) list is accurate to the best of my knowledge as of 8 March 2026, but it may not include every bill that's been introduced in every state. (I've used a few different lists plus my own "searching until I got too depressed to continue" to assemble it, excluding laws I think have absolutely no chance of passing but including laws where I think there's still even a slight chance.) If you know of one that isn't on the list, please let me know in the comments!
These are state laws only. I'm concentrating on those because you can find lists of bad federal bills more easily, but all the lists of state bills I know of are industry-gated or limited-distribution. If you don't have a preferred source for finding out about bad federal legislation about the internet, Bad Internet Bills (from Fight for the Future) and the EFF Action Center are a great place to start!
This list is only counting social media bills; I am not including bills that don't apply to us because they're modeled on the app store/OS age signal model legislation or bills that deal with age verification for other services like chatbots or "AI companions", because I'd go completely off the rails and resort to just screaming incoherently when the list passed a hundred items. I will try to update this at least quarterly, or whenever the Magic 8 Ball says there's a rapidly moving bill that you need to yell at people about.
Not all of these laws are obviously, on the surface, requiring age verification to access content: enough courts have struck down enough laws that flat out impose content-based age verification mandates that states are beginning to use different rationale. (The current trend is "product design regulation" and a lot of these are based on EPIC's model Age Appropriate Design Code. I think it is deeply ironic that a privacy organization is putting forth model legislation that would torpedo online privacy! Especially appreciate the digs at all the past litigation that protects user privacy in there, let me tell you.)
If you can't tell why a bill is on this list, remember: any law that requires a site to treat an account differently if it belongs to someone under a certain age is inherently requiring the site to determine the age of all of their users, because you can't treat "people under a target age" differently if you don't know which users are under that target age. Some of these states' bills don't have that problem as badly, because they don't specify how you need to determine someone's age, but they all also have the second problem: you can't treat users in different states differently if you don't know what states all your users are in. We not only don't know what state you're in if you haven't chosen to tell us, we can't afford to build a system that would tell us. (The geoblocking we do happens at the level of our provider, and we can't use that information to segment connections. We would have to pay for a geolocation database ourselves, and believe me, that is expensive.)
Bills listed as "in progress" can be at any stage of the legislative process, from "introduced but likely to die without action" to "very far along". I've tried to link to the Legiscan page for each bill so you can find out more information. My statements about whether a particular bill-in-progress would likely apply to Dreamwidth, and what actions we'd likely need to take if they pass, are my assessments of their current text, and may or may not change if that text changes. The "current legislative ends" dates are all taken from Legiscan's calendar, and are approximations.
The Magic 8 Ball is my attempt to quantify how likely a particular bill is to pass. It's a compilation of everything I know about the legislature in question, the legislators who sponsored it, the number of ways the legislature has already tried to break the internet, public statements made by legislators or the governor, and the aggregate assessment of all of the above from sources whose knowledge I trust that I've seen. It is completely subjective and I may very well have things ranked wrongly. If I do, blame me, not anybody else who's written about them!
The Magic 8 Ball says: the Arizona, Hawaii, Idaho, Kentucky, Michigan, and some of the New Jersey bills are on the "good chance it will pass" list, and if you live in one of those states, you should go pester your representatives about it/them. New Jersey has several bills pending; 3/4 of them would force us to block all connections from New Jersey if they go into effect. Hawaii, one bill in Michigan, and possibly Kentucky (depending on what the final version looks like) would force us to block registration from people under 18. Arizona would not apply to Dreamwidth, but it's likely to pass and it's a really terrible law that would make life so much harder for queer people online, so go yell at your legislators about it anyway.
The Magic 8 Ball says: the California bill is just a placeholder, but once that placeholder gets filled in, it's reasonably likely to pass. You probably don't need to call yet, but keep an eye on the Legiscan page for the final version to get filed. (Unless your representatives are Josh Lowenthal or Buffy Wicks, in which case please call them right now just on principle to tell them to stop repeatedly trying to break the internet. Ahem.)
The Magic 8 Ball says "outlook hazy, try again" on Missouri: I don't have a good vibe for its current chance of passage, but if it does pass in its current form without clarification of a few ridiculously vague terms, we would be forced to block all connections from Missouri once it went into effect. If you live in Missouri, I'd give your representatives a call just to be on the safe side.
Indiana: HB 1408 was signed by the governor on 4 March 2026. The version as signed doesn't apply to Dreamwidth because we don't meet the definitions, but requires sites that do to identify Indiana residents under 16, track their time spent on the site, obtain parental consent for account creation, and allow parents full access to the user's account.
South Carolina: HB 3431 was signed by the governor on 5 February 2026. Dreamwidth is covered by the act (we think) and we posted about it here. Netchoice has sued: Netchoice v. Wilson, 3:26-cv-00543, (D.S.C.).
Alaska: SB 262: Requires covered sites to completely prevent anyone under 16 from creating an account and terminate the accounts of all existing under-16 users. (This bill would not apply to Dreamwidth in its current form.) Current legislative sesion ends 21 May 2026, but the Magic 8 Ball rates this as highly unlikely to pass.
Arizona: HB 2991 (passed and sent to Senate on 5 March 2026) / SB 1747. Requires covered sites to age-verify all users, terminate the account of any user younger than 14, terminate the account of users who are 14 or 15 years old unless they obtain parental consent to make or keep the account, and prevent access to any material "harmful to minors" to any account belonging to anyone under 18 if material "harmful to minors" consists of more than 1/3 of the material on the site. "Harmful to minors" is defined in 13-3501 by reference, and if you guessed it explicitly calls out "homosexuality" as inherently "sexual conduct", see the cashier in the back for your prize. (I do not think this bill would apply to Dreamwidth in its current form, because the definition of "social media platform" is conjunctive and not disjunctive and we don't meet all the criteria.) Magic 8 ball says this one is likely to pass, so if you're in AZ, call your representatives even though it wouldn't affect Dreamwidth, because it would make life so much harder for queer people everywhere online. Current legislative session ends 25 April 2026.
