Law / United States / 
Georgia
SB 351 (2024), commercial entity age verification for material harmful to minors
In force since .
An adult content age verification (AV) rule binding private bodies.
- Audit expectation
- none
What it requires
- Applies to a commercial entity that knowingly publishes a substantial portion (more than 33.33 percent) of material harmful to minors on a public website.
- Perform reasonable age verification before granting access, using a digitized identification card, government issued identification, or a method meeting the National Institute of Standards and Technology (NIST) Identity Assurance Level 2 standard.no control in the NIST Privacy Framework
- Do not retain identifying information after access is granted.NIST Privacy FrameworkCT.DM-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.DM-P5Data are destroyed according to policy.
- NIST CSF 2.0
- ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalties
Fine up to $10,000 per violation, plus damages, court costs, and attorney fees for a minor's access or for knowingly retained identifying information.
Penalty structure
Civil fine of up to $10,000 per violation, amount determined by the superior court, imposed only via proceedings the Attorney General, solicitor general, or district attorney having jurisdiction institutes within one year of the violation; the fine does not preclude a private right of action.
- Rule
- Per violation only
- As of
- Currency
- USD
- Per violation unit
- Violation
- Per violation amount
- 10,000
Who enforces it
Enforcement body
Georgia Attorney General, solicitors general, and district attorneys
Settledness
- As of
- Open questions
- How is "more than 33.33 percent of total material on a public website" in O.C.G.A. Section 39-5-5(a)(9) measured, by number of items, running time or page views, for a site that mixes material harmful to minors with other content?
- Is the 33.33 percent test in O.C.G.A. Section 39-5-5(a)(9) applied to a public website as a whole or to each section or subdomain of it?
What it reaches
Age threshold
18
Obligation class
Age verification, Retention
Verification methods
Gov ID, Digital ID, Third party service
Applicability criteria
Subsection (b) attaches the age verification duty to a public website that contains a substantial portion of material harmful to minors, a term subsection (a)(9) defines by this share.
- As of
- Combinator
- All of
- Criteria
- knowingly and intentionally publishes or distributes material harmful to minors on a public website on which more than 33.33 percent of total material meets the definition of material that is harmful to minors
What it makes you log
Log retention
A commercial entity found to have knowingly retained it is liable to the individual for damages, court costs and reasonable attorney's fees.
- As of
- Basis
- Fixed
- Prohibits retaining
- Identifying information of the individual, which the commercial entity may not retain after access to the material has been granted
Logging duty
Code Section 39-5-5(b) requires a commercial entity to use a reasonable age verification method before allowing access to a public website with a substantial portion of material harmful to minors. It does not require a log or record of the check, and it names no audit. Subsection (d) instead forbids keeping identifying information after access is granted.
- Kind
- None
- As of
What this law does
Requires a commercial entity that knowingly publishes a substantial portion of material harmful to minors on a public website, as the applicability criteria define it, to perform reasonable age verification before granting access, using a digitized identification card, government issued identification, or a method meeting the National Institute of Standards and Technology (NIST) Identity Assurance Level 2 standard, with a bar on retaining identifying information after access is granted. Not challenged in NetChoice v. Carr, which covers only the act's social media provisions.
When LexLint raises it
When your app profile says your app publishes adult content.
Back to the example · Lint your app
Page updated .