Almost every age-verification law you have read treats age assurance as a gate. There is a room full of restricted content — pornography, alcohol, gambling, a nightclub — and the check decides who gets to walk in. You verify to gain access to something withheld by default. The mental model is a bouncer.
California’s SB 976 breaks that model, and most teams reading it for the first time do not notice. The thing being withheld is not adult content. It is your own product’s core mechanic — the personalized, engagement-ranked feed — and under SB 976 that mechanic is switched off by default for any user you cannot defensibly show is an adult. You do not verify to let a small slice of users into a restricted room. You run age assurance across your entire audience to earn the right to keep serving the algorithm you already ship to everyone.
That inversion changes the engineering problem completely, and it lands on a hard date. From January 1, 2027, the Act’s central obligation becomes operative, and California’s Attorney General has already published the rules that will define what “reasonably determined the user is not a minor” actually means. The comment window closed on June 30, 2026. The clock left is measured in months.
What SB 976 actually says
The Protecting Our Kids from Social Media Addiction Act — SB 976 — was signed by Governor Newsom on September 20, 2024 (California DOJ). Its core prohibition is narrow in wording and broad in consequence: it is unlawful for the operator of an “addictive internet-based service or application” to provide an addictive feed to a user unless one of three things is true — the operator does not have actual knowledge that the user is a minor; commencing January 1, 2027, the operator has reasonably determined that the user is not a minor; or the operator has obtained verifiable parental consent (leginfo).
An “addictive feed” is, in substance, the default surface of modern social media: content selected or ranked for a user based on that user’s data or behavior, rather than by an explicit signal like a follow or a search. Strip the algorithmic ranking and you are left with a chronological or explicitly chosen feed — which is exactly what SB 976 forces as the fallback for minors.
The Act pairs that central rule with a set of default-on protections for users the operator knows to be minors: private-by-default accounts, restrictions on the visibility of like counts and similar feedback, limits on notifications during nighttime and school hours, and parental controls including scheduled time limits (Inside Privacy; Hunton). Enforcement runs through the Attorney General in a civil action, with penalties recoverable per violation — this is a state-AG statute, not a private-right-of-action regime, which concentrates the risk but does not shrink it.
Be precise about the litigation, because it is easy to overstate in either direction. NetChoice challenged the Act on First Amendment and vagueness grounds. A district court partially enjoined several pieces — the notification restrictions, the notification-related default setting, a compelled-disclosure requirement, and the like-count default — while expressly allowing the personalized-feed restriction, the private-mode default, and the age-assurance framework to stand; the Ninth Circuit then remanded the case for further proceedings in NetChoice, LLC v. Bonta (9th Cir. Mar. 12, 2026) (Alston & Bird). The headline for anyone building product: the two provisions that matter most for age assurance — the ban on serving addictive feeds to minors, and the requirement to reasonably determine a user is not a minor — survived, and the age-assurance obligation is not operative until 2027 precisely so that operators have time to build it.
Why this is not a porn gate, and why that matters
The reason the inversion is more than a rhetorical flourish is that it moves age assurance from the edge of your product to the center, and from a fraction of your users to all of them.
A content gate assesses a self-selecting minority: the people who navigate to the age-restricted surface. You can afford heavier friction there because reaching that surface already signals intent, and because the volume is bounded. A document upload with a thirty-second liveness check is tolerable at a gambling cashier or an adult-content splash page. SB 976 gives you none of that comfort. The “restricted” surface is the home feed — the first thing every user sees, the mechanic your retention depends on. To keep serving it, you must have formed a defensible determination, for each user, that they are not a minor. That is age assurance applied to your whole California base, at signup and on an ongoing basis, under UX constraints where a thirty-second interruption is a business-model event.
This is the exact point where the document-upload monoculture collapses. Asking every user to photograph a driver’s license before they can see a ranked feed is not a compliance strategy; it is a churn strategy. It also fails the law’s own preferences, as the proposed regulations make explicit. The problem SB 976 sets is not “how do I build a strong gate.” It is “how do I resolve the age of a very large population at very low friction, accurately enough to defend, and escalate only the ambiguous cases.” That is a different discipline, and it is the one Xident is built for.