California: AB 1709 is in very very bare-bones form right now (literally just "It is the intent of the Legislature to enact legislation to establish a minimum age requirement to open or maintain a social media account" as a placeholder while they debate what that age should be), but it's from the usual gang of California legislators who are the source of all the awful tech laws, and Newsom has indicated he backs it. (We do not have enough information to know whether the final version of the bill would apply to Dreamwidth.) Current legislative session ends 31 August 2026, so there's still plenty of time for them to make yet another gigantic mess everyone is going to have to clean up. Ahem.
Connecticut: HB 5037 is partially adapted from the model AADC with its own special homegrown horrors, and requires covered sites to use "commercially reasonable and technically feasible" means to determine which users are under 18, to obtain parental consent for anyone under 18 to do a whole lot of things including accessing algorithmic feeds, to allow parents access to change account privacy and time limit settings, to show all users under 18 a non-dismissable warning screen for at least 30 seconds that covers at least 75% of the screen and repeat that warning every 3 hours of "continuous or non-continuous use" for at least 10 seconds and covering at least 25% of the screen containing specific (bullshit) state-mandated language, to limit by default all under-18 accounts to an hour a day time limit unless overridden by the user's parent, and to avoid sending notifications to under-18 accounts between 9pm and 8am unless a parent has granted approval. (I do not think this bill would apply to Dreamwidth in its current form, but I'm not 100% sure because there are some intersections of clauses in there I would have to print and sparly-gel-pen cross-reference to be certain.) Currrent legislative session ends 6 May 2026.
Georgia: SB 495 is rated by the Magic 8 Ball as deeply unlikely to advance before the current legislative session ends on 6 April, but including for completeness. The short timeline remaining and the fact it's not under active consideration means I'm invoking an "I ain't reading all that" exception for explaining the details, but it's adapted from the model AADC. Current legislative session ends 6 April 2026.
Georgia: SB 343 mandates age verification, bans social media use by users under 14, and requires parental consent for users between 14 and 18. Magic 8 Ball again rates it as unlikely to advance. Currrent legislative session ends 6 April 2026.
Hawaii: SB 2761 would prohibit all users under 16 from having accounts on any "social media" service (with a definition of "social media" so broad that they really mean "any website that accepts user-generated content and displays it publicly"; good luck saving teenagers from your local newspaper's comment section, folks!) There's a small saving grace in that it doesn't mandate age verification and indicates using self-attested age is enough, but that's really not much of an improvement. (This bill would likely apply to Dreamwidth in its current form, and would cause us to add Hawaii to the list of states we don't allow registration from for people under a certain age; we might initially have to set it to "under 18" even though the law would only restrict under-16s, depending on how much implementation lead time the final version has.) Current legislative session ends 7 May 2026 and the Magic 8 Ball rates this as moderately likely to pass.
Idaho: HB 542 is adapted from the model AADC and has passed the House and gone to the Senate. Requires covered sites to perform age estimatation (but not age verification) on an ongoing basis, requires sites to collect DOB on account registration and obtain parental consent if the DOB indicates the user is under 16, requires all under-16 accounts to be set to the most restrictive privacy settings by default, requires parental control over total time limits and time-of-day limits, and terminate an account of someone under 16 on parental request. (This bill would not apply to Dreamwidth in its current form.) Current legislative session ends 10 April 2026, but it's getting a lot of priority attention and the Magic 8 Ball rates it as moderately likely to pass.
Kansas: SB 499 is another "I ain't reading all that" exception for explaining, but it's yet more AADC nonsense. Current legislative session is expected to end 10 April 2026, but the "no bills will be considered past this date except appropriations bills and bills from these specific exempt committees" adjournment was 27 March. However! The committee it's with is one of the exempt committees. However! It is still really unlikely to advance, because it never had a committee hearing. So the Magic 8 Ball says it's almost certainly dead, Jim, but including for completeness anyway.
Kentucky: HB 227. The bill in its current form has so many contradictory and unclear requirements (sometimes it's talking about under-13, sometimes under-16, sometimes under-18), but my best effort reading of it is that it's requiring covered sites to perform age estimation but not age verification, obtain verifiable parental consent to create an account for a child under 13 (already required by federal law), allow parents to request account termination for any account belonging to someone under 18, and possibly require setting time limits on accounts belonging to people between 13 and 18 but I'm genuinely not sure because of how badly it's written. (Whether or not this bill would apply to Dreamwidth depends on how or whether they fix the nonsensical contradictions in it.) Current legislative session ends 15 April 2026, but it's getting high-priority attention right now and the Magic 8 Ball says it's moderately likely to pass, although God knows what it'll look like when it does.
Kentucky: HB 633 is getting much less action than HB 227, so I'll forego explaining it, but again, it's the typical nonsense. Current legislative session ends 15 April 2026.
Massachusetts: S30 / H4229 is a fairly abridged version of the model AADC requiring covered platforms to age verify all users and banning algorithmic feeds and notifications sent between midnight and 6AM for users under 18. (This bill would not apply to Dreamwidth in its current form.) Current legislative session ends 31 July 2026. Magic 8 Ball says "outlook hazy" and mostly dependent on what's in the Governor's not-yet-introduced legislation.
Michigan: SB 757 regulates "addictive feeds" for people under 18: sites can only offer an "addictive feed" to a user if they have actual knowledge the user is over 18 or if they have verified parental consent, and can't send a notification concerning an "addictive feed" to someone under 18 between 10pm and 6am year-round and between 8am and 4pm on a weekday during the school year. (SB 757 would not apply to Dreamwidth in its current form.) Current legislative session ends 31 December 2026. The Magic 8 Ball rates this as less likely to pass than 758 below, but they may pass both 757 and 758 in hopes 757 will survive when 758 inevitably gets enjoined.
Michigan: SB 758 and SB 759. SB 758 is the model AADC gone even further, and requires that a "covered service" create the usual set of privacy tools and default settings for minors, prohibit allowing any adult to contact a minor in any way including direct messaging unless they're already "connected", not show any adult a list of who a minor is "connected to", not send notifications to minors between 10pm and 6am year-round and between 8am and 4pm on weekdays during the school year, use "dark patterns" (defined so vaguely that absolutely everything is a "dark pattern"), not provide any personalized feeds or recommendations to minors, track time spent on the service, allow parents to manage a minor's privacy, security, and total-time-allowed settings, and transmit a truly ridiculous amount of data to "independent third party auditors" annually for them to make mandatory public reports opining on a lot of bullshit. SB 759 amends the Consumer Protection Act to make violating SB 758 an "unfair trade practice". (SB 758 would apply to Dreamwidth in its current form, and would cause us add Michigan to the list of states we don't allow under-18 registration from.) Current legislative session ends 31 December 2026. The Magic 8 Ball rates this as moderately likely to pass.
