Threat BriefJul 31, 2026

Texas Didn't Lose Age Gates. It Lost the Filter Mandate

The Fifth Circuit left Texas a narrower kids-online machine: §230 still blocks state content filters on this posture, while age registration, Discord's agreed injunction, Play Age Signals, and New York's Part 700 clock keep building the who-are-you layer.

Age verificationSection 230Digital identity

Kyber Intel title treatment over Fifth Circuit opinion pages: Texas didn't lose age gates; it lost the filter mandate. — Documentary title treatment built from the Fifth Circuit's July 24, 2026 published opinion in the consolidated SCOPE Act appeals. Court opinions are U.S. government works.

Both sides declared victory. That is usually the tell that the real machine survived.

On July 24, 2026, the U.S. Court of Appeals for the Fifth Circuit decided the consolidated preliminary-injunction appeals over Texas H.B. 18 — the Securing Children Online through Parental Empowerment Act, codified at Texas Business and Commerce Code chapter 509. Industry coverage on July 30 then did what industry coverage does: NetChoice cheered a free-speech win; Texas Attorney General Ken Paxton cheered child-protection continuity.

Read the opinion, not the press releases. The panel did not free teenagers from identity infrastructure. It told the state it cannot draft platforms into a §230-preempted speech-filter bureau — while age registration, age-verification precedent, Discord’s agreed temporary injunction, Google’s Play Age Signals, and New York’s certified age-assurance rule keep building the who-are-you layer underneath.

If you only cheer the NetChoice headline, you will miss the gate that actually scaled.

What the Fifth Circuit actually held

The cases are Computer & Communications Industry Association; NetChoice, L.L.C. v. Ken Paxton (No. 24-50721) consolidated with Students Engaged in Advancing Texas et al. v. Ken Paxton (No. 25-50096). Opinion by Circuit Judge Dana M. Douglas, joined in the judgment structure by the panel; Judge James C. Ho concurs in part and dissents in part. Filed July 24, 2026. Appeal from the Western District of Texas, Nos. 1:24-CV-849 and 1:24-CV-945.

Four-card summary of the Fifth Circuit holdings: SEAT standing failure, age-verification foreclosure, §230 filter preemption, and no broader constitutional reach.

Kyber summary card derived from the published opinion. Not a court exhibit. Read the PDF for operative language.

The majority’s own roadmap:

SEAT plaintiffs lack standing to challenge the monitoring-and-filtering, targeted-ads, and unlawful-ads requirements.
SEAT’s age-verification challenge is foreclosed by precedent — Free Speech Coalition, Inc. v. Paxton, 606 U.S. 461 (2025).
The monitoring-and-filtering requirement challenged by CCIA and NetChoice is preempted by Section 230 of the Communications Decency Act, 47 U.S.C. § 230(c)(1).
Because §230 resolves that piece, the majority declines to reach the broader First Amendment constitutional issues presented.

Disposition language is blunt: the court AFFIRMS the district-court order as to CCIA and NetChoice, and VACATES the district-court order as to the SEAT plaintiffs and REMANDS.

Documentary crop of the Fifth Circuit disposition language affirming as to CCIA/NetChoice and vacating/remanding as to SEAT.

Source: U.S. Court of Appeals for the Fifth Circuit, published opinion filed July 24, 2026, Nos. 24-50721 & 25-50096. Government work. Cropped for readability; full PDF linked in Sources.

That is a preliminary-injunction appeal, not a final merits wipe of every clause in H.B. 18. Do not upgrade it.

Three different “age” duties — stop merging them

H.B. 18, effective September 1, 2024 per the opinion, piled several duties onto covered “digital service providers.” The litigation carved them into separate boxes. Kyber keeps those boxes separate on purpose.

Duty	What the court says it is	What happened in this appeal
Age-registration	Users must register their ages before creating accounts on covered social-style services	District court did not enjoin it; SEAT had not shown it independently prohibited speech. Still litigation-live as a non-enjoined piece.
Age-verification	If more than one-third of a service’s material is “harmful material or obscene” under Texas law, verify users are 18+	SEAT challenge foreclosed by Free Speech Coalition; majority did not need a fresh full constitutional rewrite here.
Monitoring and filtering	Covered DSPs must implement a strategy to prevent known minors’ exposure to listed harm categories (self-harm, eating disorders, substance abuse, grooming, bullying, etc.)	Preempted by §230(c)(1) as challenged by CCIA/NetChoice; injunction of this duty affirmed.

Those are not synonyms. “Age gate” is marketing. The architecture is registration, verification, and content policing — three different control surfaces.

