[jacobr1]

While this is generally true for any regulation ... for small businesses we do have one approach to address the problem of regulatory compliance: outsourcing to specialized firms. For example small sites can just use an identity provider (maybe something like AuthO presuming they add an age-verification module) which can be easily integrated.