Missouri: HB 3393 requiring covered sites to perform age verification of all users, completely prohibit registration from people under 16, establish parental consent for people between 16-18; allow parents to access the entire activity of, delete the account of, change all the settings of, and block any adults (regardless of whether they're "connected" or not) from contacting a 16-18 year old; and not use "addictive and manipulative design features" (undefined, of course) targeting minors. (This bill would possibly apply to Dreamwidth in its current form, because there's an "and" on the list that includes "algorithmically curated feeds" but it doesn't define "algorithmically curated feed". The onerous age verification and parental consent requirements for all visitors to the site, including logged-out users by my reading, plus that uncertainty about scope, means its passage would likely cause us to block all access for users whose connections geolocate to the state of Missouri, identical to the Mississippi block.) Current legislative session ends 30 May 2026. Magic 8 Ball cannot guess at chance of passage.
Nebraska: LB 1119, based on the model AADC and requiring covered sites to offer users under 18 an easy way to delete their accounts, to refrain from targeted advertising to users under 18, and to refrain from sending notifications between the hours of 10pm-6am daily and 8am-4pm on weekdays during the school year. It explicitly does not mandate age verification, and only applies to services with actual knowledge that more than 2% of their users are minors. (This bill would probably not apply to Dreamwidth in its current form; we haven't run our stats to see if more than 2% of our users are under 18 and the stats page excludes people with private birthdates.) Current legislative session ends 17 April 2026.
Nebraska: Very similar provisions to LB 1119 above were just added to LB 838, via amendment that passed on 6 March 2026. In addition to the requirements of LB 1119, it also requires covered sites to provide minors with a specific set of privacy tools and adds a parental control requirement. (This bill would probably not apply to Dreamwidth in its current form: I haven't had enough time with the amended version of it yet to tell for sure.) Current legislative session ends 17 April 2026. Magic 8 Ball thinks the end-run amendment is probably a sneaky way of making sure it's got a higher chance of passing in time, because the only-vaguely-connected legislation it was thrown into is "vetoing this law means you hate grandparents everywhere".
New Hampshire: HB 1650 is adapted from the model AADC and requires covered sites to provide a specific set of privacy tools and configure all defaults for maximum privacy for people under 18 including not showing a minors' posts to adults or allowing adults to interact with minors' posts, establishes a duty of care to prevent "emotional distress, compulsive use, or discrimination" to people under 18 (as defined in regulations made by the Attorney General), and prohibits notifications from being sent to someone under 18 between the hours of midnight and 6am. (This bill would likely apply to Dreamwidth in its current form, and would cause us add New Hampshire to the list of states we don't allow under-18 registration from.) Current legislative session ends 30 June 2026. Magic 8 ball says chances of passage are low, however.
New Jersey: AB 4015 / SB 3413 are companion bills based on the model AADC. They require covered sites to create the usual set of privacy tools and default settings for minors, prohibit allowing any adult to contact a minor in any way including direct messaging unless they're already "connected", not show any adult a list of who a minor is "connected to", not send notifications to minors between 10pm and 6am year-round and between 8am and 4pm on weekdays during the school year, not use "dark patterns" (again, so vaguely defined that the definition is worthless), track the time all minors spend on the site, and transmit a truly ridiculous amount of data to "independent third party auditors" annually for them to make mandatory public reports opining on a lot of bullshit. (These bills would probably apply to Dreamwidth in their current form, despite them including the same "must be 2% minors" saving throw as Nebraska, because it's written in the opposite way than Nebraska did: you have to have "actual knowledge" that 98% of your users are adults, not that no more than 2% of your users are minors, and that means we'd have to count OpenID accounts as minors for the calculations. If they pass, they would cause us to block access to all connections from New Jersey.) Current legislative session ends 11 January 2028. This is the one the Magic 8 ball rates as most likely to pass out of all of the NJ list.
New Jersey: AB 4013/SB 3412 are companion bills. They require covered sites to time-track usage and proactively monitor all users' (not just minor users') use of the site for "problematic behaviors" (use of the site for more than 3 hours per day cumulative, accessing the site within 10 minutes of waking up, or making more than 10 posts a day, plus anything else the Commissioner of Health determines is "problematic behavior"), display a bullshit state-mandated warning covering 25% of the screen on everyone's (minors' and adults') first login of the day for at least 10 seconds or until the user dismisses it, display a bullshit non-dismissable state-mandated warning for everyone for at least 90 seconds that covers at least 75% of the screen after 3 hours of cumulative daily use and every hour afterwards (unless you have actual knowledge the user is over 17, in which case it can be dismissable, 10 seconds, and 25% of the screen), and if the site detects detect any of the "problematic behavior" on a user's account, inform the user that they've detected "problematic behavior" and provide a list of state-approved resources for Helping You Stop That Problematic Behavior. (I have been desperately trying to avoid making too many snarky asides throughout writing this, but I failed my saving throw on this one: if your bill is repeatedly using language from 2014 Tumblr, maybe you should rethink it.) Oh, and you also have to repeat the state-mandated disclaimer about social media under every ad on the platform. (These bills would apply to Dreamwidth in their current form, and if they pass, they likely would cause us to block access to all connections from New Jersey. Fortunately, this kind of compelled speech is really easily knocked out as unconstitutional. Which is good, because I have no idea how we could possibly tell whether someone had just woken up.) Current legislative session ends 11 January 2028. The Magic 8 Ball says this one is slightly less likely to pass than the above, but I encourage everyone living in New Jersey to obey the finest traditions of my natal state and figure out the most creative ways to insult your representatives about it anyway.
