Kansas Age Verification Law: SB 394 Requirements Explained

Kansas's age-verification law for adult content, Senate Bill 394, took effect July 1, 2024 and is codified at K.S.A. 50-6,146. It has drawn more litigation than any other state's age-verification law covered on this site, but every case so far has turned on jurisdiction or enforcement mechanics, not on whether the law itself is constitutional.

What Kansas's Age-Verification Law Requires

Senate Bill 394, enacted during Kansas's 2024 Regular Session as 2024 Kan. Sess. Laws chapter 28, took effect July 1, 2024 and is codified at K.S.A. 50-6,146. Its operative rule, quoted from the Kansas Revisor of Statutes, reads:

Any commercial entity that knowingly shares or distributes material that is harmful to minors on a website and such material appears on 25% or more of the webpages viewed on such website in any calendar month, or that knowingly hosts such website shall verify that any person attempting to access such website, who is a resident of this state or who is located in this state at the time of such attempted access, is 18 years of age or older.

The 25 percent of webpages-viewed-per-month formula is a different test than the roughly one-third of total content threshold most other states use, so a site that would be covered elsewhere is not automatically covered in Kansas, and vice versa. The statute borrows Kansas's existing harmful-to-minors definition from K.S.A. 21-6402. It connects to the Kansas Consumer Protection Act in a specific and limited way: subsection (c) makes any violation an unconscionable act and practice under the KCPA, and subsection (d) says that for purposes of KCPA remedies the person alleging the violation is deemed a consumer, the violating entity is deemed the supplier, and proof of a consumer transaction is not required.

The Citation: K.S.A. 50-6,146, Not 21-6425

A citation for Kansas's age-verification law that circulated in earlier reporting, K.S.A. 21-6425, is wrong. Checked directly against the Kansas Revisor of Statutes' own site, section 21-6425 is titled Misuse of nonpublic sports information, a sports-betting insider-information statute with no connection to age verification.

The correct citation is K.S.A. 50-6,146, titled Distribution of material that is harmful to minors; age verification required, when; violation, unconscionable act and practice; penalties; private cause of action; definitions. The Revisor's history note for that section reads L. 2024, ch. 28, § 1; July 1, which ties it directly back to SB 394 as chapter 28 of the 2024 session laws.

What Actually Counts as Age Verification

The statute does not leave verification open-ended. Under K.S.A. 50-6,146(a), it must be conducted through either a commercially available database that is regularly used by businesses or governmental entities for the purpose of age and identity verification, or any other commercially reasonable method of age and identity verification.

That second option is narrower than it sounds. Subsection (h)(2) defines a commercially reasonable method of age verification as either a method expressly approved by the Attorney General, or a method certified in documented international standards for age verification as specified by the Attorney General. In practice that puts the Kansas Attorney General's office in the middle of deciding which verification vendors and techniques a covered site can rely on.

Self-attestation, the click-here-if-you-are-18 button, does not satisfy either branch.

The Data-Retention Rule Readers Should Know About

Age verification means handing over identity data, and Kansas addressed that directly. Subsection (f) prohibits a commercial entity, or any third party that performs the required age verification, from retaining any identifying information of the individual after access has been granted to the website. If a commercial entity is found to have knowingly retained that information, it is liable to the individual for damages resulting from the retention, including reasonable attorney fees and costs as ordered by the court. That is a second private remedy, separate from the parent-or-guardian action, and it belongs to the adult whose data was kept.

The statute's definition of identifying information is deliberately broad. It lists 21 categories, including name, home address, phone number, email address, criminal records, medical or health records, Social Security number, biometric information, disabilities, socioeconomic information, food purchases, political affiliations, religious information, text messages, documents, employment identifiers, search activity, photos, voice recordings, and geolocation information.

Who Is Not Covered

Subsection (g) is the carve-out that decides who falls outside the law entirely: nothing in the section may be construed to impose an obligation or liability on an internet service provider or on the user of an interactive computer service. The definition of host in subsection (h)(4) reinforces this, expressly excluding internet service providers from the hosting duty. So the coverage question is not only whether a site clears the 25 percent threshold; it is also whether the party in question is the commercial entity or host at all, rather than a conduit or an end user.

