§49A-1-102. Reasonable age verification methods.

(a) A commercial entity that knowingly and intentionally publishes or distributes sexual material harmful to minors on an Internet website or application, or a third party that performs age verification under this article, shall in order to prove that an individual is 18 years of age or older require an individual to:

(1) Provide digital identification; or

(2) Comply with a commercial or governmental age verification system that verifies age using:

(A) Government-issued identification which may be digital identification; or

(B) A commercially reasonable method that relies on public or private transactional data to verify the age of an individual.

(b) A commercial entity, or third party, that performs the required age verification shall not retain any identifying information of the individual after access has been granted to the material: Provided, That nothing in this subsection shall be interpreted to require the deletion of data that was otherwise held or obtained by a commercial entity or third party, which the commercial entity, or third party, held prior to the age verification or which is, or was, otherwise held by a commercial entity, or third party, and was not gained or compiled as a part of the age verification process.

(c) A commercial entity, or third party, shall implement best practices to comply with the current standards of the National Institute of Standards and Technology to limit the amount of personally identifiable information transferred between entities while effectively accomplishing the age verification requirements of this section.

(d) A commercial entity shall not publish or distribute material that the entity knows is obscene, or material that the entity knows depicts, describes, or promotes child pornography, on the Internet or via an application.