New Jersey: AB 2739 is, on the surface, the least objectionable bill on this list: it prevents covered sites from using "a design, algorithm, practice, affordance, or feature that the platform knows, or which by the exercise of reasonable care should have known, could cause child users to develop an eating disorder, including, but not limited to, promoting diet products", and requires quarterly internal audits and annual external audits to determine whether anything on the site has that potential (and if there are any findings, correct them/stop doing them within 30 days). (It also manages to almost completely invalidate itself by precluding liability for anything the website didn't post itself.) However, it doesn't explicitly say you can rely on self-attestation for determining who's a "child" and who isn't, what little definition there is also covers logged-out users, there's no data anonymization/protection provisions for the third-party annual audits, and there is absolutely no scientific consensus about what causes children to develop eating disorders. (I have consulted so many child psychologists who specialize in treating eating disorders over the last 25 years looking for some guidance on that, and yep, no consensus at all.) This bill would not apply to Dreamwidth in its current form, and the Magic 8 Ball says this one is the least likely to pass; it did pass last session but the governor pocket-vetoed it (although the governor has changed). Might as well include it while you're insulting your representatives, though. Current legislative session ends 11 January 2028.
Oklahoma: SB 1871 requires covered sites to disable logged-out viewing of the site, freeze all accounts belonging to anyone in Oklahoma, conduct mandatory age verification using uploaded state ID, establish the usual package of settings and defaults for anyone under 18, disable all features that "prolong engagement" for people under 18, disable accounts at parental request, allow parents to access minors' settings, and forbid minors from changing any privacy setting without parental consent. This bill would likely apply to Dreamwidth in its current form, and would probably require us to block Oklahoma, but the Magic 8 Ball says it's extremely unlikely to pass so I'm not going to put it on the "would likely block" list. Current legislative session ends 30 May 2026.
Pennsylvania: HB 1430 is a ludicrous katamari of every single moral panic theory about social media and teenagers whose only saving grace is it has been languishing in committee for nearly a year with no sign of movement, indicating at least someone on that committee probably has a glimmer of clue (and also that I get to invoke the "I ain't explaining all that" exemption). Still, I don't have as good a read on the PA legislature as I'd like and the bill is still technically active, so I'm including this out of a modicum of caution even though the Magic 8 Ball says it's probably dead, Jim. Current legislative session ends 30 November 2026.
Rhode Island: SB 2406 requires covered sites to create "data protection impact assessments" and provide them to the Attorney General on demand, plus provide a specific set of privacy tools and configure all defaults for maximum privacy for people under 18. Creates a duty of care for sites to prevent certain harms to people under 18. It explicitly does not mandate age verification (but does include any self-attested age data and any age a site imputes to the user). (This bill would likely apply to Dreamwidth in its current form, and would cause us add Rhode Island to the list of states we don't allow under-18 registration from.) Current legislative session ends 30 June 2026, but the Magic 8 Ball says it's not likely to pass.
South Carolina: HB 4591 duplicates much of the already-enacted HB 3431 with some slightly different provisions, but the legislature is still making floor amendments to it as of 6 March, so including here for completeness. Magic 8 Ball thinks they may be trying to pass something else and repeal the one they're already getting sued over, the way Utah tried a while back, to delay the lawsuit. Current legislative session ends 7 May 2026.
South Carolina: HB 5209 duplicates much of the already-enacted HB 3431 with some slightly different provisions; again, including here for completeness, but the Magic 8 Ball thinks this one's probably dead. Current legislative session ends 7 May 2026.
Massachusetts: The Governor has indicated she intends to introduce a more wide-ranging package of legislation than S30/H4229 above, but without much detail as to what it would include, other than definitely mentioning age verification, time restrictions, and parental consent. (We can't tell if it would apply to Dreamwidth or not until we see the text.) Current legislative session ends 31 July 2026.
If these states' bills pass in their current form without significant changes, we would likely be forced to block under-18 registration the way we currently do for Tennessee and South Carolina:
Hawaii (as an under-16 registration block)
Michigan (SB 758 only)
New Hampshire
Rhode Island
If these states' bills pass in their current form without significant changes, we would likely be forced to block all connections that geolocate to the state entirely the way we currently do for Mississippi:
Missouri
New Jersey (SB 3413 and AB 4013/SB 3412 only)
We do not currently have enough information about whether these bills would affect Dreamwidth or require us to make any changes:
California (placeholder bill, still in development)
Kentucky (incoherent, still in development)
Massachusetts (the not-yet-introduced governor's package)
These bills likely would only affect us if more than 2% of our users submitted a date of birth at account creation making them under 18, which we've never calculated:
Nebraska
I am still not actually a lawyer, no matter how often I've considered going to law school at my advanced age. My interpretation of these laws may not be 100% accurate and my assessment of whether we would be covered by them and the likely actions we'd have to take may change after Actual Lawyer advice (as well as based on whether or not an organization we're a member of chooses to challenge the law in court and whether the court grants a preliminary injunction preventing the enforcement of the law against members). Do not take any statements made within this entry as anything other than my first-pass assessment of which laws would affect us and what actions we would have to take if they pass. It's possible that something listed as "likely wouldn't affect us" actually would, or vice versa. Do not fold, spindle, or mutilate. Cape does not enable wearer to fly. I am still very, very tired and I want legislators to stop trying to break the entire freaking internet already. I also really, really want Legiscan to stop throwing me captchas every half an hour even if I've been slamming them all week while researching.
This (very long, sigh) list is accurate to the best of my knowledge as of 8 March 2026, but it may not include every bill that's been introduced in every state. (I've used a few different lists plus my own "searching until I got too depressed to continue" to assemble it, excluding laws I think have absolutely no chance of passing but including laws where I think there's still even a slight chance.) If you know of one that isn't on the list, please let me know in the comments!
These are state laws only. I'm concentrating on those because you can find lists of bad federal bills more easily, but all the lists of state bills I know of are industry-gated or limited-distribution. If you don't have a preferred source for finding out about bad federal legislation about the internet, Bad Internet Bills (from Fight for the Future) and the EFF Action Center are a great place to start!
This list is only counting social media bills; I am not including bills that don't apply to us because they're modeled on the app store/OS age signal model legislation or bills that deal with age verification for other services like chatbots or "AI companions", because I'd go completely off the rails and resort to just screaming incoherently when the list passed a hundred items. I will try to update this at least quarterly, or whenever the Magic 8 Ball says there's a rapidly moving bill that you need to yell at people about.