The proposed regulations are an architecture spec in disguise
On May 14, 2026, Attorney General Bonta released the proposed SB 976 regulations and opened the 45-day comment period that closed with a public hearing on June 30, 2026; the AG must adopt final regulations by January 1, 2027 (California DOJ; Alston & Bird). Read as a compliance document, the proposal is a list of obligations. Read as an engineer, it is a remarkably specific description of an architecture — and it rules out most of the shortcuts operators reach for first.
The core requirement: an operator without actual knowledge that a user is a minor must make a reasonable determination that the user is not a minor before providing covered features, using one or more commercially reasonable and technically feasible age-assurance methods that are effective, measurable, consistent, and testable (Alston & Bird). Those four adjectives are not decoration. “Measurable” and “testable” mean you must be able to state your method’s accuracy and prove it under audit — the same standard we argued was becoming table stakes in why you have to prove age assurance works, not just deploy it. A method you cannot instrument is, under this rule, not a method.
Then the proposal names what is not a reasonable determination — a blacklist that reads like a tour of the industry’s favorite corners to cut:
- Self-declaration. A birthday field a minor can lie past is explicitly insufficient. This is now the third major regime to say so out loud, after the reasoning behind the ICO’s £14.47M Reddit penalty; treating a typed date of birth as age assurance is no longer an oversight, it is a documented failure to comply.
- General contractual age restrictions. A terms-of-service clause asserting all users are 18+ is not a determination about any actual user.
- Certain online payment methods. A stored card is a billing relationship, not an age proof — the precise argument in a credit card is not an age check, now written into a regulator’s insufficiency list.
- Inconclusive outcomes, and methods with known risks the operator has not reasonably mitigated. An estimate that lands in the uncertain band is not a pass; you must resolve it, not round it.
And the sharpest line of all: the proposed rules prohibit operators from requiring government-issued identification, or using it as the sole age-assurance method (Alston & Bird). Read that twice if you sell, or buy, a document-upload product as a standalone answer. California is not merely permitting privacy-preserving estimation as an alternative to ID; it is forbidding an ID-only design. The regulation is pushing the entire market toward exactly the layered model — low-friction estimation first, stronger methods including but never solely document checks for the cases that need them — that a gate-shaped, upload-everything product cannot provide.
The rest of the proposal fills in the operational frame, and each item maps to a capability rather than a policy:
- Transparency reporting — publish how your methods work, the data and rationale behind them, and how you test and audit their accuracy. You cannot publish what you did not instrument.
- Cross-platform consistency — apply a determination across every access point, web and app. Age status is an attribute of the user, not of the surface.
- Appeals and error correction — a real path for a wrongly classified user to contest the result. This is the adult-lockout problem written into law: false positives against adults are not an acceptable rounding error, they are a compliance obligation with a required remedy.
- Verifiable parental consent with at least one option that requires no account creation, no purchase, and no government ID — a deliberate rejection of consent flows that quietly re-collect identity from the parent.
- Revocation as easy as consent, honored immediately.
- Anti-circumvention measures that account for concealed or misrepresented California location — i.e., the VPN and location-spoofing problem is your problem to reasonably address, not an excuse.
- Data governance — collect only what compliance requires, use it only for compliance, secure it, retain it only as long as needed, and delete it immediately after. This is data minimization as a rule, and it is the strongest possible argument against building the biometric honeypot that the 2026 breach wave keeps punishing.
Taken together, the proposed regulations do not just permit a privacy-first, estimate-then-escalate, tokenized, minimized architecture. They come close to mandating it.
The two ways to fail, and the one design that avoids both
Once age assurance is the switch on your whole feed, the failure surface is symmetric, and both sides are expensive.
Set your bar too high — demand strong proof from everyone, or treat every ambiguous estimate as a minor — and you throttle adults out of the product you built for them. That is not a hypothetical; it is the adult-lockout failure mode, and at the scale of a whole user base it is a revenue line, not an edge case. Set your bar too low — wave through anyone who does not obviously read as a child — and you are serving addictive feeds to minors in violation of the Act, with the Attorney General as your counterparty.
