A new Utah law intended to keep kids from accessing pornography and other kinds of “harmful material” online is raising critical questions about the First Amendment rights of young people and the privacy implications of checking IDs at websites’ proverbial doors.

Policymakers who pushed for the law say it will help protect kids from mental health issues and other risks that can arise from viewing certain kinds of material online. But what counts as “harmful,” exactly? The law is aimed at pornography, but it extends to virtually any commercial website with content that does not have “literary, artistic, political or scientific” value for minors and that makes up more than a third of all material on that site. With the law now in effect this month, anyone in Utah can sue violators if a minor accesses content on their website. Nonprofit-run sites, search engines and news-gathering organizations are exempt from liability.

Utah passed another law earlier this year to regulate minors’ access to social media platforms, which requires teens to get parental consent to use the platforms and prohibits them from using such platforms between 10:30 p.m. and 6:30 a.m. Research has shown that social media can be harmful to the mental health of young people. But age verification and time curfews might not be the best solutions to the problems that lawmakers have trained their focus on.

Heidi Tandy, a lawyer and First Amendment speech researcher, says it’s worrying that policymakers don’t consider kids’ rights. “It’s very clear that there is a sliding scale of First Amendment rights for those under the age of 18,” Tandy told me.

On Twitter, Electronic Frontier Foundation researcher Jason Kelley pointed out that while politicians tend to frame these laws as protection for children, they apply to everyone under the age of 18. He warned against “lumping in 10 year olds with seventeen year olds who can work, apply for emancipation, and drive.” Older teens are much more likely to seek out sexual content online — and have legitimate reasons to do so — than kids who are just nine or 10 years old.

Kelley suggested that the Utah law might end up pushing well past pornography to cover things like sexual education materials or fiction that includes sexual themes.

“The goal is often not just to remove or block what most of us would consider adult content, but go beyond that,” he told me. Kelley says advocates have “a certain reasonable fear that larger swaths of sites would be swept up in the law.”

“You’ve seen that, with definitions of what’s considered pornography or adult content in places like Florida, they’re removing books from libraries,” Kelley said, referring to recent legislation targeting books that are considered “sexually explicit” or that deal with gender identity, sexuality and related subjects.

Experts and adult film industry voices have also noted that these restrictions could send teens toward more obscure sites that parents or policymakers might not be aware of. This is a key argument that Pornhub makes, the Canada-based adult content site that consistently ranks among the most popular websites in the world. Earlier this month, Pornhub blocked access to videos on its site for all users based in Utah to show its opposition to the law. People in Utah who tried accessing the site were instead redirected to a video featuring adult film actress Cherie DeVille explaining the company’s objections to the law. Among other things, she noted that it could lead teens to sites with no protections against videos depicting things like sexual violence or child abuse.

There’s good reason to believe that rules like the one in Utah will soon spread to much of the U.S. The state of Louisiana was the first ever to implement this type of age verification law. A raft of similarly-worded age verification bills, what Kelley calls “copycat laws,” have been introduced in six states so far this year. All of these policies ostensibly require websites to introduce technical mechanisms for checking a user’s age before they can access that site’s content. Although the Louisiana law provides special guidance on this, Utah hasn’t established a standard for how sites should digitally verify a user’s age.

How should websites card their users, exactly? Utah recently implemented a pilot project for making driver’s licenses accessible on a mobile device that comes with an annual subscription cost. A digital ID works in tandem with a state’s motor vehicle administration, so it can be considered a valid form of identification for buying alcohol or other age-restricted products.

Louisiana, meanwhile, requires sites to use “commercial age verification systems.” And there’s a burgeoning industry waiting to serve sites in states with these requirements. Third-party services like FaceTec and Yoti offer biometrics-driven age verification software that websites can pay for, but this software can be costly to buy and maintain, making it difficult for small businesses to comply with the law.

All of the solutions on the table thus far raise significant concerns about the privacy of young people’s data. As Coda has reported in the past, using biometrics to verify someone’s identity or assess their age often requires sites to hold troves of personal data that can become vulnerable to breaches or even targeted abuse, harming users in the near term or for years ahead.

“People who want age verification laws have the best interest of teenagers at heart,” Tandy told me. But, she said, “I don’t think they’re thinking through the privacy ramifications of what they’re asking for.”