Definitions, Clarifications, and Caveats
Not all of these laws are obviously, on the surface, requiring age verification to access content: enough courts have struck down enough laws that flat out impose content-based age verification mandates that states are beginning to use different rationale. (The current trend is "product design regulation" and a lot of these are based on EPIC's model Age Appropriate Design Code. I think it is deeply ironic that a privacy organization is putting forth model legislation that would torpedo online privacy! Especially appreciate the digs at all the past litigation that protects user privacy in there, let me tell you.)
If you can't tell why a bill is on this list, remember: any law that requires a site to treat an account differently if it belongs to someone under a certain age is inherently requiring the site to determine the age of all of their users, because you can't treat "people under a target age" differently if you don't know which users are under that target age. Some of these states' bills don't have that problem as badly, because they don't specify how you need to determine someone's age, but they all also have the second problem: you can't treat users in different states differently if you don't know what states all your users are in. We not only don't know what state you're in if you haven't chosen to tell us, we can't afford to build a system that would tell us. (The geoblocking we do happens at the level of our provider, and we can't use that information to segment connections. We would have to pay for a geolocation database ourselves, and believe me, that is expensive.)
Bills listed as "in progress" can be at any stage of the legislative process, from "introduced but likely to die without action" to "very far along". I've tried to link to the Legiscan page for each bill so you can find out more information. My statements about whether a particular bill-in-progress would likely apply to Dreamwidth, and what actions we'd likely need to take if they pass, are my assessments of their current text, and may or may not change if that text changes. The "current legislative ends" dates are all taken from Legiscan's calendar, and are approximations.
The Magic 8 Ball is my attempt to quantify how likely a particular bill is to pass. It's a compilation of everything I know about the legislature in question, the legislators who sponsored it, the number of ways the legislature has already tried to break the internet, public statements made by legislators or the governor, and the aggregate assessment of all of the above from sources whose knowledge I trust that I've seen. It is completely subjective and I may very well have things ranked wrongly. If I do, blame me, not anybody else who's written about them!
The Magic 8 Ball says: the Arizona, Hawaii, Idaho, Kentucky, Michigan, and some of the New Jersey bills are on the "good chance it will pass" list, and if you live in one of those states, you should go pester your representatives about it/them. New Jersey has several bills pending; 3/4 of them would force us to block all connections from New Jersey if they go into effect. Hawaii, one bill in Michigan, and possibly Kentucky (depending on what the final version looks like) would force us to block registration from people under 18. Arizona would not apply to Dreamwidth, but it's likely to pass and it's a really terrible law that would make life so much harder for queer people online, so go yell at your legislators about it anyway.
The Magic 8 Ball says: the California bill is just a placeholder, but once that placeholder gets filled in, it's reasonably likely to pass. You probably don't need to call yet, but keep an eye on the Legiscan page for the final version to get filed. (Unless your representatives are Josh Lowenthal or Buffy Wicks, in which case please call them right now just on principle to tell them to stop repeatedly trying to break the internet. Ahem.)
The Magic 8 Ball says "outlook hazy, try again" on Missouri: I don't have a good vibe for its current chance of passage, but if it does pass in its current form without clarification of a few ridiculously vague terms, we would be forced to block all connections from Missouri once it went into effect. If you live in Missouri, I'd give your representatives a call just to be on the safe side.
Recently passed
Indiana: HB 1408 was signed by the governor on 4 March 2026. The version as signed doesn't apply to Dreamwidth because we don't meet the definitions, but requires sites that do to identify Indiana residents under 16, track their time spent on the site, obtain parental consent for account creation, and allow parents full access to the user's account.
South Carolina: HB 3431 was signed by the governor on 5 February 2026. Dreamwidth is covered by the act (we think) and we posted about it here. Netchoice has sued: Netchoice v. Wilson, 3:26-cv-00543, (D.S.C.).
Still in the legislative process
Alaska: SB 262: Requires covered sites to completely prevent anyone under 16 from creating an account and terminate the accounts of all existing under-16 users. (This bill would not apply to Dreamwidth in its current form.) Current legislative sesion ends 21 May 2026, but the Magic 8 Ball rates this as highly unlikely to pass.
Arizona: HB 2991 (passed and sent to Senate on 5 March 2026) / SB 1747. Requires covered sites to age-verify all users, terminate the account of any user younger than 14, terminate the account of users who are 14 or 15 years old unless they obtain parental consent to make or keep the account, and prevent access to any material "harmful to minors" to any account belonging to anyone under 18 if material "harmful to minors" consists of more than 1/3 of the material on the site. "Harmful to minors" is defined in 13-3501 by reference, and if you guessed it explicitly calls out "homosexuality" as inherently "sexual conduct", see the cashier in the back for your prize. (I do not think this bill would apply to Dreamwidth in its current form, because the definition of "social media platform" is conjunctive and not disjunctive and we don't meet all the criteria.) Magic 8 ball says this one is likely to pass, so if you're in AZ, call your representatives even though it wouldn't affect Dreamwidth, because it would make life so much harder for queer people everywhere online. Current legislative session ends 25 April 2026.
California: AB 1709 is in very very bare-bones form right now (literally just "It is the intent of the Legislature to enact legislation to establish a minimum age requirement to open or maintain a social media account" as a placeholder while they debate what that age should be), but it's from the usual gang of California legislators who are the source of all the awful tech laws, and Newsom has indicated he backs it. (We do not have enough information to know whether the final version of the bill would apply to Dreamwidth.) Current legislative session ends 31 August 2026, so there's still plenty of time for them to make yet another gigantic mess everyone is going to have to clean up. Ahem.
Connecticut: HB 5037 is partially adapted from the model AADC with its own special homegrown horrors, and requires covered sites to use "commercially reasonable and technically feasible" means to determine which users are under 18, to obtain parental consent for anyone under 18 to do a whole lot of things including accessing algorithmic feeds, to allow parents access to change account privacy and time limit settings, to show all users under 18 a non-dismissable warning screen for at least 30 seconds that covers at least 75% of the screen and repeat that warning every 3 hours of "continuous or non-continuous use" for at least 10 seconds and covering at least 25% of the screen containing specific (bullshit) state-mandated language, to limit by default all under-18 accounts to an hour a day time limit unless overridden by the user's parent, and to avoid sending notifications to under-18 accounts between 9pm and 8am unless a parent has granted approval. (I do not think this bill would apply to Dreamwidth in its current form, but I'm not 100% sure because there are some intersections of clauses in there I would have to print and sparly-gel-pen cross-reference to be certain.) Currrent legislative session ends 6 May 2026.
