On Wednesday 14 October 2026, a US federal appeals court let Florida enforce its social media law for minors. On Thursday it did the same for Georgia. If you have users in Georgia, your legal risk changed that day, and nobody gave you a notice period.
This post covers what the two rulings say, what they don’t say, and how to build a per-state switch. The goal is simple. The next court ruling should change one row of config, not your roadmap. That only works if you built the rules behind each row first, and the build is what this post is about.
What the court did
The court is the US Court of Appeals for the Eleventh Circuit. The same judge, Kevin Newsom, wrote both opinions. For Florida I’m working from news reports and a case timeline. For Georgia I also read the opinion, as published by the Georgia attorney general’s office. The news sources are Biometric Update, Courthouse News, Fox 5 Atlanta and the case timeline on Wikipedia. Read the Florida opinion before you act on any Florida detail here.
Both rulings vacate a preliminary injunction. That is a court order that pauses a law while the case continues. NetChoice, a trade group for companies such as Meta, Google, Amazon and X, had won those orders in the lower courts. The appeals court removed them. The cases go back to the lower courts, so this is not the final word.
Florida HB 3. The panel found the law likely content-neutral and likely able to pass intermediate scrutiny (a medium-strength test that courts use for First Amendment questions). One thing is easy to miss. Florida’s law was already in force. The same court paused the injunction on 25 November 2025, by a 2 to 1 vote. So the October ruling doesn’t switch Florida on. It tells you the law probably isn’t going away soon.
Georgia SB 351. This is the one that is new. The court said NetChoice had not carried its burden. It had not given the court a full list of its members that the law applies to. The court said it “needn’t address the merits” of the First Amendment claim. It also split platforms into groups. “Conventional” platforms host fully protected speech. “Hybrid” platforms, such as X and Reddit, host mostly protected speech and some pornography. “Rogue” platforms host only speech that has no protection. The court said hybrid platforms raise different questions.
NetChoice says the court did not hold SB 351 constitutional. That reading looks right to me. The ruling is about who must prove what, at an early stage. Georgia’s attorney general, Chris Carr, called it a win and said it clears the way for the law to take full effect.
Why this will happen again
NetChoice has challenged similar laws in about a dozen other states. Courthouse News says most of those laws are blocked today. Each case has its own court, its own judge and its own calendar. Each can flip in either direction, and NetChoice says it’s weighing its next steps in Georgia. Another order could block SB 351 again.
We saw the same pattern in Utah. Our post on Utah’s injunction and location confidence covers that case. The lesson is the same: if you hard-code a state’s law into your product, you rebuild it every time a court acts.
The two laws side by side
| Florida HB 3 | Georgia SB 351 | |
|---|---|---|
| Under 14 | Barred from accounts | Parent consent needed |
| 14 and 15 | Parent consent needed | Parent consent needed |
| 16 and over | Not covered | Not covered |
| Age check | Platform must verify age and the parent | Platform must make “commercially reasonable efforts” to verify ages |
| Which platforms | Reported test: 10% of users under 16, 2 hours a day on average, addictive features | Broad definition, with exceptions for email, streaming, news, sports and shopping |
| Ads | Not covered in the reports I read | No ads to under-16s based on personal data other than age and location |
| Penalty | Up to 50,000 USD per violation, plus private lawsuits | Not reported |
| Status | In force since 25 Nov 2025 | Newly enforceable |
The Florida details come from the case timeline. The Georgia details come from the opinion, Courthouse News and Fox 5. I couldn’t find the Georgia penalties or a start date in any of them.
The legal lines are not on the age-band grid
Here is a build problem that the headlines skip. Florida draws lines at 14 and 16. Georgia draws one at 16. Browser-based age estimation, including the Xident Check, returns bands: +12, +15, +18, +21 and +25. Neither 14 nor 16 is a band edge.
An estimate that says “over 15” doesn’t tell you whether the person is 15 or 17. So don’t try to resolve 14 versus 15 with a camera.
There is a cleaner way to see it. These laws protect minors. A user who passes +18 is outside every row in the table. For everyone else, route on the best age you have, and escalate to a document check or a parent step. That’s my reading of the build, not a legal requirement. Your counsel decides what “verify” means for your platform.
The switch
Put each state’s rule in one table. Each row has a mode:
- off: the rule doesn’t apply here.
- shadow: run the check and write down what you would have done, but don’t block anyone.
- enforce: apply the rule.
