Law / United States / 
Tennessee
Protect Tennessee Minors Act (SB 1792/HB 1614, 2024 Tenn. Pub. Acts ch. 1021)
Tenn. Code Ann. section 39-17-912
In force since , under challenge in court.
An adult content age verification (AV) rule binding private bodies.
- Audit expectation
- none
- Court action
A suit challenging this law is pending. No court has blocked it. Premium data
What it requires
- Applies to an individual or commercial entity that publishes or distributes a website on which one third or more of total content is content harmful to minors.
- Perform reasonable age verification, confirming the user is 18 or older, before granting access.no control in the NIST Privacy Framework
- Re-verify after each age-verified session of at most 60 minutes.no control in the NIST Privacy Framework
- Retain seven years of anonymized age verification data.NIST Privacy FrameworkCT.DM-P8
- Do not retain personally identifying information.NIST Privacy FrameworkCT.DM-P5
These lines are LexLint's reading of the law's text.
In the frameworks
- NIST Privacy Framework
- NIST CSF 2.0
- ID.AM-08Systems, hardware, software, services, and data are managed throughout their life cycles
- FINOS AIGF
- AIR-DET-004AI System Observability
- AIR-DET-021Agent Decision Audit and Explainability
Our reading of where this law's duties sit in each framework, and in the NIST Privacy Framework, line by line beside each duty above. It never says that running a control meets the law. How we read a framework against the law
If you get it wrong
Criminal exposureYes
Private right of actionYes
Criminal exposure note
A violation of the age-verification duty (failing to verify, or re-verify after a 60-minute age-verified session, an active user's age) or the retention duty (failing to retain seven years of anonymized age-verification data, or retaining personally identifying information after access has been granted) is a Class C felony, Tennessee's general felony classification carrying three to fifteen years imprisonment and a fine of up to $10,000 under Tenn. Code Ann. sec. 40-35-111.
Penalties
Class C felony for a violation of the age verification or data retention requirements; civil damages liability to individuals harmed.
Who enforces it
Enforcement body
Tennessee Attorney General and Reporter, who may bring any appropriate action or proceeding against a noncompliant commercial entity; the age-verification duty and the data-retention duty are each also a Class C felony, and an individual may separately sue for damages caused by a minor's access to the material or by unlawful retention of identifying information.
Litigation
- Court
- U.S. District Court for the Western District of Tennessee
- Docket
- Free Speech Coalition, Inc. v. Skrmetti, No. 2:24-cv-02933 (W.D. Tenn.); appeal No. 24-6158 (6th Cir.)
- Posture
- Preliminarily enjoined on , before the law took effect. The Sixth Circuit stayed that injunction on , allowing enforcement to proceed, and on vacated the injunction and remanded for proceedings consistent with the Supreme Court's June 2025 decision in Free Speech Coalition v. Paxton. The plaintiffs amended their complaint on to challenge the Act as amended in 2025, and on the district court denied the Attorney General's motion to dismiss. The law is enforceable as of this date.
Settledness
Free Speech Coalition, Inc. v. Skrmetti, No. 2:24-cv-02933 (W.D. Tenn.), challenges the Act as amended in 2025: on the district court denied the Attorney General's motion to dismiss the amended complaint, after the Sixth Circuit vacated the earlier preliminary injunction on .
- As of
- Under challenge
- Yes
- Open questions
- Is the 'total amount of data available on a website' against which Section 39-17-912(b)(13) measures the thirty-three and one-third percent threshold counted by bytes, files or pages, and does it include the 'infrastructure, code, and other technological assets' that Section 39-17-912(b)(15) counts as part of a website?
- What makes a reasonable age-verification method 'easily bypassed or circumvented' under Section 39-17-912(b)(11): does a method that a minor can defeat with a virtual private network or another person's identification fall short?
What it reaches
Age threshold
18
Covered services
Websites where thirty-three and one-third percent or more of the total data is content harmful to minors.
How the hook was established
express
What makes it apply
Market targeting
Obligation class
Age verification, Retention
Verification methods
Gov ID, Transactional data
Applicability criteria
- As of
- Combinator
- All of
- Criteria
- "Substantial portion" means thirty-three and one-third percent (33 1/3%) or more of the total amount of data available on a website
What it makes you log
What the log must hold
Age assurance result, System identity
Log retention
The seven-year floor applies to anonymized age-verification data only; the statute sets no maximum for it.
- Unit
- Years
- As of
- Basis
- Fixed
- Minimum value
- 7
- Prohibits retaining
- Any personally identifying information of the active user, once access to the content harmful to minors has been granted
Logging duty
A website owner, commercial entity or third party that executes a required age-verification method must retain at least seven years of historical anonymized age-verification data, defined as data sufficient to prove the method was used to verify an active user as 18 or older, kept apart from personally identifying information, and including architectural diagrams of the technology and data showing a volume of verification executions consistent with overall visits. Subdivision (d)(2) bars retaining the active user's personally identifying information after access is granted. A violation of subsection (d) is a Class C felony under (i).
- Kind
- Explicit
- As of
- Provision
- Tenn. Code Ann. section 39-17-912(d)(1) (2024 Tenn. Pub. Acts ch. 1021, section 1(d)(1))
- Trigger
- age_assurance
What this law does
Requires an individual or commercial entity that publishes or distributes a website on which one third or more of total content is content harmful to minors to perform reasonable age verification before granting access, and to re-verify after each age-verified session of at most 60 minutes. Verifiers must retain seven years of anonymized age verification data and may not retain personally identifying information. A violation is a Class C felony.
When LexLint raises it
When your app profile says your app publishes adult content.
Back to the example · Lint your app
Page updated .