Georgia: SB 495 is rated by the Magic 8 Ball as deeply unlikely to advance before the current legislative session ends on 6 April, but including for completeness. The short timeline remaining and the fact it's not under active consideration means I'm invoking an "I ain't reading all that" exception for explaining the details, but it's adapted from the model AADC. Current legislative session ends 6 April 2026.
Georgia: SB 343 mandates age verification, bans social media use by users under 14, and requires parental consent for users between 14 and 18. Magic 8 Ball again rates it as unlikely to advance. Currrent legislative session ends 6 April 2026.
Hawaii: SB 2761 would prohibit all users under 16 from having accounts on any "social media" service (with a definition of "social media" so broad that they really mean "any website that accepts user-generated content and displays it publicly"; good luck saving teenagers from your local newspaper's comment section, folks!) There's a small saving grace in that it doesn't mandate age verification and indicates using self-attested age is enough, but that's really not much of an improvement. (This bill would likely apply to Dreamwidth in its current form, and would cause us to add Hawaii to the list of states we don't allow registration from for people under a certain age; we might initially have to set it to "under 18" even though the law would only restrict under-16s, depending on how much implementation lead time the final version has.) Current legislative session ends 7 May 2026 and the Magic 8 Ball rates this as moderately likely to pass.
Idaho: HB 542 is adapted from the model AADC and has passed the House and gone to the Senate. Requires covered sites to perform age estimatation (but not age verification) on an ongoing basis, requires sites to collect DOB on account registration and obtain parental consent if the DOB indicates the user is under 16, requires all under-16 accounts to be set to the most restrictive privacy settings by default, requires parental control over total time limits and time-of-day limits, and terminate an account of someone under 16 on parental request. (This bill would not apply to Dreamwidth in its current form.) Current legislative session ends 10 April 2026, but it's getting a lot of priority attention and the Magic 8 Ball rates it as moderately likely to pass.
Kansas: SB 499 is another "I ain't reading all that" exception for explaining, but it's yet more AADC nonsense. Current legislative session is expected to end 10 April 2026, but the "no bills will be considered past this date except appropriations bills and bills from these specific exempt committees" adjournment was 27 March. However! The committee it's with is one of the exempt committees. However! It is still really unlikely to advance, because it never had a committee hearing. So the Magic 8 Ball says it's almost certainly dead, Jim, but including for completeness anyway.
Kentucky: HB 227. The bill in its current form has so many contradictory and unclear requirements (sometimes it's talking about under-13, sometimes under-16, sometimes under-18), but my best effort reading of it is that it's requiring covered sites to perform age estimation but not age verification, obtain verifiable parental consent to create an account for a child under 13 (already required by federal law), allow parents to request account termination for any account belonging to someone under 18, and possibly require setting time limits on accounts belonging to people between 13 and 18 but I'm genuinely not sure because of how badly it's written. (Whether or not this bill would apply to Dreamwidth depends on how or whether they fix the nonsensical contradictions in it.) Current legislative session ends 15 April 2026, but it's getting high-priority attention right now and the Magic 8 Ball says it's moderately likely to pass, although God knows what it'll look like when it does.
Kentucky: HB 633 is getting much less action than HB 227, so I'll forego explaining it, but again, it's the typical nonsense. Current legislative session ends 15 April 2026.
Massachusetts: S30 / H4229 is a fairly abridged version of the model AADC requiring covered platforms to age verify all users and banning algorithmic feeds and notifications sent between midnight and 6AM for users under 18. (This bill would not apply to Dreamwidth in its current form.) Current legislative session ends 31 July 2026. Magic 8 Ball says "outlook hazy" and mostly dependent on what's in the Governor's not-yet-introduced legislation.
Michigan: SB 757 regulates "addictive feeds" for people under 18: sites can only offer an "addictive feed" to a user if they have actual knowledge the user is over 18 or if they have verified parental consent, and can't send a notification concerning an "addictive feed" to someone under 18 between 10pm and 6am year-round and between 8am and 4pm on a weekday during the school year. (SB 757 would not apply to Dreamwidth in its current form.) Current legislative session ends 31 December 2026. The Magic 8 Ball rates this as less likely to pass than 758 below, but they may pass both 757 and 758 in hopes 757 will survive when 758 inevitably gets enjoined.
Michigan: SB 758 and SB 759. SB 758 is the model AADC gone even further, and requires that a "covered service" create the usual set of privacy tools and default settings for minors, prohibit allowing any adult to contact a minor in any way including direct messaging unless they're already "connected", not show any adult a list of who a minor is "connected to", not send notifications to minors between 10pm and 6am year-round and between 8am and 4pm on weekdays during the school year, use "dark patterns" (defined so vaguely that absolutely everything is a "dark pattern"), not provide any personalized feeds or recommendations to minors, track time spent on the service, allow parents to manage a minor's privacy, security, and total-time-allowed settings, and transmit a truly ridiculous amount of data to "independent third party auditors" annually for them to make mandatory public reports opining on a lot of bullshit. SB 759 amends the Consumer Protection Act to make violating SB 758 an "unfair trade practice". (SB 758 would apply to Dreamwidth in its current form, and would cause us add Michigan to the list of states we don't allow under-18 registration from.) Current legislative session ends 31 December 2026. The Magic 8 Ball rates this as moderately likely to pass.
Missouri: HB 3393 requiring covered sites to perform age verification of all users, completely prohibit registration from people under 16, establish parental consent for people between 16-18; allow parents to access the entire activity of, delete the account of, change all the settings of, and block any adults (regardless of whether they're "connected" or not) from contacting a 16-18 year old; and not use "addictive and manipulative design features" (undefined, of course) targeting minors. (This bill would possibly apply to Dreamwidth in its current form, because there's an "and" on the list that includes "algorithmically curated feeds" but it doesn't define "algorithmically curated feed". The onerous age verification and parental consent requirements for all visitors to the site, including logged-out users by my reading, plus that uncertainty about scope, means its passage would likely cause us to block all access for users whose connections geolocate to the state of Missouri, identical to the Mississippi block.) Current legislative session ends 30 May 2026. Magic 8 Ball cannot guess at chance of passage.