The design that survives both is not a single method at a single threshold. It is a calibrated pipeline: passive, privacy-preserving age estimation resolves the large, unambiguous majority at near-zero friction; a defined confidence band around the 18-year line escalates rather than guesses; and stronger verification — document plus liveness, or a trusted signal — is spent only on the ambiguous and high-risk cases that estimation should never decide alone. We laid out the mechanics of this in orchestrating layered age assurance; SB 976’s proposed rules are, in effect, a regulator independently specifying the same shape and forbidding the flat alternatives. The “inconclusive outcomes are insufficient” clause is the law telling you to build the escalation path. The “no ID-only” clause is the law telling you estimation has to carry the first and largest tier.
And because the determination should be made once and honored consistently, the natural output is a reusable, privacy-preserving token: a minimal attestation that a user cleared the not-a-minor bar, re-presented on return without re-collecting identity, and portable across your web and app surfaces to satisfy the cross-platform-consistency rule. That is the model behind reusable age credentials and zero-knowledge age proofs — prove the fact, not the identity — and it is the cleanest way to satisfy the data-minimization and immediate-deletion requirements without breaking the user experience on every session.
This is a template, not a California problem
It is tempting to scope this to one state and move on. That is the mistake. SB 976 is one instance of a fast-converging pattern: age assurance as the trigger for how you must treat a user, not merely whether you let them in. New York’s SAFE for Kids Act runs on the same logic — restrict addictive feeds and nighttime notifications for minors, with age assurance as the gating capability — and we broke down its accuracy expectations in the SAFE for Kids rules. The broader shift from gating access to segmenting the experience by age is now visible across jurisdictions.
Build a California-only bolt-on and you will rebuild it for New York, then again for the next state, each with slightly different definitions and thresholds. Build the underlying capability once — a jurisdiction-aware age-assurance layer that outputs a defensible, minimized determination and can be tuned per rule — and each new statute becomes a configuration change, not a new project. The proposed SB 976 regulations are detailed enough to serve as the reference spec for that capability, because they are stricter and more prescriptive than most of what will follow.
What to build before January 2027
Four things belong on the roadmap now, not in Q4.
Resolve age at the feed boundary, not at a content gate. You need a low-friction determination of whether a user is under 18 that runs across your whole California audience and is accurate enough to defend under audit — which in practice means estimation-first, because ID-first is both a churn problem and, under these rules, an impermissible sole method. Tune for the threshold, not the average: define the confidence band around 18 where you escalate instead of guessing, so you neither lock out adults nor wave through minors. Instrument everything, because “measurable, testable” and the transparency-report requirement mean an accuracy number you cannot produce is a determination you cannot defend. And minimize by default — emit a reusable token that proves the not-a-minor determination without hoarding the identity data the deletion rule requires you to destroy.
Xident is built for the first two directly and makes the last two the default. Age-threshold classification resolves whether a user clears the 18-year line as a low-friction, privacy-preserving first tier; document OCR, face match, and server-side liveness are there to escalate the near-threshold and high-risk cases that estimation alone should never settle — the layered shape the proposed regulations effectively require and the ID-only shape they forbid. Token-based returning-user verification means a user proves the fact once and re-presents a minimal attestation across your web and app surfaces, satisfying cross-platform consistency and data minimization at the same time. The parental-consent rail and the feed-configuration logic remain yours to own; Xident is the age-assurance layer that decides, defensibly, which experience each user is entitled to.
If you serve California users and your feed is algorithmically ranked, the switch is already wired into the statute — you have until January 1, 2027 to make sure it is connected to something you can defend. That is the conversation to have now, while the runway is measured in months rather than weeks.
This article is for general information and does not constitute legal advice. SB 976 remains subject to ongoing litigation, and the Attorney General’s regulations were in proposed form and subject to revision as of publication. Validate your compliance approach with qualified California counsel against the final adopted regulations and the current posture of NetChoice, LLC v. Bonta.