The §230 holding in plain English

The majority treats the filter duty as a requirement that forces platforms to monitor, screen, and delete third-party content under state-set categories. Under Fifth Circuit §230 doctrine, claims that treat a service as the publisher/speaker of someone else’s information — including duties that necessarily require monitoring, altering, or removing third-party content — are preempted.

The Attorney General argued H.B. 18 just creates “comply with the statute” obligations, not liability for specific harmful posts. The panel rejected the idea that states can re-encode publisher duties as affirmative statutory checklists and walk around §230. As the majority puts it in substance: unlike audience filtering, this requirement is about filtering content.

Judge Ho’s partial dissent is the opposite theory and should be labeled as such. He would vacate the entire injunction. He argues SCOPE regulates curation — the platform’s own first-party speech about how feeds are built — not liability for third-party posts, so §230 should not preempt. That is a live intellectual fight. It is not the holding.

What Free Speech Coalition does and does not do here

Free Speech Coalition v. Paxton, 606 U.S. 461 (2025), upheld a pornography-site age-verification regime under intermediate scrutiny in that context. The Fifth Circuit treats the SEAT age-verification challenge as foreclosed by that precedent; the opinion notes appellees did not oppose on the point.

That is not a silent upgrade to “every social media age gate is constitutional forever.” It is a foreclosure ruling on the challenge before this panel. Anyone spinning it into a blank check for universal identity checkpoints is doing politics, not reading.

The dual-spin day is the incentive map

Biometric Update’s July 30 write-up captured the theater. NetChoice’s Paul Taske called the filter block a win for Texans who think government has “no business deciding what they can read, watch, and say online.” Paxton’s side pointed at the Discord temporary injunction and the continuity of age-registration pressure.

Both can be partially true without either being the whole story:

NetChoice honestly won on state-drafted category filters under §230 — for now, on this posture.
Paxton honestly retained runway on age-status infrastructure and a separate agreed injunction against a major platform.
Neither spin proves children are safer, speech is freer, or anonymity survived.

The stack that kept moving while lawyers argued filters

Age-control stack map: Fifth Circuit SCOPE posture, Texas chapter 509, Discord TI, Play Age Signals, and NY Part 700.

Kyber analysis diagram from primary sources listed below. Not legal advice. Status as of July 31, 2026 package.

Discord — agreed temporary injunction, 90-day clock

On the same calendar day as the opinion, the Texas Attorney General’s office announced an Agreed Temporary Injunction requiring Discord to give Texas users the same age-assurance and default safety protections Discord already provides in the United Kingdom, with 90 days to turn them on for every Texas user.

That release is primary for the existence claim and the OAG’s narrative. It is not a substitute for the signed order. Kyber has not attached the TI PDF in this package. Exact definitions, exceptions, audit rights, and technical mandates stay qualified until that order is on file. Day-90 arithmetic from a July 24 start lands around late October 2026 — track compliance receipts, not vibes.

The OAG’s hearing stories and NCMEC volume figures are advocacy exhibits. They can be true, false, or incomplete as individual facts; they do not convert an agreed injunction into a constitutional theory of the internet.

Google Play Age Signals — the OS/store middleman

Google’s first-party developer documentation for Play Age Signals states the API began returning age signals for users in Brazil on March 17, 2026 (Digital ECA), and for eligible Texas users who created accounts after May 28, 2026 as part of compliance efforts for Texas SB 2420. Google promises “ongoing updates” ahead of other U.S. state bills.

Purpose limitation language in the same docs matters: apps may use the API to provide age-appropriate experiences in compliance with laws, and may not use it for advertising, marketing, user profiling, or analytics. The client library claims it collects no data itself. That does not make the Play account, Play integrity stack, or store update channel disappear. It means the age signal is a mediated dependency: your app’s “are you old enough?” answer increasingly routes through a platform that already knows too much about the device.

This is how identity creeps without a dramatic national digital-ID bill. The store becomes the passport office.

New York Part 700 — certified age assurance on a clock

New York’s Office of the Attorney General published implementing rules for the SAFE for Kids Act as Part 700 of Title 13 NYCRR. The OAG rule page and the rule PDF define accuracy floors for age-assurance methods, certification by accredited third parties, addictive-feed limits, nighttime notification limits, appeals, and data-use constraints.

Section 700.11 is the clean clock: the Part takes effect on the 180th day after publication in the State Register. If that publication date is July 29, 2026, arithmetic yields January 25, 2027. Confirm the Register issue before treating the calendar day as locked. The architecture does not wait on Texas drama either way: New York is productizing certified age assurance with numeric false-positive ceilings.