Nebraska: LB 1119, based on the model AADC and requiring covered sites to offer users under 18 an easy way to delete their accounts, to refrain from targeted advertising to users under 18, and to refrain from sending notifications between the hours of 10pm-6am daily and 8am-4pm on weekdays during the school year. It explicitly does not mandate age verification, and only applies to services with actual knowledge that more than 2% of their users are minors. (This bill would probably not apply to Dreamwidth in its current form; we haven't run our stats to see if more than 2% of our users are under 18 and the stats page excludes people with private birthdates.) Current legislative session ends 17 April 2026.
Nebraska: Very similar provisions to LB 1119 above were just added to LB 838, via amendment that passed on 6 March 2026. In addition to the requirements of LB 1119, it also requires covered sites to provide minors with a specific set of privacy tools and adds a parental control requirement. (This bill would probably not apply to Dreamwidth in its current form: I haven't had enough time with the amended version of it yet to tell for sure.) Current legislative session ends 17 April 2026. Magic 8 Ball thinks the end-run amendment is probably a sneaky way of making sure it's got a higher chance of passing in time, because the only-vaguely-connected legislation it was thrown into is "vetoing this law means you hate grandparents everywhere".
New Hampshire: HB 1650 is adapted from the model AADC and requires covered sites to provide a specific set of privacy tools and configure all defaults for maximum privacy for people under 18 including not showing a minors' posts to adults or allowing adults to interact with minors' posts, establishes a duty of care to prevent "emotional distress, compulsive use, or discrimination" to people under 18 (as defined in regulations made by the Attorney General), and prohibits notifications from being sent to someone under 18 between the hours of midnight and 6am. (This bill would likely apply to Dreamwidth in its current form, and would cause us add New Hampshire to the list of states we don't allow under-18 registration from.) Current legislative session ends 30 June 2026. Magic 8 ball says chances of passage are low, however.
New Jersey: AB 4015 / SB 3413 are companion bills based on the model AADC. They require covered sites to create the usual set of privacy tools and default settings for minors, prohibit allowing any adult to contact a minor in any way including direct messaging unless they're already "connected", not show any adult a list of who a minor is "connected to", not send notifications to minors between 10pm and 6am year-round and between 8am and 4pm on weekdays during the school year, not use "dark patterns" (again, so vaguely defined that the definition is worthless), track the time all minors spend on the site, and transmit a truly ridiculous amount of data to "independent third party auditors" annually for them to make mandatory public reports opining on a lot of bullshit. (These bills would probably apply to Dreamwidth in their current form, despite them including the same "must be 2% minors" saving throw as Nebraska, because it's written in the opposite way than Nebraska did: you have to have "actual knowledge" that 98% of your users are adults, not that no more than 2% of your users are minors, and that means we'd have to count OpenID accounts as minors for the calculations. If they pass, they would cause us to block access to all connections from New Jersey.) Current legislative session ends 11 January 2028. This is the one the Magic 8 ball rates as most likely to pass out of all of the NJ list.
New Jersey: AB 4013/SB 3412 are companion bills. They require covered sites to time-track usage and proactively monitor all users' (not just minor users') use of the site for "problematic behaviors" (use of the site for more than 3 hours per day cumulative, accessing the site within 10 minutes of waking up, or making more than 10 posts a day, plus anything else the Commissioner of Health determines is "problematic behavior"), display a bullshit state-mandated warning covering 25% of the screen on everyone's (minors' and adults') first login of the day for at least 10 seconds or until the user dismisses it, display a bullshit non-dismissable state-mandated warning for everyone for at least 90 seconds that covers at least 75% of the screen after 3 hours of cumulative daily use and every hour afterwards (unless you have actual knowledge the user is over 17, in which case it can be dismissable, 10 seconds, and 25% of the screen), and if the site detects detect any of the "problematic behavior" on a user's account, inform the user that they've detected "problematic behavior" and provide a list of state-approved resources for Helping You Stop That Problematic Behavior. (I have been desperately trying to avoid making too many snarky asides throughout writing this, but I failed my saving throw on this one: if your bill is repeatedly using language from 2014 Tumblr, maybe you should rethink it.) Oh, and you also have to repeat the state-mandated disclaimer about social media under every ad on the platform. (These bills would apply to Dreamwidth in their current form, and if they pass, they likely would cause us to block access to all connections from New Jersey. Fortunately, this kind of compelled speech is really easily knocked out as unconstitutional. Which is good, because I have no idea how we could possibly tell whether someone had just woken up.) Current legislative session ends 11 January 2028. The Magic 8 Ball says this one is slightly less likely to pass than the above, but I encourage everyone living in New Jersey to obey the finest traditions of my natal state and figure out the most creative ways to insult your representatives about it anyway.
New Jersey: AB 2739 is, on the surface, the least objectionable bill on this list: it prevents covered sites from using "a design, algorithm, practice, affordance, or feature that the platform knows, or which by the exercise of reasonable care should have known, could cause child users to develop an eating disorder, including, but not limited to, promoting diet products", and requires quarterly internal audits and annual external audits to determine whether anything on the site has that potential (and if there are any findings, correct them/stop doing them within 30 days). (It also manages to almost completely invalidate itself by precluding liability for anything the website didn't post itself.) However, it doesn't explicitly say you can rely on self-attestation for determining who's a "child" and who isn't, what little definition there is also covers logged-out users, there's no data anonymization/protection provisions for the third-party annual audits, and there is absolutely no scientific consensus about what causes children to develop eating disorders. (I have consulted so many child psychologists who specialize in treating eating disorders over the last 25 years looking for some guidance on that, and yep, no consensus at all.) This bill would not apply to Dreamwidth in its current form, and the Magic 8 Ball says this one is the least likely to pass; it did pass last session but the governor pocket-vetoed it (although the governor has changed). Might as well include it while you're insulting your representatives, though. Current legislative session ends 11 January 2028.
