Kansas Senate Bill 394

Regulation Summary

Timeline

March 5, 2024 – Kansas Senate Bill 394 was passed by the Senate.
April 23, 2024 – Passed by the House of Representatives.
July 1, 2024 – The law took effect, requiring all applicable websites to comply with age verification mandates.

What Businesses Are Affected

Commercial entities that knowingly share or distribute material harmful to minors and where such material appears on 25% or more of the webpages viewed in a calendar month.
Third-party age verification providers ensuring compliance with the Act.

Exemptions

Internet service providers (ISPs) and users of interactive computer services – The law does not impose obligations or liability on ISPs or users of interactive computer services.
Third-party age verification providers – As long as they do not retain identifying information after verification is completed.

Responsibilities for Businesses

Implement a Reasonable Age Verification Method, such as:
- A commercially available database regularly used for age and identity verification.
- Any other commercially reasonable method of age and identity verification.
Ensure secure data handling by preventing retention of personally identifiable information beyond verification.
Restrict access to minors by blocking entry to age-restricted content.
Prevent circumvention of age verification methods.

Specific Responsibilities for Website Owners

Verify user age before granting access to restricted content.
Prevent minors from accessing harmful material through secure verification methods.
Ensure compliance with data privacy laws by not storing personally identifiable verification data.
Use commercially reasonable security measures to protect user information.

Additional Requirements

Websites must clearly disclose their age verification policies.
Age verification providers must comply with security and data protection standards.
Websites must ensure that user data is not retained after access is granted.

Individual Rights

Right to Data Protection: Individuals’ personal information used for age verification must be protected and not retained beyond verification.
Right to Seek Damages: Individuals may seek damages if their verification data is improperly stored or mishandled.
Parental Legal Action: Parents or guardians have the right to take legal action if a minor accesses restricted content due to non-compliance with age verification requirements.

Enforcement

Enforced by the Kansas Attorney General, who may investigate violations and bring an action for injunctive relief to stop any ongoing non-compliance.
Civil penalties between $500 and $10,000 per violation may be imposed on non-compliant businesses.
Each instance of a minor accessing a website without verification constitutes a separate violation.
Private Right of Action: Parents or legal guardians of minors who accessed harmful content without verification may file lawsuits against non-compliant businesses.
They may seek:
- Actual damages for harm caused by a minor’s access to restricted content.
- Statutory damages of at least $50,000 per violation.
- Reasonable attorney fees and costs.
Businesses that retain identifying information after verification may also be held liable for damages, including attorney fees and costs.