But they do have authority over the domain registrar, so you’re vulnerable there no matter where you live.
I don’t agree with the premise of age verification, but of course a prosecutor would go after the assets they can reach if enforcing local laws. They’ve done this for years when it comes to copyright infringement.
> But they do have authority over the domain registrar
Why do you say that?
They do not
It's a huge overreach to say that any individual US state has authority over a domain registrar, and even more specifically over .COM as a TLD, given its history with VeriSign and the US federal government.
There exists a well defined process, precedent and prior case law in US federal court to seize a .COM domain name by a court order issued to VeriSign. Doing this at the state level is entirely new.