Utah, Arkansas and California social media age check laws and what parents may need to show

What to take away

Why states moved to age verification, and what the laws try to do

State lawmakers started writing age-verification bills because parents and attorneys general said platforms were not enforcing their own minimum ages. The FTC's COPPA Rule only covers children under 13, so 13-to-17-year-olds fell into a gap. States filled it.

The laws target three things: knowing who is a minor, getting a parent's permission, and changing how platforms treat minors by default. Utah, Arkansas and California each picked a different tool.

Utah's approach is the strictest on paper. Arkansas copied parts of it. California went after design instead of identity. That split is why a family in Salt Lake City faces a different sign-up screen than a family in San Jose.

State attorneys general drove much of this. They run online safety task forces and can sue platforms under consumer protection statutes. The same offices that oversee elections and consumer complaints now handle social media cases.

You can see how state officials fit into public life through Voting and elections | USAGov, which explains the offices and how they are chosen.

Federal rulemaking is moving in parallel. The FTC has proposed amendments to COPPA that would extend some protections to teens, which you can track on the agency's Rulemaking | Federal Trade Commission page. Notices about platform rules also appear under Federal Register :: Science & Technology.

For a wider view of how these statutes fit together, our guide to teen social media use laws walks through the 2027 picture. The short version: age checks are spreading, but their scope and enforcement vary sharply by state.

Utah's age-verification and parental consent requirements in practice

Utah passed the first comprehensive social media law for minors in 2023, then amended it in 2024 before it took effect. The amended version, the Utah Social Media Regulation Act, requires platforms to verify the age of Utah account holders and to obtain parental consent for any user under 18.

In practice, a Utah teen signing up for a covered platform must go through an age check. If the platform identifies the user as a minor, it must get verifiable parental consent before the account is activated. Covered platforms also face limits on features that keep minors scrolling, and they must give parents access to their child's account settings.

Utah's law applies to platforms that meet thresholds for revenue and user numbers, so not every app is covered. It also includes a private right of action, meaning parents can sue a platform for violations. That is unusual among state social media laws and is the main reason platforms have taken it seriously.

The consent requirement is the part parents feel. A parent or guardian must confirm they are the adult responsible for the minor. Platforms can use several methods, including a signed form, a government ID, or a payment card. The law does not require a specific vendor, so each platform chooses.

Utah's Division of Consumer Protection enforces the law alongside the attorney general. Complaints can be filed with the division if a platform skips the age check or activates an account without consent.

One caveat: the law has been challenged in court, and its enforcement timeline has shifted. Parents should check the current status before relying on it. Our explainer on age-by-age guidance laws covers how these thresholds work in practice.

Arkansas and the consent rules that followed court challenges

Arkansas passed the Social Media Safety Act in 2023. It required covered platforms to verify the age of all users and to obtain parental consent for any user under 18. It also required platforms to contract with a third-party age verification vendor.

A federal judge blocked the law in August 2023, days before it was to take effect. The court found that the law likely violated the First Amendment because it burdened minors' access to speech and forced platforms to verify all users. The state appealed.

The case, NetChoice v. Griffin, is still working through the courts. As of 2026, the law is not being enforced. That means Arkansas parents do not currently need to supply documents, but the requirement could return if the appeal succeeds.

Arkansas's law would have applied to platforms that meet user and revenue thresholds, and it would have covered a broad set of services, including some that are not primarily social media. That breadth was one reason the court was skeptical.

The Arkansas attorney general's office has continued to pursue online safety cases under other statutes, including consumer protection law. So even without the Social Media Safety Act, platforms operating in Arkansas face scrutiny.

For families, the practical effect is uncertainty. A platform may still ask for age information voluntarily, and some do. But there is no state mandate to comply with while the law is blocked.

California's approach: default settings and design duties rather than ID checks

California took a different route. The California Age-Appropriate Design Code Act, signed in 2022, does not require age verification or parental consent. Instead, it requires covered businesses to configure default privacy settings for minors and to assess how their designs affect children.

The law applies to online services likely to be accessed by children under 18. Covered businesses must estimate the age of child users, but the law explicitly says they cannot use age estimation to collect more data than necessary. It also requires high default privacy settings and limits on features that encourage minors to share location or personal details.

The design code also requires data protection impact assessments before launching new features. Those assessments must identify risks to minors and outline how the business will mitigate them.

