Mississippi’s Broken Age Verification Law Forces Bluesky To Block All State Users

Legal Issues

from the the-fracturing-of-the-internet-through-bad-laws dept

Full disclosure: I am on the Bluesky board.

Bluesky made a major statement last week when it announced that it would be geoblocking Mississippi IP addresses from accessing its site—making it the first major social media platform to completely block access from a US state.

Unlike tech giants with vast resources, we’re a small team focused on building decentralized social technology that puts users in control. Age verification systems require substantial infrastructure and developer time investments, complex privacy protections, and ongoing compliance monitoring — costs that can easily overwhelm smaller providers. This dynamic entrenches existing big tech platforms while stifling the innovation and competition that benefits users.

We believe effective child safety policies should be carefully tailored to address real harms, without creating huge obstacles for smaller providers and resulting in negative consequences for free expression. That’s why until legal challenges to this law are resolved, we’ve made the difficult decision to block access from Mississippi IP addresses. We know this is disappointing for our users in Mississippi, but we believe this is a necessary measure while the courts review the legal arguments.

Some companies have been blocked by foreign countries, or blocked access in other countries. But geoblocking specific states had generally been limited to adult content sites in the past. This unprecedented response highlights just how unworkable Mississippi’s law really is.

Here at Techdirt, we’ve been warning about the dangerous negative consequences of age verification mandates for years. But even then there are variations in the pure ridiculousness of some of these laws. Some can be dealt with. Some are effectively impossible. Enter Mississippi’s HB 1126.

The bill is ridiculous in many, many ways. It first requires “digital service providers” (defined fairly broadly) to engage in age verification of every new user (the bill is written so badly that it’s not clear if it applies to accounts from before the bill goes into effect). If the user is deemed to be under the age of 18, the site is required to get “parental consent” before making the service available.

The parental consent requirements alone show how divorced from reality this law is. Picture this: your 17-year-old wants to join a social media platform, so now you need to:

A digital service provider shall not permit an account holder who is a known minor to be an account holder unless the known minor has the express consent from a parent or guardian. Acceptable methods of obtaining express consent of a parent or guardian include any of the following:

(a) Providing a form for the minor’s parent or guardian to sign and return to the digital service provider by common carrier, facsimile, or electronic scan;

(b) Providing a toll-free telephone number for the known minor’s parent or guardian to call to consent;

(c) Coordinating a call with a known minor’s parent or guardian over video conferencing technology;

(d) Collecting information related to the government-issued identification of the known minor’s parent or guardian and deleting that information after confirming the identity of the known minor’s parent or guardian;

(e) Allowing the known minor’s parent or guardian to provide consent by responding to an email and taking additional steps to verify the identity of the known minor’s parent or guardian; or

(f) Any other commercially reasonable method of obtaining consent in light of available technology.

So if your teenager wants to use Bluesky (or any other digital service), you might need to mail in a signed form, hop on a video call with the company, or hand over your government ID to verify you’re really their parent—all so they can post about their favorite bands or follow local news. What if the kid is estranged from their parents? What if their parents disagree over whether or not their child can use the site? How do you verify that it’s actually a legal guardian? The law is effectively silent on all that.

There’s a lot more that’s problematic in the law as well. Even if the parent gives permission, a site is still required to block kids from accessing anything deemed harmful… but also shouldn’t stop the kid from searching for harmful information. It basically demands the impossible.

And if a kid does access ambiguously “harmful” information any parent can sue and sites can face penalties of up to $10k per violation and the potential of criminal penalties as well.

NetChoice, the trade group that has been kept busy the last few years suing (and mostly winning) to stop every unconstitutional internet law, sued over this law, and, after some procedural nonsense related to last year’s Supreme Court ruling in Moody, got a temporary restraining order blocking the law from going into effect (at least against NetChoice’s members). Judge Halil Suleyman Ozerden recognized how obviously unconstitutional the law was, noting that the law was incredibly broad, was not even remotely narrowly tailored to the state’s compelling interest. Basically this law is a mess and the state has no reasonable defense:

In short, NetChoice has carried its burden of demonstrating that there are a number of supervisory technologies available for parents to monitor their children that the State could publicize… Yet, the Act requires all users (both adults and minors) to verify their ages before creating an account to access a broad range of protected speech on a broad range of covered websites. This burdens the First Amendment rights of adults using the websites of Netchoice’s covered members, which makes it seriously overinclusive. But NetChoice has also presented persuasive evidence that “[u]ncertainty about how broadly the Act extends—and how Defendant will interpret the Act—may spur members to engage in over-inclusive moderation that would block valuable content from all users,” and that not all covered websites have the ability to “age-gate,” meaning that “they are unable to separate the content available on adults’ accounts from content available on minors’ accounts.” …. This likewise renders H.B. 1126 overinclusive.

The Act also requires all minors under the age of eighteen, regardless of age and level of maturity, to secure parental consent to engage in protected speech activities on a broad range of covered websites, which represents a one-size-fits-all approach to all children from birth to age 17 years and 364-days old. H.B. 1126 is thus overinclusive as to Netchoice’s covered members to the extent it is intended as an aid to parental authority beyond the resources for monitoring children’s internet activity NetChoice has already identified, because not all children forbidden by the Act to create accounts on their own have parents who will care whether they create such accounts. See Brown, 564 U.S. at 789, 804 (holding the state act purporting to aid parental authority by prohibiting the sale or rental of “violent video games” to minors “vastly overinclusive” because “[n]ot all of the children who are forbidden to purchase violent video games on their own have parents who care whether they purchase violent video games” (emphasis in original)).

