Minors

Children’s privacy regulations globally are shifting away from notice-and-consent models toward outright access restrictions, age-appropriate design mandates, categorical advertising prohibitions, and app-store-level age verification, as illustrated by Australia’s December 2025 enforcement of its under-16 social media ban. In the United States, similar legislative efforts have faced significant First Amendment challenges that have stalled most state laws restricting minor access to social media and AI platforms, while age-appropriate design requirements inspired by California’s law have been enacted in several states. Several states, including Oregon, have enacted categorical bans on targeted advertising to known minors, while app-store-level age verification laws imposing age-signal obligations on app developers are also subject to active litigation. Companies operating consumer-facing digital services should map where minors interact with their products, review advertising practices involving teens, and prepare for the eventual downstream effects of age-signal regimes.

South Carolina’s new Age-Appropriate Design Code Act is shaping up to be one of the most demanding privacy laws in the country for companies whose products can be reached by people under 18. It pairs prescriptive “privacy by design” requirements, meaning child-safety and data-minimization choices have to be built into the product itself rather than bolted on later, with limits on targeted advertising to minors. It also requires parental tools that let a parent manage a minor’s account settings, restrict purchases, see time spent, and set time limits.

Two features stand out for small teams. First, covered services must obtain an annual review by an independent outside auditor and file that report with the South Carolina Attorney General, and those reports are posted publicly. Second, penalties are unusually aggressive and can reach individual officers and employees personally where violations are willful and wanton.

In June 2025, the U.S. Supreme Court upheld a Texas law requiring websites where more than one-third of content is sexually explicit to verify users’ ages before granting access. The critical legal question was which First Amendment standard to apply. The Court chose the more lenient intermediate scrutiny rather than the strict scrutiny used to strike down similar federal laws in the early 2000s, reasoning that the law targets distribution of obscene content to minors and only incidentally burdens adults’ access to protected speech. The three-justice dissent argued strict scrutiny should apply and warned of a chilling effect on lawful speech. The ruling’s reach extends beyond traditional adult content sites to any platform (including social media) if one-third or more of the platform’s content could be deemed harmful to minors. With nearly half of U.S. states having already enacted similar laws, the decision is expected to accelerate that legislative trend. Privacy advocates have separately warned that mandatory age verification forces users to submit sensitive personal identification, raising data breach risks and potentially threatening the First Amendment right to browse the internet anonymously.

Texas has rapidly emerged as one of the nation’s most aggressive data privacy regulators, surpassing California and New York in the breadth and enforcement intensity of its privacy regime. Over the past two years, the state has enacted a comprehensive suite of laws covering consumer and children’s data privacy, artificial intelligence, and data brokers, and its attorney general has secured multi-billion-dollar settlements against major technology companies for alleged violations. While the federal government and many other states have taken a lighter touch on privacy and AI regulation, Texas is leading the charge with active enforcement that companies operating in the state or collecting data from Texas residents cannot afford to ignore.