Enforcement: Two Tracks

Kansas enforces K.S.A. 50-6,146 through two separate mechanisms.

The Attorney General track runs through subsection (b). A person who was able to access a website without age verification may report the violation to the Attorney General, who then investigates and may bring an action for injunctive relief to stop a continuing violation. That action may also seek a civil penalty against the commercial entity of not less than $500 and not more than $10,000 for each violation. Two details matter and are easy to miss: the statute sets a floor as well as a ceiling, and it imposes that penalty instead of the penalty provided for in K.S.A. 50-636(a), the Kansas Consumer Protection Act's general civil-penalty provision. Subsection (b) also provides that each instance in which a website is accessed in violation of the section is a separate violation, so exposure scales with traffic rather than being capped at one penalty per site.

The private track runs through subsection (e). The parent or legal guardian of a minor who got in without verification may bring a private action against the commercial entity for actual damages resulting from the minor's access, statutory damages in an amount not less than $50,000, and reasonable attorney fees and costs. Subsection (e) makes that relief available notwithstanding the provisions of K.S.A. 50-634 and 50-636, so it displaces the ordinary Kansas Consumer Protection Act damages route rather than running through it.

Kansas Is the Most Litigated State in This Comparison, but the Statute Itself Has Not Lost

Kansas has drawn more filed cases against covered sites than any other state covered on this site, but none of them is a constitutional challenge to SB 394 itself. A minor, referred to as Q.R. in court filings, and a parent, represented with the National Center on Sexual Exploitation as co-counsel, sued Jerkmate.com, Superporn.com's operator Techpump Solutions, Chaturbate.com, and Titan Websites in the U.S. District Court for the District of Kansas, alleging more than 170 visits between August and October 2024 without effective age verification.

In March 2026, according to Kansas Reflector's reporting, U.S. District Judge Holly Teeter dismissed two of those suits, against Washington-state- and Canada-headquartered defendants, for lack of personal jurisdiction, a procedural ruling about where the defendants can be sued, not a ruling on whether SB 394 is constitutional. A third defendant's similar dismissal motion was denied, and the National Center on Sexual Exploitation voluntarily dismissed a fourth suit. This research could not independently reopen Kansas Reflector's reporting on the exact procedural details, so those specifics are described here as reported rather than independently confirmed.

Separately, Attorney General Kris Kobach sued SARJ LLC in Shawnee County District Court around January 2026, alleging SB 394 violations; that case was reported as ongoing, though this research did not independently reconfirm its current status.

What the Jurisdiction Dismissals Do and Do Not Mean

The March 2026 dismissals do not mean Kansas's law was weakened or struck down. They reflect a recurring practical problem in enforcing any state's age-verification law: many adult websites are incorporated or headquartered outside the United States or outside Kansas, and a court has to have personal jurisdiction over a defendant before it can rule on the merits of a case against it. A jurisdictional dismissal ends that particular lawsuit against that particular defendant; it says nothing about whether SB 394 itself would survive a constitutional challenge, and no such challenge has succeeded, or as far as this research found, even been filed.

Statutory text, penalties, verification methods, the retention rule and the intermediary carve-out on this page were read directly from K.S.A. 50-6,146 on the Kansas Revisor of Statutes' own site, and the 21-6425 correction was checked the same way, current as of 2026-09-02. An earlier version of this page said SB 394's codified K.S.A. section could not be located; that was wrong, and the Revisor's own entry for 50-6,146, with its L. 2024, ch. 28, § 1 history note, is the source that corrects it. The March 2026 personal-jurisdiction dismissal details and the current status of Attorney General Kobach's suit against SARJ LLC rest on reporting this research could not independently reopen and are described as reported rather than independently confirmed; recheck before treating them as settled.

Related Resources

• Age Verification Laws by State
• Texas Age Verification Law
• Indiana Age Verification Law
• Idaho Age Verification Law
• Mississippi Age Verification Law

---

Last updated: 2026-09-02.