Kansas requires age verification for certain online content and products under Senate Bill 394 (2024), which took effect July 1, 2024. If you sell age-restricted products or operate a website with mature content and serve Kansas customers, here’s what the law actually requires — not just that it exists.
Selling age-restricted products in Kansas? Most payment processors treat that as high-risk by default. See how ConvesioPay supports regulated and high-risk merchants →
What Senate Bill 394 Actually Requires
SB 394 requires any commercial entity operating a website where 25% or more of the content is “material harmful to minors” to verify that visitors are 18 or older before granting access. The “harmful to minors” standard draws on Kansas’s existing obscenity statute (K.S.A. 21-6401), which asks whether material appeals to a prurient interest in sex under community standards, is patently offensive by those standards, and lacks serious literary, artistic, political, or scientific value for minors.
The law does not mandate a specific verification method. It allows any of the following:
- A commercially available database regularly used for age and identity verification
- Any other commercially reasonable verification method
- A method expressly approved by the Kansas Attorney General
Data Handling Requirements
The law is specific about what happens to verification data after the fact: a commercial entity or third party performing age verification cannot retain any identifying information after access has been granted. A business found to have knowingly retained that information is liable to the individual for resulting damages, including attorney fees and court costs.
Enforcement and Penalties
SB 394 carries two separate enforcement tracks:
- State enforcement. The Kansas Attorney General can pursue civil penalties of $500 to $10,000 per violation — and each instance of granting access without proper verification counts as a separate violation.
- Private right of action. A parent or guardian of a minor who accessed the content can sue directly, with statutory damages of no less than $50,000, plus attorney fees and costs.
The law explicitly does not impose liability on internet service providers or users of an interactive computer service — the obligation sits with the commercial entity operating the site.
Who This Applies To
The law applies to any commercial entity meeting the 25% content threshold, regardless of where the business is physically located — Kansas’s law reaches out-of-state companies transacting with Kansas residents, not just Kansas-based businesses. Several major adult sites responded to the law by blocking Kansas traffic entirely rather than implementing verification.
Beyond adult content specifically, the same underlying principle applies to any online seller of age-restricted products — alcohol, tobacco, vape products, and similar categories carry their own age-verification expectations under separate state and federal rules, even where SB 394’s specific 25%-content threshold doesn’t apply.
What This Means for Your Business
If your site meets the content threshold, or if you sell age-restricted products to Kansas customers more generally, you need:
- A working age verification method — one of the three routes above
- A process that doesn’t retain verification data after access is granted
- Documentation of your verification approach, in case of an inquiry
Age verification requirements like this one also tend to push businesses into “high-risk” payment processing categories by default, regardless of whether the underlying product itself is legal to sell. That’s a separate compliance track from the age-verification law itself, but the two frequently arrive together.
Need a payment processor that already works with age-restricted and regulated merchants? Talk to the ConvesioPay team →