Oklahoma: SB 1871 requires covered sites to disable logged-out viewing of the site, freeze all accounts belonging to anyone in Oklahoma, conduct mandatory age verification using uploaded state ID, establish the usual package of settings and defaults for anyone under 18, disable all features that "prolong engagement" for people under 18, disable accounts at parental request, allow parents to access minors' settings, and forbid minors from changing any privacy setting without parental consent. This bill would likely apply to Dreamwidth in its current form, and would probably require us to block Oklahoma, but the Magic 8 Ball says it's extremely unlikely to pass so I'm not going to put it on the "would likely block" list. Current legislative session ends 30 May 2026.
Pennsylvania: HB 1430 is a ludicrous katamari of every single moral panic theory about social media and teenagers whose only saving grace is it has been languishing in committee for nearly a year with no sign of movement, indicating at least someone on that committee probably has a glimmer of clue (and also that I get to invoke the "I ain't explaining all that" exemption). Still, I don't have as good a read on the PA legislature as I'd like and the bill is still technically active, so I'm including this out of a modicum of caution even though the Magic 8 Ball says it's probably dead, Jim. Current legislative session ends 30 November 2026.
Rhode Island: SB 2406 requires covered sites to create "data protection impact assessments" and provide them to the Attorney General on demand, plus provide a specific set of privacy tools and configure all defaults for maximum privacy for people under 18. Creates a duty of care for sites to prevent certain harms to people under 18. It explicitly does not mandate age verification (but does include any self-attested age data and any age a site imputes to the user). (This bill would likely apply to Dreamwidth in its current form, and would cause us add Rhode Island to the list of states we don't allow under-18 registration from.) Current legislative session ends 30 June 2026, but the Magic 8 Ball says it's not likely to pass.
South Carolina: HB 4591 duplicates much of the already-enacted HB 3431 with some slightly different provisions, but the legislature is still making floor amendments to it as of 6 March, so including here for completeness. Magic 8 Ball thinks they may be trying to pass something else and repeal the one they're already getting sued over, the way Utah tried a while back, to delay the lawsuit. Current legislative session ends 7 May 2026.
South Carolina: HB 5209 duplicates much of the already-enacted HB 3431 with some slightly different provisions; again, including here for completeness, but the Magic 8 Ball thinks this one's probably dead. Current legislative session ends 7 May 2026.
Not yet introduced
Massachusetts: The Governor has indicated she intends to introduce a more wide-ranging package of legislation than S30/H4229 above, but without much detail as to what it would include, other than definitely mentioning age verification, time restrictions, and parental consent. (We can't tell if it would apply to Dreamwidth or not until we see the text.) Current legislative session ends 31 July 2026.
Sorted by impact to your use of Dreamwidth
If these states' bills pass in their current form without significant changes, we would likely be forced to block under-18 registration the way we currently do for Tennessee and South Carolina:
If these states' bills pass in their current form without significant changes, we would likely be forced to block all connections that geolocate to the state entirely the way we currently do for Mississippi:
We do not currently have enough information about whether these bills would affect Dreamwidth or require us to make any changes:
These bills likely would only affect us if more than 2% of our users submitted a date of birth at account creation making them under 18, which we've never calculated:
Obligatory Disclaimer
I am still not actually a lawyer, no matter how often I've considered going to law school at my advanced age. My interpretation of these laws may not be 100% accurate and my assessment of whether we would be covered by them and the likely actions we'd have to take may change after Actual Lawyer advice (as well as based on whether or not an organization we're a member of chooses to challenge the law in court and whether the court grants a preliminary injunction preventing the enforcement of the law against members). Do not take any statements made within this entry as anything other than my first-pass assessment of which laws would affect us and what actions we would have to take if they pass. It's possible that something listed as "likely wouldn't affect us" actually would, or vice versa. Do not fold, spindle, or mutilate. Cape does not enable wearer to fly. I am still very, very tired and I want legislators to stop trying to break the entire freaking internet already. I also really, really want Legiscan to stop throwing me captchas every half an hour even if I've been slamming them all week while researching.
no subject
Thank you for compiling this list, and good luck dealing with these cases!
Edit: I see that 0,15% of people with public birthdays are younger than 18, so that might give a rough indication of what to expect for the birthdays of all accounts.
no subject
Yeah, I genuinely don't expect that we'd pass the 2% threshold (especially given the existence of OpenID accounts, many of which were created as placeholders by the import system to make sure people could continue to manage their comments after someone imported them: it's a genuine question I can't answer whether the denominator should be "all registered accounts", "all registered personal accounts", "all registered personal + community accounts" etc.) But I have learned to hedge my bets in predicting the future with things like these, because my Magic 8 Ball sometimes goes on the fritz!
no subject
That's certainly wise, especially given how vague some of the other laws are!
(By the way, the percentage of under-18s seems a bit low to me; I suppose they feel less like making their birthdays public, or maybe Dreamwidth's uncool for young people? Also, I didn't know that communities could have birthdays, too; do you have any idea how common that is?)
no subject
no subject
My brain has tried so hard to save me from this list that today I actually changed my sheets and swept the bedroom floor to avoid working on it for another hour or two.
(If it had gotten really dire I might have been forced to fold my laundry, even.)
no subject
Because I don't live in the US, I feel like calling my congresscritters isn't helpful; they/their staffers are just going to look at my foreign phone number and dismiss me. I donate to the EFF and the Free Speech Coalition, but if there are other places you'd recommend, I'd be glad to hear about them. Thanks so much for all this work!
no subject
I thought support for censorship would become something quaint, like… owning an 8-track player, or smoking a pipe. I thought it would be politically unthinkable by our current decade.
I thought to myself, ‘I can’t speak my mind now, but once I’m an adult I’ll be able to speak freely.’
Instead, we got this. Fundamentalists aren’t just dusty, laughable ideologues any more; they’re everywhere. I can’t even meaningfully vote against them because there aren’t any other viable parties. My disappointment is immeasurable.
Thank you for your efforts to protect our freedom.
I opened this page within ten minutes of waking up. How ‘problematic’.
no subject
Wrote a cranky email to my state rep! Thank you, I did not know about the bill in my state and appreciate the heads-up.