Filters were always the loud fight. Certified age status is the quieter procurement market.

Who benefits

State AGs get a durable enforcement story even when §230 knocks out content-category mandates: force age status, default “safety” configurations, and platform process changes via injunctions and sister-state rules.

Platform coalitions get to claim a free-speech win on filters while still building compliance rails that satisfy the next statute. §230 becomes the shield for feed policing discretion; age APIs become the olive branch to regulators.

Age-assurance vendors get a multi-state product roadmap. Accuracy floors and accredited certification are a business model with a moral vocabulary.

App stores and OS vendors become unavoidable intermediaries. If your distribution depends on Play, the age signal is not a boutique experiment — it is infrastructure.

Users who need anonymity — journalists, abuse survivors, dissidents, people in hostile households, anyone who should not need a permanent identity dossier to read — eat the residual risk. The child-protection slogan does not ship a narrow warrant. It ships a gate.

What this does not prove

It does not prove H.B. 18 is dead.
It does not prove every remaining Texas duty is unenforceable.
It does not prove social-media age verification is universally constitutional.
It does not prove Discord’s exact technical buildout from an OAG press release alone.
It does not prove Play Age Signals is a government ID wallet.
It does not prove New York’s calendar effective date without the State Register cite.
Judge Ho’s dissent is not the law.

Evidence boundary

Publication-ready for: the Fifth Circuit’s July 24, 2026 disposition; the §230 preemption holding on monitoring/filtering as to CCIA/NetChoice; SEAT standing failure on the listed counts; foreclosure of the SEAT age-verification challenge with the Free Speech Coalition pornography-site scope caveat; district-court non-injunction of age-registration as described by the opinion; Texas OAG’s claim that an agreed Discord TI with a 90-day clock exists; Play Age Signals Brazil/Texas activation sentences and purpose limits as stated in Google’s developer docs on capture; NY Part 700’s 180-day effective-date formula and certified age-assurance architecture from the OAG rule text.

Not publication-ready as: a final merits wipe of SCOPE; universal constitutional approval of social age gates; detailed Discord injunctive terms without the order PDF; a locked January 25, 2027 NY effective date without Register publication proof; any claim that anonymity tools are criminal; any how-to for evading lawful process.

Vendor and agency position

Fifth Circuit majority: §230 blocks the state filter mandate challenged here; SEAT’s PI package does not stand as entered; age-verification challenge is foreclosed for these plaintiffs; no need to decide the bigger First Amendment theory once preemption resolves the CCIA filter issue.

Judge Ho (partial dissent): would vacate the entire injunction; SCOPE regulates curation standards (first-party), not third-party publication liability.

NetChoice (via secondary coverage): filter injunction is a free-speech win; government should not decide lawful speech categories for Texans.

Texas OAG: child-exploitation enforcement framing; agreed Discord TI requiring UK-style age assurance and default safety in 90 days; continuity pressure on age-status duties.

Google Play: Age Signals API for legal compliance and age-appropriate experiences; activated for Brazil and eligible post-May-28-2026 Texas accounts; purpose-limited against ads/profiling in the developer docs.

NY OAG: Part 700 implements SAFE for Kids with certified age-assurance methods, addictive-feed and nighttime-notification limits, and a Register-tied effective date.

Practical exits

None of this requires cosplay. It requires reducing how much of your life depends on one age ritual.

Own the audience path. Domain, email list, RSS, payment relationship that is not a single app-store account. If a platform adds a harder gate tomorrow, your business should still have a door that is yours.
Prefer services that publish non-government-ID methods when any age method is required — and treat every upload as potentially retained metadata even when the vendor swears the selfie is deleted.
Assume Play Age Signals is a dependency if you ship on Play. Prefer lawful sideload/F-Droid/Graphene-style distribution where your threat model and local law allow; do not confuse “client library collects nothing” with “Google knows nothing.”
Turn off addictive ranking where the product still lets you. Chronological follows and notification discipline are partial exits from the feed-design fight New York is regulating directly.
Do not confuse predator enforcement with universal ID. Kyber’s line stays fixed: target suspected crimes with warrants, evidence, and due process. Do not accept permanent identity linkage for everyone as the price of admitting that predators exist.
Track the clocks. Discord day-90 receipts; NY Register publication; en banc or cert activity in Nos. 24-50721 and 25-50096; DSP compliance banners that quietly rewrite signup flows.

The filter mandate was the noisy statue. The age-status layer is the plumbing. Plumbing is what still works when the statue loses an arm.