Law / United States / 
Oklahoma
SB 1959, age verification for material harmful to minors
Okla. Stat. tit. 15, sections 791 to 791.4 (2024 Senate Bill 1959)
In force since .
An adult content age verification (AV) rule binding private bodies.
- Audit expectation
- none
What it requires
- Applies to a commercial entity that knowingly publishes or distributes material harmful to minors where more than a third of the site's content meets that definition.
- Perform reasonable age verification to confirm a visitor is 18 or older, using a digitized identification card, an independent third party verification service checking commercial databases, or a commercially reasonable method relying on transactional data; without it you are civilly liable to a minor's parent or guardian.no control in the NIST Privacy Framework
- Let internet and cellular subscribers request that access to your site be blocked.no control in the NIST Privacy Framework
- Do not retain a user's identifying information after access is granted.NIST Privacy FrameworkCT.DM-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- CT.DM-P5Data are destroyed according to policy.
- NIST CSF 2.0
- ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureNo
Private right of actionYes
Penalties
Injunctions sought by the Attorney General, plus civil damages, nominal damages, court costs, and attorney fees recoverable by an affected minor's parent or guardian
Statutory damages
No liquidated per-person amount is stated. A commercial entity that publishes or distributes obscene material or child sexual exploitation material, or that fails to verify age, honor a blocking request, or stop retaining identifying information, may be held liable to an affected individual, or to a minor by and through the minor's parent or legal guardian, for nominal damages, actual damages, court costs, and reasonable attorney fees, plus punitive damages where the generally applicable standard for punitive damages is met (15 Okla. Stat. secs. 791.1(A)-(B), 791.2(C)-(E), 791.2(I)). Individual claims meeting the generally applicable standards for joinder or class action may be combined in a single action (15 Okla. Stat. secs. 791.1(C), 791.2(F)).
- As of
- Class action available
- Yes
Who enforces it
Enforcement body
Oklahoma Attorney General
Settledness
- As of
- Open questions
- Does any method that "relies on public or private transactional data" qualify as "commercially reasonable" under Okla. Stat. tit. 15, section 791(12)(c), or must the method also be reasonable for the commercial entity's site and audience?
- How is "more than a third of the total material available on the website" in Okla. Stat. tit. 15, section 791(13) measured, by number of items, running time or page views, for a site that mixes material harmful to minors with other content?
What it reaches
Age threshold
18
Covered services
Commercial websites where more than one third of the content is material harmful to minors
Obligation class
Age verification, Retention
Verification methods
Digital ID, Third party service, Transactional data
Applicability criteria
- As of
- Combinator
- All of
- Criteria
- "Substantial portion" means when more than a third of the total material available on the website meets the definition of material harmful to minors as defined in this section.
What it makes you log
What the log must hold
Consent or opt-out state
Log retention
- As of
- Basis
- Purpose bound
- Prohibits retaining
- Any identifying information of the individual, held by the commercial entity or by a third party that performs the age verification, after access has been granted, except as reasonably necessary to carry out a block request
Logging duty
A commercial entity must block access on a subscriber's request and is liable if it later lets a minor in, which cannot be done without keeping the block request, and the act allows keeping identifying information where reasonably necessary to carry out a block request. It names no log of the age check itself, and section 791.2(H) bars keeping identifying information once access is granted.
- Kind
- Implicit
- As of
- Provision
- Okla. Stat. tit. 15, section 791.2(B), (D) and (I)
- Trigger
- age_assurance
- consent_or_optout
What this law does
Makes a commercial entity that knowingly publishes or distributes material harmful to minors, where more than a third of the site's content meets that definition, civilly liable to a minor's parent or guardian unless it performs reasonable age verification to confirm a visitor is 18 or older, defined as a digitized identification card, an independent third party verification service checking commercial databases, or a commercially reasonable method relying on transactional data.
It also requires the entity to let internet and cellular subscribers request that access to the site be blocked, and bars retaining a user's identifying information after access is granted.
When LexLint raises it
When your app profile says your app publishes adult content.
Back to the example · Lint your app
Page updated .