This follows on what happens in basically every district court over laws like this. But, of course, Mississippi is in the Fifth Circuit, where good judicial systems go to die. What happened next perfectly encapsulates why the Fifth Circuit has become synonymous with lawless judicial activism. A month later the Fifth Circuit—with no explanation—said the law could go into effect, putting a “stay” on the TRO. No reasoning. No analysis. Just a naked power grab that ignores clear Supreme Court precedent.

NetChoice went to the Supreme Court’s shadow docket, where the Supreme Court refused to vacate the Fifth Circuit’s ruling, even as Justice Kavanaugh explained that it was pretty obvious the law was unconstitutional: We had mentioned this very odd result when it happened. Here’s Kavanaugh:

To be clear, NetChoice has, in my view, demonstrated that it is likely to succeed on the merits—namely, that enforcement of the Mississippi law would likely violate its members’ First Amendment rights under this Court’s precedents. See Moody v. NetChoice, LLC, 603 U. S. 707 (2024); Brown v. Entertainment Merchants Assn., 564 U. S. 786 (2011); cf. Free Speech Coalition, Inc. v. Paxton, 606 U. S. ___ (2025). Given those precedents, it is no surprise that the District Court in this case enjoined enforcement of the Mississippi law and that seven other Federal District Courts have likewise enjoined enforcement of similar state laws.

Okay? So why are you letting the law go into effect?

… because NetChoice has not sufficiently demonstrated that the balance of harms and equities favors it at this time, I concur in the Court’s denial of the application for interim relief.

What?!? This is judicial gaslighting at its finest. The Supreme Court has said, repeatedly, that denial of your First Amendment rights is very much a harm. But apparently, they all forgot that.

And now social media users begin to suffer. Welcome to the two-tiered internet. As Bluesky explained, there’s basically no other reasonable way to comply with this law short of blocking all users from the state:

Mississippi’s approach would fundamentally change how users access Bluesky. The Supreme Court’s recent decision leaves us facing a hard reality: comply with Mississippi’s age assurance law—and make every Mississippi Bluesky user hand over sensitive personal information and undergo age checks to access the site—or risk massive fines. The law would also require us to identify and track which users are children, unlike our approach in other regions. We think this law creates challenges that go beyond its child safety goals, and creates significant barriers that limit free speech and disproportionately harm smaller platforms and emerging technologies.

The harm is immediate and concrete. Mississippi now has a fundamentally different internet than the rest of the country—one where geography determines your access to information and communities. This is exactly the kind of balkanization that the internet was designed to prevent. The Mississippi Free Press, a fantastic independent journalism site covering news in Mississippi, has said that Bluesky has been a huge part of their distribution:

For those of us at the Mississippi Free Press, this is a significant blow. We left Twitter earlier this year for a lot of reasons, and have since made Bluesky our main social media platform (it’s also where we have the most followers).

[….]

We don’t know yet what this will mean for our ability to continue to post on Bluesky. Frankly, I’m more concerned about how this will prevent our readers who follow us on Bluesky from continuing to do so.

Think about what this means: A local news organization in Mississippi can no longer easily reach its readers through a major social media platform because of their state government’s actions. Independent journalism—already struggling—now faces additional barriers created by the very government it’s trying to hold accountable.

MFP’s news editor, Ashton Pittman has made it clear where the blame lies for this: with Mississippi’s legislators who (on a bipartisan basis) passed this terrible law:

And, yes, as with every other age-gating law that shows up anywhere in the world, all it’s really doing is promoting VPN subscriptions. The tech-savvy will route around the censorship. Everyone else—including the most vulnerable populations this law claims to protect—gets cut off.

Separately, I’ve seen some commentary regarding how this somehow goes against Bluesky’s decentralization promises, but nothing can be further from the truth. Understanding why requires grasping how the AT Protocol actually works. Bluesky is one provider on the wider Atmosphere (the rapidly growing set of services using the underlying ATprotocol). Each of those services can make their own decision of how to comply with the law here. Bluesky made this point in its explanation:

This decision applies only to the Bluesky app, which is one service built on the AT Protocol. Other apps and services may choose to respond differently. We believe this flexibility is one of the strengths of decentralized systems—different providers can make decisions that align with their values and capabilities, especially during periods of regulatory uncertainty. We remain committed to building a protocol that enables openness and choice.

This is actually decentralization working as intended. If this were Twitter or Facebook, users would have no alternatives when states make dangerous policy choices. With AT Protocol, other providers could theoretically serve Mississippi users differently (though they’d face the same impossible legal risks). More importantly, users retain their identity and social connections across different providers within the network.

The key thing to remember is that nothing in this law actually makes kids safer. Like all age verification laws, it just creates a ridiculous scenario that infringes on people’s rights, closes off portions of the open internet, and serves no purpose other than enabling legislators to pat themselves on the back and pretend they’ve done something useful.

One hopes that the legislators in Mississippi will reconsider this bad law. Or that the courts (which continue to review this law) issue a new injunction that the Fifth Circuit and the Supreme Court don’t reject.

Until then, it really sucks that the state of Mississippi has effectively decided that smaller, upstart social media sites have three awful choices: comply with the law and block all access, disobey the law and risk ruinous liability, or comply with the law by collecting a ton of extremely sensitive data and setting up an impossible and unworkable system of “parental consent” that will create a huge mess for both kids and parents. The option Bluesky took seems like the only sensible one in this scenario.

Filed Under: 1st amendment, 5th circuit, age verification, geoblocking, mississippi, netchoice v. fitch, supreme court
Companies: bluesky, netchoice