Age verification laws continue to spread through the US, with Ohio the next state to implement them.
From September 30, 2025, websites hosting adult content or that deemed “obscene or harmful to juveniles” must require users to prove their age.
Attention has turned to the best VPNs as a result of these laws. People are searching for ways to bypass age verification checks and the privacy tools are seen as a solution.
Uploading sensitive personal information, often to third-party services, is how Ohioans will have to verify their age. Opponents argue this opens users up to numerous cybersecurity risks, including data breaches, hacking, and fraud.
The law’s effective date is just four days after a very similar law came into effect in Arizona.
Invasive laws hidden away
Unlike some other US states, Ohio’s laws are not a bill in their own right. Instead, age verification requirements were nestled into the state’s two-year operating budget – House Bill 96.
The appropriate section starts on page 654 of the bill. It says age verification will be enforced for websites if “materials that are obscene or harmful to juveniles” make up “a significant or substantial portion” of its trade, revenue, content, or advertising.
“Reasonable age verification methods” should be undertaken. This can be done via submitting “government-issued” photo identification or “public or private transactional data” through the use of a “commercial age verification system.”
“Third-party and governmental databases” using photo ID and transactional data via a commercial age verification system can also be used.
Organizations who host adult content must verify the individual trying to access it is over 18. They must also verify that anyone creating an account or subscription to access the material is over 18. For account holders, re-verification must take place every two years.
As well as this, organizations are instructed to monitor a user’s location. The bill states sites shall “utilize a geofence system maintained and monitored by a licensed location-based technology provider to dynamically monitor the geolocation” of those accessing material and creating accounts and subscriptions.
The “licensed location-based technology provider” performs a check to determine whether the individual is located in Ohio. If yes, the site will be blocked until age verification takes place.
Websites are instructed to “immediately delete all information gathered” for age verification purposes once the process is complete. They must also “develop and maintain a data privacy policy compliant with federal and state law,” as well as ensuring any maintained data is “reasonably secure.”
The bill doesn’t indicate how location checking would take place. Analyzing IP addresses would be the simplest method, but other methods are possible. If it is IP-based, then connecting to a non-Ohio VPN server may bypass the checks.
However, when TikTok went offline in the US in January 2025, connecting to a VPN didn’t bring the app back. Location appeared to be tied to accounts and other information, as opposed to IP address.
There is also no indication of which technology provider will perform location checks and how data will be stored securely. Both of these uncertainties don’t seem to ease the concerns of age verification critics, who cite the cybersecurity risks and label it as “a disaster waiting to happen.”
Ohio’s Attorney General has “exclusive authority” to enforce these rules and can bring “civil action” against any organization found to breach them. However, organizations, following receipt of a violation notice have 45 days to rectify the situation before any action is taken.
There are no details on what a punishment would look like beyond “civil action.” Fines are common for breaches taking place in other US states. In Arizona, penalties range from $10,000 to $250,000.
Not the first attempt
This is not the first time Ohio has attempted to pass age verification laws. Similar bills were introduced in 2024 and earlier this year, the latter titled “The Innocence Act.”
Republican representative Steve Demetriou sponsored both bills. He reportedly called online age verification laws “common sense” and said minors would be protected from “harmful” content.
As per reports, Rep. Josh Williams, who co-sponsored the 2025 bill, claimed age verification wouldn’t come to social media sites. In the UK, age verification came to X, as well as Reddit, Bluesky, and even Spotify.
While this may not be the case in the US right now, a change would not be surprising.
Ohio’s law was signed by the governor on June 30, 2025 and takes effect on September 30, 2025. When this happens it will become the 24th state to have active age verification laws. Missouri will soon follow, with its laws due to come into effect on November 30, 2025.
The Free Speech Coalition’s Age Verification Bill Tracker monitors the progress of all age verification bills and laws in the US.
The group has said it “whole-heartedly supports the goal of protecting young people from material that is age-inappropriate or harmful.” But it opposes “current proposals” on “practical, technical, and legal” grounds. It is also concerned about the risk of data breaches and impact on free speech.