The state should handle personal records, authentication, and age verification. Compliance should be as simple as implementing dead simple state provided interfaces.