A federal court blocked parts of the law in 2024 on First Amendment grounds, and the state has been litigating the scope since. Some provisions remain in effect or are being enforced in modified form. Parents should treat the law as a design standard, not a sign-up gate.

California's attorney general can bring enforcement actions under the law and under the state's Unfair Competition Law. The state also has a separate online safety law for platforms that offer features like friend recommendations to minors, which imposes additional design duties.

For parents, California's rules matter because they shape what your teen sees by default: who can message them, whether their profile is public, and how much data the platform collects. That is different from proving who they are. Our teen social media use guide explains how to set up those defaults in the first ninety days.

What documents and steps each state asks of families

This is where the laws stop being abstract. If your state requires age verification or parental consent, you will be asked to prove two things: your teen's age and your relationship to them.

Utah allows platforms to choose from several verification methods. In practice, families are asked for one of the following:

Arkansas's blocked law would have required a third-party vendor to verify age, with a similar document list. Because it is not enforced, no document is currently mandatory. If the appeal succeeds, expect a vendor-mediated process rather than direct uploads to the platform.

California does not ask families for documents. The law puts the duty on the business to estimate age and apply defaults. A California parent will not be asked for ID to create an account, but they may see a default private profile and restricted messaging.

Here is what each state asks, in one view:

If you are asked for documents, use the smallest set the platform accepts. A signed form is usually enough in Utah. A payment card is faster but ties the account to your billing details. A government ID upload carries the most risk if the platform's storage is breached.

Keep a copy of anything you send. If a platform later claims you did not consent, you will want a record. Under Utah's private right of action, that record matters.

Where federal COPPA ends and state age checks begin

The Children's Online Privacy Protection Act, or COPPA, is the federal floor. It requires operators of websites and online services directed to children under 13 to get verifiable parental consent before collecting personal information.

The FTC enforces it, and the full rule text is on the agency's Children's Online Privacy Protection Rule ("COPPA") | Federal Trade Commission page.

COPPA stops at 13. That is the gap state laws try to fill. Utah and Arkansas extend consent to 18. California extends design duties to 18. None of them replace COPPA; they stack on top.

This matters for parents because a platform may already have COPPA-compliant consent for your 12-year-old, then ask for a second, state-specific consent when your child turns 13. The two processes can look similar but serve different laws.

The FTC has been revising COPPA to address teen data. Proposed amendments would expand some obligations to users under 18 and tighten rules on targeted advertising. You can follow the process on the FTC's rulemaking page and in the Federal Register's business and industry notices at Federal Register :: Business & Industry.

Other federal laws touch the same territory. FERPA covers school records. The FBI's IC3 takes reports of online exploitation, and NCMEC's CyberTipline handles child sexual abuse material reports. StopBullying.gov, run by the Department of Health and Human Services, covers harassment. None of these require age checks, but they are the reporting routes when something goes wrong.

State attorneys general often coordinate with these federal bodies. If a platform ignores a state age-check law, the attorney general can act. If the conduct also violates COPPA, the FTC can act. Parents can report to either.

A teen safety comparison table of state requirements

The table below compares the three states covered here on the dimensions parents ask about most. It reflects the law as written and its current enforcement status as of 2026.

Utah is the only state in this group where a parent is likely to be asked for documents today. Arkansas is paused. California changes the product, not the sign-up.

That pattern is likely to hold as more states pass laws. Age checks are expensive and legally risky. Design rules are cheaper and survive court review more often. Expect a mix.

For a sense of how these rules interact with content standards, see our piece on pipeda teen social media parent rights, which covers advertising rules that affect teens but not account creation.

If your teen is in a state with an age-check law, the practical question is what happens when a platform asks. The next section covers that.

What to do when a platform asks your teen for proof of age

If a platform asks for proof of age, you have options. The steps below work in Utah and in any state that adopts a similar law. They also apply when a platform asks voluntarily.

If the platform refuses to accept a reasonable method, or if it activates an account without consent, you can complain. In Utah, file with the Division of Consumer Protection. In any state, the attorney general's consumer protection office takes complaints. The FTC takes COPPA complaints for under-13 issues.

One more step: review the platform's privacy policy for how it stores verification data. Some platforms delete it after checking. Others keep it. Ask, and if the answer is unclear, choose a different verification method.

Common questions