Bluesky’s Mississippi Exit Highlights Cost of Age Verification

Social media platform Bluesky’s decision to cease operations in Mississippi rather than comply with a state social media law highlights the burden that age verification rules puts on smaller, less-resourced tech companies.

“Unlike tech giants with vast resources, we’re a small team focused on building decentralized social technology that puts users in control,” Bluesky wrote in a blog post last week. “Age verification systems require substantial infrastructure and developer time investments, complex privacy protections, and ongoing compliance monitoring—costs that can easily overwhelm smaller providers.”

Without further clarification, attorneys say, the Mississippi law is set to pull in a wide range of companies outside of typical social media platforms, forcing them into costly new compliance frameworks. Moreover, it’s unclear which age verification technologies will allow companies to avoid enforcement.

Bluesky, a much smaller competitor to X Corp., formerly Twitter Inc., isn’t alone. In response to the law, online journal Dreamwidth said it would temporarily block access from all IP addresses that geolocate to Mississippi starting Sept. 1. Nextdoor banned individuals in Mississippi under the age of 18 from creating accounts as of Aug. 15.

“We are disappointed that Mississippi’s new age assurance law has taken effect in its current form, as it imposes burdensome requirements that create unnecessary barriers for legitimate users of all ages to access our service—a service grounded in building stronger local communities,” Sophia Contreras Schwartz, chief legal officer at Nextdoor Holdings Inc. wrote in an email.

Both companies are members of tech lobby NetChoice, which has sued to block the law.

The Mississippi law (HB 1126), introduced after a 16-year-old killed himself in the wake of an online sexual extortion attempt, requires social media platforms to receive parental permission before allowing anyone younger than 18 to access their services, and to make “reasonable efforts” to verify users’ ages. Failure to comply risks fines of up to $10,000 per user.

The US Supreme Court this month denied a request from tech trade group NetChoice to block Mississippi from enforcing the law while the lobby group’s lower court challenge plays out.

“Smaller companies are particularly vulnerable, and it puts them in between a rock and a hard place trying to navigate this unconstitutional law,” said Paul Taske, co-director of the NetChoice Litigation Center.

Mississippi’s law is the first of the growing crop of state laws requiring age verification for social media to actually be enforced. The others are currently enjoined by the courts or not yet in effect.

Bluesky declined to comment.

Broad Reach

The broad definitions of the law raise the possibility that companies that don’t consider themselves social media could still be ensnared, said Megan Stokes, state policy director of the Computer & Communications Industry Association, whose members include Alphabet Inc.‘s Google and Meta Platforms Inc.

Complying will raise costs by forcing companies to create new privacy frameworks and new content moderation, Stokes added. Companies might also need to deploy third-party age verification services.

Engine, a nonprofit policy group focused on startup growth, estimated in a paper last year that even for a small startup implementing age verification technology would cost at least $500,000 dollars.

Even if small and medium-sized firms turn to third-party vendors rather than building in-house, adoption and integration present a host of compliance demands, said Sam Castic, partner at Hintze Law. And because many age verification services require sensitive data, such as biometrics, companies will have to make sure the data collection is in compliance with other state laws around sensitive information.

Complicating things, states have so far offered little guidance on which third-party vendors actually meet age assurance requirements. The law requires companies to use a “commercially reasonable” effort.

“There’s certainly room for interpretation,” said Adam Griffin, shareholder at Polsinelli PC. “What the attorney general and others think is commercially reasonable may be different than what companies think is commercially reasonable. And that’s a risk.”

Absent more guidance, companies will have to “look to enforcement actions and read the clues,” Castic said, noting that not all states might accept the same technology.

Technological Fix?

Bluesky’s departure from Mississippi comes as Big Tech is racing to roll out new age-assurance technologies. Google in July introduced age estimation technology that it says uses machine learning to read behavioral signals from users to determine their age, automatically turning on enhanced protections for users under 18. Roblox has started requiring users to verify their ages via video selfies in order to access chat features for users over 13. Both companies allow users to upload photo IDs for age verification if the estimates fail.

The US push for age assurance laws is mirrored in the UK, where the Online Safety Act requires age verification for certain services and features.

Bluesky, which says it complies with the UK law, says Mississippi goes a step further by requiring all users to undergo an identity check for any of its services.

Bluesky’s decision echoes that of the porn companies that have cut off service in Florida, Louisiana, Texas, and Utah after those states began requiring strict age verification. The Supreme Court in June upheld the Texas porn age verification law against an industry challenge. There has been no high court ruling so far on the constitutionality of age verification for social media, which could give some businesses pause.

“If you’re a small or medium company it might be risky to build out a new process just for the Supreme Court to ultimately say this law is unconstitutional,” said Bailey Sanchez, deputy director of the Future of Privacy Forum’s US Legislation Team.

That calculus may change, however, if more state social media laws go into effect.

“For a smaller state like Mississippi, it might make sense to pull out,” said Hintze Law’s Castic. “You wonder what it’s going to look like when there’s five or 10 or 15 states that have these kinds of laws.”