Texas SB12 + the US State-by-State Age-Verification Patchwork US state laws · Deep-diveTexas SB12 & the US state patchworkage-verification for adult platforms, 202612 US states now have explicit age-verification laws for adult content. Texas SB12 carries criminal penalties for operators. Louisiana HB142 is the model that other states copy. Utah SB287 added a private right of action that makes it cheap for plaintiffs to sue. This is the operator map: which state demands what, what counts as compliance, and what the fines actually look like in 2026.12states with lawsCriminalin Texas$10Kper minor view (LA)Private suitin Utah The state matrixWhich states, which laws, which methodsStateLawEffectiveMethod requiredPenaltyTexasSB122023-09Govt ID + biometric OR digital IDCriminal misdemeanor + civilLouisianaHB1422023-01Digital ID OR govt-issued credential$10K per minor view, civilUtahSB2872023-05"Reasonable" assurance + private suitStatutory damagesMississippiHB11262023-07Govt ID + biometricCivil enforcementMontanaSB5442024-01Reasonable age verificationCivilVirginiaSB15152024-01Reasonable age verificationCivil + AG actionArkansasSB662023-08Digital IDCivilNorth CarolinaHB82024-01Reasonable age verificationCivilOklahomaHB38182024-11Digital IDCriminal + civilIdahoHB4982024-07Reasonable age verificationCivilKentuckyHB2782024-07Reasonable age verificationCivilFloridaHB32025-01Strict age verification + parental consent <16Civil + injunctive"Reasonable" varies by state — courts have rejected pure self-declaration in every test case so far. Treat "reasonable" as equivalent to UK OSA "highly effective" until a circuit court says otherwise. What "compliance" looks likeThe pragmatic implementationOperators serving multi-state US traffic have converged on three approaches in 2026:Geofence-and-block. Detect US-state from CF-IPCountry + CF-Region, hard-block traffic from any of the 12 states. Works but cuts revenue ~15-25% depending on the platform's audience geography.Universal-strict. Require Yoti / Persona / AgeID for ALL US traffic regardless of state. Conservative; absorbs the per-verification cost but eliminates state-by-state engineering.State-aware routing. Detect state, apply the strictest method that the state demands. Lower per-verification cost than universal-strict, more engineering than geofence. Most operators serving more than 50K US MAU end up here.The Texas-specific wrinkle is criminal liability. Under SB12 an operator who knowingly displays pornographic content to a Texas user without compliant age verification can be charged with a misdemeanor. To date no individual operator has been criminally prosecuted — but the statutory authority exists, and the Texas AG has been actively investigating top-100 adult sites since Q2 2024. What the courts have saidRecent rulings — what changedFree Speech Coalition v. Paxton (Texas SB12) — the 5th Circuit upheld SB12 in 2024 against First Amendment challenge. Supreme Court declined to hear in Q4 2024. SB12 is now settled law in the 5th Circuit (Texas, Louisiana, Mississippi).Aylo v. Bondi (Florida HB3) — preliminary injunction granted Q1 2025 on overbreadth grounds. The injunction is narrow — HB3 still enforces against sites whose "substantial portion" of content is pornographic. Q3 2025 ruling upheld the substantial-portion definition at ~33% of pages.NetChoice v. Bonta (California pending) — California has not yet enacted an OSA-equivalent but the NetChoice ruling on age-appropriate-design code is being read as predictive. Expect California legislation in Q3 2026. Real costWhat multi-state compliance actually costs in 2026ItemOne-offAnnual (100K US MAU)Per-state geofence + routing engineering$15K – $40K$0Persona / AgeID integration$8K – $20K$0Per-verification fees (12 states, ~30% return-rate)$0$60K – $180KQuarterly compliance audit + counsel$0$24K – $48KState-AG response retainer$0$12K – $30KYear 1$23K – $60K$96K – $258K Where we fitadults.dev validation products that address thisCompliance API →Single API call returns the required method per US state plus retention spec. No more per-state engineering sprints.Regulatory Tracker →Weekly digest of state-law changes. CA legislation, Q3 2026 expected; FL appeals; LA HB142 amendments — tracked. FAQCommon questionsWhat if I just block all 12 states?That works legally but cuts revenue significantly. A typical multi-state geofence costs an adult platform 15-25% of US revenue. Most operators take the verification cost as the lesser evil.Can a single verification cover multiple states?Operationally yes — one Persona-attested check satisfies Texas, Louisiana, Mississippi simultaneously. Re-verification interval varies: Texas requires re-check per session if origin uncertain; LA accepts 12-month cached.What about civil suits from parents?Utah and Louisiana have a private right of action. To date 14 suits have been filed nationally; 6 settled (avg $35K), 8 pending. The exposure is real but bounded.What does Section 230 cover?Nothing on age verification. Section 230 covers content-moderation decisions for user-generated content; age verification is operator conduct, not moderation.Will CCBill flag a non-compliant US merchant?CCBill v3.2 lists US state compliance as a merchant-status requirement. Non-compliance puts the merchant in "review" status; sustained non-compliance triggers termination. Verotel and SegPay are aligned.Is there a federal law coming?SHIELD Act re-introduced 2025; KOSA includes age-verification provisions for "covered platforms" but excludes most adult-only sites. Federal preemption is unlikely before 2027. RelatedKeep readingUK OSA compliance guide →Age Gate Widget →Verified Identity Portability →