Porn ID Laws: Your State or Country May Soon Require Age Verification

For the past three months, anyone who lives in Louisiana and opens up Pornhub has been met with a new prompt. The state’s laws, it says, require people who want to watch pornography to prove they are over 18. People seeking to access Pornhub are directed to a government-linked site where they can provide their ID. The move is the result of new laws designed to stop children from seeing explicit content. But it is just the beginning—the online age-verification industry is heating up.

Since January, three other states across the US—Mississippi, Virginia, and Utah—have copied Louisiana’s approach, passing their own versions of age-verification laws. Another 11 states, from Virginia to California, have proposed laws that will require users to confirm their age before they can view pornography, according to recent analysis. Some of these regulations are slated to take effect in the coming months.

It’s not just a US phenomenon either. Across the Western world, efforts are underway to introduce more age checks online. Since 2020, regulators in Germany and France have pushed porn sites to check people’s ages, and the UK and Australia are developing their own laws. These follow the introduction of more stringent safety rules that protect children online.

The internet isn’t a child-friendly place. However, introducing age verification across the web is technical and complex. (In 2019, the UK ditched a multiyear plan to introduce age checks after encountering myriad problems). The porn we watch is also highly sensitive—kinks are incredibly personal, and leaks of data online can be devastating. Privacy advocates, porn companies, and some regulators say the move to introduce age verification introduces significant problems.

“The concerns about young people accessing adult websites are real and widespread; less widespread is the understanding of limitations of various age-verification tools, and of the new dangers they might pose,” says Irina Raicu, director of the Internet Ethics Program at Santa Clara University’s Markkula Center. “Many regulators and others seem to think of age verification as a solved problem; technologists and privacy activists, including activists focused on protecting children, are trying to explain that’s not the case.”

For years, the only thing stopping people from accessing porn online has been small checkboxes: Are you over 18? Yes or No? However, legislation proposed around the world would add more robust checks. Dozens of online age-verification companies have cropped up, with multiple ways to prove you’re old enough to access sites.

Your age can be confirmed by credit card details, scans of your face, or, as is often proposed, checks of government ID documents, such as passports or driver’s licenses. The checks can be carried out by third-party companies, without sensitive information being passed directly to porn sites. One briefing from the European Commission details nine different methods of age verification—some sophisticated, some very low tech.

“A lot of stuff is being passed,” says Mike Stabile, director of public affairs at the adult industry trade body the Free Speech Coalition. “In terms of the actual implementation and how it’s going to work—that’s much more mysterious.” The porn industry isn’t against age-checking everyone who visits its websites, Stabile says, but some laws are vague and don’t say how age verification should be implemented or whether all companies would be required to introduce the technology.

Take Louisiana. The state law requires websites with 33 percent or more adult content to check visitors’ ages when they access the sites from within that state. Stabile says some porn sites have introduced age checks, while “most have just blocked the state.” In both France and Germany, regulators have asked the biggest pornography websites to implement age verification in recent years and taken them to court when they haven’t done so. Germany has tried to block porn site xHamster and is now taking individual porn creators to court when they post adult content on sites that don’t have age verification, like Twitter.

“While there are multiple proposed laws on age verification throughout the world, we are not aware of any, thus far, that achieve their aim of protecting children from age-inappropriate material online,” says a spokesperson for MindGeek, the owner of Pornhub and other giant adult sites YouPorn and Redtube. They say that within Louisiana, MindGeek is one of a “small handful” following the laws and claim it has “pushed traffic to adult platforms with far fewer safety measures in place.”

“In order to achieve tangible outcomes and safeguard the interests of young people, it is imperative to regulate not just individual websites but the industry as a whole,” says Alex Hawkins, vice president of porn website xHamster. “Ensuring global standards uniformity is of vital importance, as applying varying regulations to each country or state would prove extremely difficult to implement and maintain.”

While lawmakers and regulators are pushing for age verification, that doesn’t mean people will use it. For widespread adoption, people wiould have to trust the systems. “Mandating that users must hand over more sensitive information about themselves than they previously did is fundamentally anti-private,” says Daly Barnett, a staff technologist at the Electronic Frontier Foundation. “Even if these systems were to work flawlessly and their security were perfect—which is never a safe assumption to make—it still goes against the basic privacy needs of the everyday internet user.”

Some regulators agree. France’s data regulator, CNIL, which is regarded as one of the most effective in Europe, has looked at the privacy of current age-verification systems and found them lacking. In July 2022, CNIL reviewed existing age verification measures and said they are “circumventable and intrusive.”

Instead, it is trialing a system in which a third party, such as a bank or energy supplier, authenticates a person’s identity and age. (This is not dissimilar to some efforts from third-party companies themselves.) Using cryptographic concepts, the system creates a digital signature that says someone is over 18, and this is then shared with the porn website. French officials said they plan to introduce a government app that allows this to work.

Simone van der Hof is a professor of law and digital technologies at Leiden University in the Netherlands and has studied age-verification systems under Europe’s GDPR and found that they do not meet data rules. Van der Hof says all an age-verification system needs to do is say whether you are over 18. It doesn’t need all the details on your passport. Van der Hof points to a system in the Netherlands that works similarly to the one CNIL suggested and communicates whether you’re old enough to access a site.

“You then have an app on your phone that allows you to retrieve attributes from a trusted party,” van der Hof says. “You can then decide which attributes you share with which party (or which yes or no verification questions you answer with it).” Although, van der Hof points out, this still requires trusted third parties that can prove your identity. “Ideally, you would want to have a system where you can choose from a menu of age-verification providers like you can choose a bank when making an online payment,” van der Hof says.

But many people may not want their bank to confirm to a porn site that they’re over 18, even if it isn’t sharing personal information and is just providing approval—or they may not have the patience to go through that process when they’re in the mood to access adult content. And even if age-checking systems can be successfully introduced, finding ways around them isn’t necessarily difficult. Reddit, Twitter, and other social media sites are often not included in laws mandating age verification on porn sites, despite porn being readily available on them. VPNs and the anonymity service Tor can help people get around one state or country’s specific rules. Research from the University of Munich has found that while young people regularly access porn, they are also very aware of VPNs and know how to use them.

Whatever tech issues the porn industry encounters, the rest of the internet usually follows. As governments around the world look to improve safety online, ID walls are popping up elsewhere. The UK’s controversial online safety bill may require social media companies to verify people’s ages, and France’s age-verification measures also sweep up social media. Google can require age verification to use YouTube and its other services. In Japan, people are required to provide documents showing they are old enough to use Tinder. Instagram is using age estimation based on video selfies, the word of your friends, and ID documents. On the internet, nobody knows you’re a dog—but your age is about to become another story.