Georgia can now require social media platforms to verify the age of every user, after a federal appeals court stripped away the legal protection that had kept Senate Bill 351 frozen for more than a year. The Eleventh Circuit's decision on October 15, 2026, does not settle whether the law is constitutional - but it does mean enforcement can begin while that bigger question works its way back through the courts.
What the Ruling Actually Decided
A three-judge panel - Kevin Newsom, Robert Luck, and Gerald Bard Tjoflat - vacated a preliminary injunction that had blocked SB 351 since it passed. The injunction had been obtained by NetChoice, a trade group representing major technology platforms, which argued the law violated the First Amendment on its face. The panel's decision turned on a narrower, more technical failure: NetChoice brought a facial challenge, meaning it tried to show the law is unconstitutional across every platform it touches, rather than challenging how it applies to one company in one situation. Under the Supreme Court's 2024 framework in Moody v. NetChoice, that kind of broad challenge requires a broad evidentiary record - a full accounting of the different platforms covered and how the law affects each of them. NetChoice did not supply a complete membership list or address that range adequately, and the panel found the record too thin to justify continued blocking of the law.
That is a procedural defeat, not a constitutional verdict. The underlying case continues in the Northern District of Georgia, where platforms can still argue that specific provisions are unlawful as applied to them.
What Platforms Must Now Do
SB 351 places the compliance burden squarely on platforms rather than parents. Covered services must use commercially reasonable efforts to verify the age of every account holder. Users under 16 cannot hold an account without express parental consent, which platforms may confirm through government-issued identification or payment-card data. Companies that decline to build verification systems face a stricter fallback: they must apply every minor-protection restriction to their entire user base, regardless of actual age.
- Advertising directed at users under 16 is restricted to age and location data only - no behavioral or interest-based targeting.
- Civil penalties can reach $2,500 per violation.
- Platforms that skip verification must treat all users as minors for compliance purposes.
The court also revived the law's advertising restriction, reversing the district court's finding that it was preempted by Section 230 of the Communications Decency Act. The panel reasoned that limiting how a platform targets advertising regulates the platform's own conduct, not the content its users post - placing it outside Section 230's shield, which protects platforms from liability for user-generated material, not from rules governing their business practices.
A Pattern Across States
Georgia's outcome fits a broader shift. The Eleventh Circuit has already found Florida's comparable law, HB 3, likely constitutional, and the Sixth Circuit reversed a block on Ohio's parental-consent requirement for users under 16 - though that ruling is reportedly paused while NetChoice seeks Supreme Court review. Courts are increasingly willing to let age-verification and parental-consent laws take effect while litigation over their outer limits continues, shifting the practical burden onto platforms long before any final constitutional ruling arrives.
NetChoice's litigation director, Paul Taske, said the group remains "disappointed" but noted the court "did not hold that SB 351 is constitutional," signaling further challenges ahead. Georgia Attorney General Chris Carr's office called the ruling "a major win for Georgia families." Both characterizations are accurate in their own way - the law is enforceable now, but its fate is still being argued.
Why This Matters Beyond Georgia
For platforms, the shift from "pending" to "enforceable" is immediate and costly: verification infrastructure, consent workflows, and advertising-targeting systems must be built now, not whenever the courts finish deliberating. For users and parents, it marks a concrete step toward identity-based gatekeeping on social platforms, a trend privacy advocates have watched warily because age-verification systems often require handing over government identification or financial data - the same categories of sensitive information that make centralized verification databases attractive targets for breaches. The underlying tension - protecting minors online without expanding data collection or chilling adult speech - is far from resolved, and Georgia's case is now one of several moving in parallel toward appellate and possibly Supreme Court review.
