The laws, and links to the actual text

Governs any site or service directed to children under 13. The amended Rule took effect 23 June 2025 and full compliance has been required since 22 April 2026. Personal information now expressly includes biometric identifiers, and operators owe a written information-security policy and data-retention limits.

Makes it a federal crime to publish sexually explicit images of a person without consent — AI-generated images count exactly the same as real photographs. Sharing or threatening to share intimate images of a minor carries fines and up to three years. Since 19 May 2026 covered platforms must run a notice-and-removal process and take content down within 48 hours of a valid notice.

Requires electronic service providers to report apparent child sexual abuse material to NCMEC's CyberTipline. It is why platform reports exist at all, and why a CyberTipline report is the right first channel for online exploitation.

Would have required age verification and parental consent for minors' social media accounts. A federal court declared it unconstitutional and permanently enjoined it on 31 March 2025. It is still widely cited as if it applied. It does not.

Arkansas's amended and expanded replacements for Act 689. Act 901 was preliminarily enjoined on 15 December 2025 and Act 900 on 20 April 2026, the day before it was to take effect. Both are on appeal. Do not build any program that assumes state age-verification law will do the work for you.