Bluesky will follow recently passed age-verification rules in South Dakota and Wyoming, also offering in-app age checks rather than being cut off.” The decision comes a week after the decentralized social media platform departed the state of Mississippi, which included a more expansive law that would have required the company to verify the age and ostensibly the identity of all user accounts and obtain the consent of parents on behalf of any underage users, with fines of potentially up to $10,000 per user.
How Bluesky will vet ages in SD and WY
The company is rolling out Kids Web Services (KWS), a product from the Epic Games-owned SuperAwesome, which specializes in kid-friend privacy tooling. KWS offers a range of “age attestation” methods, which include checking that a payment card is used to demonstrate the payment card holder is over 18, checking government issued ID or facial age estimation to determine age without maintaining biometrics. Users in both states will be prodded to verify where needed, but the app won’t otherwise be blocked — so not everyone with an unconfirmed account should expect to see a cold shoulder.
Bluesky has been collaborating with KWS to meet the requirements of the United Kingdom’s Online Safety Act, which envisages risk-adjusted age assurance. That alignment indicates the company is trying to standardize compliance around the world, reducing bespoke engineering for every jurisdiction while maintaining access for most users.
Why Mississippi was a red line
Mississippi’s bill, by contrast, would have forced the platform to verify all users — regardless of whether they have access to adult features — and obtain parental consent for all users under 18. For a lean operation, that means a heavy technical lift, continuing costs of moderation and support and major legal exposure. Bluesky decided to leave the state rather than not comply or introduce large-scale identity checks that might dissuade participation on a pseudonymous network.
Its approach highlights a pragmatic partition beginning to come into focus in policy discussions: targeted, risk-based age assurance can often be implemented while universal gating of identity can be unfeasible, especially for smaller or privacy-friendly services. The contrast with the South Dakota and Wyoming frameworks versus Mississippi’s all-users mandate was stark.
A spreading patchwork — and a legal minefield
With no federal standard in the United States, states are moving forward. The National Conference of State Legislatures has monitored a dozens of age-verification and youth online safety bills since 2023, applying to social media, content platforms and adult sites alike. The effect is a patchwork that forces companies to piece together state-by-state logic for sign-ups, features — and enforcement.
Litigation is shaping the boundaries. A federal judge halted enforcement of the Social Media Safety Act in Arkansas, expressing First Amendment issues. Ohio’s social media parental-consent law was also enjoined. Many of these challenges have been led by the industry group NetChoice, which contends that many of the statutes are overbroad or unconstitutional. The legal uncertainty — along with ever-evolving products — raises the costs of compliance, particularly for nascent platforms without compliance teams the size of Meta’s or TikTok’s.
Privacy vs. protection, by the numbers
Defenders of age checks say they can cut down on minors’ exposure to harmful content and high-risk features — like DMs or algorithmic discovery. Regulators in Europe and the United Kingdom have stressed “proportionate” age assurance, weighing safety against privacy. For instance, Ofcom’s draft guidance under the Online Safety Act now under consideration, which the government would do well to uphold, calls for a range of measures calibrated to risk, and not a one-size-fits-all ID requirement.
Privacy advocates argue that mandatory identification introduces new attack vectors. The Federal Trade Commission’s Consumer Sentinel Network typically tracks more than a million identity theft reports a year, indicating the danger of creating additional storehouses of sensitive information. Groups like the Electronic Frontier Foundation and the ACLU caution that invasive checks can discourage vulnerable people from speaking up, chill speech and normalize surveillance across the web.
What this means for decentralized social apps
Bluesky is based around the AT Protocol, which seeks to decentralise control over a number of competing service providers. That architecture complicates traditional compliance strategies — there’s no one walled garden to police — and amplifies the trade-offs inherent to identity checks in communities that cherish portability and pseudonymity. Adopting a modular, off-chain verifier, such as KWS, paves the way for a practical approach: contain checks at high-risk features and regions and keep the protocol’s open design.
As for users in South Dakota and Wyoming, the immediate takeaway is simple: Bluesky will remain live, with scolds to check age when appropriate. For policymakers and platforms, the larger lesson is that risk-based, interoperable age assurance has a much better shot at widespread adoption than blanket identity mandates — especially if the goal is to protect young users without steamrolling privacy or curtailing competition.