Each row also has a version string, so every decision records which rule it used.
type Mode = "off" | "shadow" | "enforce";
type Rule = { mode: Mode; version: string; banBelow: number; consentBelow: number };
export const RULES: Record<string, Rule> = {
"US-FL": { mode: "enforce", version: "fl-hb3@2026-10-14", banBelow: 14, consentBelow: 16 },
"US-GA": { mode: "enforce", version: "ga-sb351@2026-10-15", banBelow: 0, consentBelow: 16 },
// any state where a court still blocks the law:
"US-XX": { mode: "shadow", version: "xx@2026-10-15", banBelow: 0, consentBelow: 16 },
};
type User = { state: string; adult: boolean; age: number; parentOk: boolean };
export function decide(u: User) {
const r = RULES[u.state];
if (!r || r.mode === "off" || u.adult) return { action: "allow", wanted: "allow", version: r?.version ?? null };
let wanted = "allow";
if (u.age < r.banBelow) wanted = "block";
else if (u.age < r.consentBelow && !u.parentOk) wanted = "ask_parent";
return { action: r.mode === "shadow" ? "allow" : wanted, wanted, version: r.version };
}Three tests keep the switch honest:
test("shadow mode never blocks, but records what it would do", () => {
const d = decide({ state: "US-XX", adult: false, age: 15, parentOk: false });
expect(d.action).toBe("allow");
expect(d.wanted).toBe("ask_parent");
});
test("Florida blocks an under-14 account", () => {
expect(decide({ state: "US-FL", adult: false, age: 13, parentOk: true }).action).toBe("block");
});
test("Georgia asks a 15 year old for a parent", () => {
expect(decide({ state: "US-GA", adult: false, age: 15, parentOk: false }).action).toBe("ask_parent");
});Shadow mode is the part people skip. It isn’t free: a shadow check still adds friction and collects data. Run it only for users in the state, and keep the records for a short, fixed time. It does two jobs. It tells you how many users a rule would touch before it touches them. It also gives you a record that you were ready. When a court lifts a block, you change shadow to enforce and ship the config. Nothing else moves.
Four things that break when a row flips
Who is “in” the state. The rule follows the user’s location, and location is a guess. IP addresses mislead, and VPNs (tools that hide a user’s real location) make it worse. We covered how to size an uncertain ring around the border in the Utah post.
Proof that a parent is a parent. Both laws lean on parent consent. A checkbox that says “I am the parent” isn’t proof. Plan a real step: a verified adult who links to the child’s account. Our guide to verifiable parental consent lists the methods and their trade-offs.
Accounts that already exist. Florida reportedly requires platforms to remove existing 14 and 15 year old accounts that lack consent. Those users get 90 days to dispute the removal. Under-14 accounts must go within 5 business days of a request. I took those numbers from the case timeline, so confirm them in the statute. The process is the same one we describe in back-book remediation. Plan for appeals too, using our human review guide.
The decision record. Florida allows private lawsuits. In a dispute, the question will be what you did for this user on this date, under which rule. Store the version string, the method, the result and the time with every decision. Our post on private rights of action shows why that matters.
The cost trade-off
You can enforce early in every state, or you can wait for each court. Both have a price.
Enforce early, and you add friction for adult users in states where the law may never take effect. Each extra step loses some sign-ups. You also collect more personal data than you need.
Wait, and you carry legal risk the day a court acts. In Florida that means up to 50,000 USD per violation and lawsuits from private parties.
Shadow mode is the middle path, and it’s cheap. Here is a model. The numbers are my assumptions, not Xident customer data.
- 50,000 new sign-ups a month across states with a blocked or newly enforceable law.
- A Check on each one, at the Growth list rate of €0.02.
- That’s about €1,000 a month in shadow mode, before the included volume on your plan.
- If 8% of those users need a document Verification at €0.20, that’s 4,000 users and €800 more. This only starts when you move a state to enforce.
Compare that with one Florida-sized penalty. The shadow data also tells you your real 8%, so you can replace my guess with a measured number.
What I could not confirm
- Georgia penalties and start date. None of the reports I read gave either.
- The exact Florida coverage test. The 10% and 2 hour figures come from one summary. Check them in the statute and in the opinion.
- What happens next. NetChoice says it is “evaluating” its options. I don’t know if it will ask for a wider panel of judges, go to the Supreme Court, or go back to the lower court.
- The reasoning for hybrid platforms. The court said they raise different questions. I haven’t read how far that goes, and it may matter if your product mixes content types.
Where Xident fits
The Check runs in the browser and returns an age band. A +18 pass clears the user in both states without a document. Everyone below that goes to your next step, which could be a document Verification. Each Xident result carries the outcome, method, threshold, confidence, policy version and time, so the record from the section above is part of the response.
On Growth, a Check is €0.02 and a document Verification is €0.20. A returning user with an Xident ID can pass a Check without uploading a document again. The pricing page has current terms, and the docs show how to start a Check from your code. The free sandbox gives you 1,000 Checks and 100 document Verifications, once, which is enough to run a shadow-mode test on your own traffic.
Xident doesn’t read the court calendar for you or decide which states to enforce. It also doesn’t run your parent-consent screens. Those are your product and your counsel’s call.
Seven days to a switch
- Make the rule table. One row per state, with mode, version and the age lines. No state logic anywhere else.
- Put Georgia and Florida on
enforce, after your counsel agrees on what “verify” means for you. - Put every state with a blocked law on
shadow, and read the counts weekly. - Send everyone who passes +18 through. Route the rest to a document check or the parent step.
- Build the parent step with proof that the adult is an adult, linked to the child’s account.
- Add the version string to every decision record.
- Write a one-page runbook: who reads court news, who approves a mode change, and how long a deploy takes. Aim for one day.
For the wider US picture, see the state-by-state compliance guide. For another under-16 rule that needs the same table, compare the UK policy table.
