In a blog post on Friday, Bluesky said the law’s requirements would force them to “collect and store sensitive personal information from all users, not just those accessing age-restricted content.”

After a user is identified as under 18, the company said it would have to begin “detailed tracking of minors” to stay compliant, essentially monitoring what they’re doing on the platform at all times.

That is an extraordinary demand for a law pitched as protecting children from the dangers of social media. Instead of shielding teens, the law risks building a system that requires constant observation of their digital lives.

Bluesky, which runs a decentralised social platform using its AT Protocol, said the demands were incompatible with its privacy-first design and beyond the capabilities of its small team. Rather than risk $10,000 per user fines, the company decided to geoblock all Mississippi IPs and wait for the courts to figure it out.

Some Bluesky users outside Mississippi got swept up in the mess when their mobile traffic routed through the state, but the company says it is working on a fix.

Meanwhile, the law is still working its way through the courts. A federal judge originally blocked it, siding with NetChoice, a tech trade group that represents Google, Meta and others, but an appeals court overturned that decision. A last-minute attempt to halt the law failed at the Supreme Court, although Justice Kavanaugh openly suggested the law is probably unconstitutional.

Whether or not lawmakers realised what they were doing, the law now effectively requires every platform to become a data-hungry surveillance system, not just checking IDs but keeping detailed logs of what minors do online. Bluesky was not having it. Other platforms may eventually follow if the law remains on the books.