When the Age Gate Is Just a Checkbox, the Liability Is Yours

An adults-only business puts a friendly assistant on its website. A visitor clicks the box that says they are 18 and asks to be let in. A little later, someone else opens the chat, mentions almost in passing that they are still in high school, and keeps asking questions anyway. The assistant answers both. The first visitor gets pointed inside on the strength of a single click. The second keeps getting replies. It reads like good service. It is not. Age-restricted commerce is one of the few corners of the web where helping the wrong person is itself the liability.

These businesses sit under rules most websites never touch. State age-verification mandates. A federal record-keeping regime. The platform immunity that FOSTA cut back. A general-purpose chatbot knows about none of this. To it, an adults-only storefront is just another store, so it answers every question with the same easy confidence, including the ones it should have refused outright.

A Clicked Box Is Not Age Verification

For years the age gate was a button. That standard is collapsing. More and more states now require verified proof of age before a visitor can reach adult content, and a typed "yes" does not satisfy those laws. The Supreme Court underscored where this is going in 2025, when it upheld one such state mandate in Free Speech Coalition v. Paxton. An assistant that walks a visitor past the gate on a self-reported age does the one thing those laws were written to prevent. There is a second problem, too. If your site tells visitors it verifies age while a bot quietly lets anyone through, that gap between the claim and the practice is the sort of deceptive act the FTC polices under Section 5.

The Assistant That Keeps Talking to a Minor

The more serious failure involves a child. A visitor lets slip that they are under 18. What should happen next is a full stop. End the conversation. Route to nothing. A general chatbot does the opposite, because its whole purpose is to keep things moving, so it answers on, now and then even spelling out how someone might get in. That exchange has no good ending for the business. A system that cannot catch and refuse a minor, every time and however the age comes up, does not belong on an adults-only site.

FOSTA Narrowed the Cover You Used to Have

Operators used to assume Section 230 shielded them from what users typed and what an automated tool said back. FOSTA changed that math. The law added an exception, so Section 230 immunity no longer extends to content that promotes or supports prostitution or sex trafficking. Federal trafficking law, separately, already reaches anyone who knowingly benefits from such a venture. Now picture an assistant that engages with a solicitation or plays into a request it should have refused. It is producing the precise kind of content the carve-out was built around. The bot does not understand the line. The company is still standing on the wrong side of it.

"Will Not" Is a Suggestion. "Cannot" Is an Architecture.

The instinct is to write the rules into the assistant. Never admit anyone who has not verified. Never continue with a minor. Never touch an illegal request. That reads like a boundary. It is not, because the model handles a reworded question on its own terms.

You instruct it to refuse minors. The trouble is that a visitor rarely announces an age. They mention a curfew, or a parent who might see the screen, or a class they have in the morning. The model hears context, not a trigger, and keeps going. Being helpful is its default, and nothing in that sentence matched the warning it was given. The rule was loaded the whole time. The phrasing simply walked around it, and a disclaimer at the bottom of the chat retracts nothing the assistant already said.

Who Answers for It

Strip away the software and the exposure is familiar. A new clerk who let an unverified visitor into the back room, kept chatting with an obvious minor, and went along with an illegal request would be a serious problem on the first shift. The website assistant doing those same things is no different, except now there is a written transcript, no person in the loop, and a body of age-verification, record-keeping, and trafficking-related law that governs exactly those moments.

The businesses that get burned are not the ones that added an assistant. They are the ones that dropped a generic chatbot onto a regulated, age-restricted business and assumed friendly meant safe. The fix is not to pull the assistant. It is to run one that answers ordinary questions about a lawful adults-only business and refuses, by design, to verify age on a click, to engage a minor, or to entertain an illegal request.

Frequently asked questions