The year age verification laws came for the open internet

A rapid wave of age‑verification laws—about 25 U.S. states in the past two years and 16 states imposing social‑media age controls, alongside recent Supreme Court backing of a Texas statute and upcoming app‑store rules in Utah, Texas and Louisiana (California in 2027)—is fragmenting the open internet by forcing costly identity checks that smaller platforms cannot absorb. The mandates have prompted market exits and access blocks (Dreamwidth and Bluesky withdrawing from Mississippi; Pornhub blocked in 23 states) and raised acute privacy and security risks as services demand government IDs or face scans, with incidents such as Discord’s reported ~70,000 potentially exposed IDs and prior third‑party leaks involving major apps underscoring vulnerability. The measures are also driving circumvention—ProtonVPN saw a 1,400% sign‑up surge in the UK after its Online Safety Act took effect—and are prompting discussions of VPN restrictions, signaling growing regulatory tradeoffs between child‑protection goals and broader consequences for anonymity, free expression, platform economics and data security.

Analysis

A rapid and broad wave of age-verification laws is fragmenting the open internet in the U.S. and abroad: roughly 25 U.S. states have passed adult-content age checks in the past two years, 16 states require social-media age controls, the Supreme Court recently upheld a Texas statute mandating age checks for adult sites, and Utah, Texas and Louisiana will require app stores to verify ages next year (California in 2027). Smaller platforms are already exiting regulated markets—Dreamwidth and Bluesky withdrew from Mississippi—and Pornhub has blocked access in 23 states, illustrating real commercial disruption and enforcement risk.

Mandates force platforms to collect government IDs or use AI face-scans, raising acute security and privacy exposure: Discord reported ~70,000 potentially exposed IDs from a third-party incident, a separate identity vendor leak affected drivers’ licenses used by TikTok and Uber, and the EFF warns face-scans can be repurposed to infer identities. Circumvention is already material—ProtonVPN reported a 1,400% surge in UK sign-ups after the Online Safety Act—and regulators are even discussing VPN restrictions, increasing legal uncertainty.

For listed platforms cited in the article, the policy mix implies rising compliance costs and user-friction risk: Spotify requires age checks for certain music videos and messaging in the UK, Uber’s association with an identity-provider leak highlights vendor-risk, and Reddit communities have been blocked under UK rules, suggesting engagement and moderation costs. Ongoing court challenges (six state measures in limbo) and inconsistent state/federal trajectories make near-term outcomes binary and event-driven, favoring large incumbents able to absorb verification costs while heightening downside for smaller operators.

Key Decisions for Investors

• Re-weight portfolios modestly toward large-cap platforms with scale and diversified revenue that can absorb verification and compliance costs, while reducing allocation to smaller niche social or hosting services exposed to market exit risk
• Monitor SPOT for changes in user-engagement metrics and disclosure of incremental compliance costs tied to age-verification requirements for music videos and messaging, and consider tactical hedges if guidance implies material churn
• Audit UBER exposure to third-party identity vendors and prioritize names that disclose robust vendor-management and breach remediation controls; consider event-driven protection if additional vendor incidents emerge
• Track legal developments and enforcement signals (Supreme Court precedents, the six measures in limbo, Ofcom statements, and state-level app-store rules) as primary catalysts that could rapidly widen or narrow market impacts