Posted in

Appeals Court Lets Georgia Enforce Youth Social Media Verification Law

Social media platforms operating in Georgia now face a legal obligation that, until last week, existed only on paper. A three-judge panel of the Eleventh Circuit Court of Appeals vacated the preliminary injunction that had kept Georgia's age-verification statute, Senate Bill 351, from taking effect. The October 15, 2026 ruling does not settle whether the law is constitutional, but it does end more than a year of enforced inaction, and it shifts real compliance pressure onto platforms with virtually no transition period.

A Narrow Ruling With Broad Consequences

The panel, composed of Judges Kevin Newsom, Robert Luck, and Gerald Bard Tjoflat, did not rule that SB 351 survives First Amendment scrutiny. It ruled that NetChoice, the industry group representing major platforms, failed to meet the evidentiary standard required to freeze enforcement while litigation continues. Under the Supreme Court's 2024 decision in Moody v. NetChoice, a facial challenge to a law must show how that law operates across the entire range of platforms and applications it touches - not just how it might burden one hypothetical actor. NetChoice did not provide the court with a complete list of its members or a sufficiently detailed account of how the statute would apply across different kinds of services. Without that evidentiary foundation, the panel found no basis to keep blocking enforcement.

The distinction is consequential. A law can remain legally vulnerable and still be enforceable while that vulnerability gets litigated. That is precisely where SB 351 now sits.

What the Law Actually Requires

SB 351 places the compliance burden on platforms rather than on parents or minors. Covered services must make commercially reasonable efforts to verify the age of every account holder. Users under 16 cannot maintain an account without express parental consent, which platforms may confirm through government-issued identification or payment-card data. Platforms that decline to build age-verification systems face a stricter fallback: they must apply every minor-protection restriction to their entire user base, regardless of actual age. Advertising directed at users under 16 is restricted to age and location targeting only - no broader behavioral profiling. Violations carry civil penalties of up to $2,500 each, a figure that scales quickly across large user populations.

Section 230 and the Advertising Carve-Out

The Eleventh Circuit also reversed the district court's earlier findings that parts of SB 351 were unconstitutionally vague and preempted by Section 230 of the Communications Decency Act. Section 230 shields platforms from liability tied to user-generated content, but the panel reasoned that restricting how a platform advertises to minors regulates the platform's own commercial conduct, not the content its users post. That reasoning places the advertising provision outside Section 230's protective scope, a notable interpretive move that other circuits may watch closely as similar laws work through the courts.

Part of a Wider Pattern

Georgia is not litigating this question alone. The Eleventh Circuit previously found Florida's comparable statute, HB 3, likely constitutional, and the Sixth Circuit reversed a block on Ohio's parental-consent requirement for users under 16 - though that Ohio ruling is reportedly paused while NetChoice seeks Supreme Court review. Together, these cases suggest appellate courts are growing more receptive to state efforts to regulate how platforms handle younger users, even as the underlying constitutional questions remain open.

NetChoice's litigation director, Paul Taske, said the group was "disappointed" but emphasized that the court "notably did not hold that SB 351 is constitutional," signaling further challenges ahead. Georgia Attorney General Chris Carr's office called the decision "a major win for Georgia families." Both characterizations are accurate in their own way: enforcement is live, but the deeper legal fight - over speech, verification mandates, and platform liability - is only beginning its next phase in the Northern District of Georgia.