Age verification laws
Multiple jurisdictions are implementing age verification (AV) for adult content. This guide explains the major regimes, the technical methods used, and what they actually require — for users and for platforms.
UK Online Safety Act (2023)
The UK's Online Safety Act passed in October 2023 and is being implemented in phases through 2025-2026. Adult content platforms operating in the UK must implement "highly effective" age verification — defined by Ofcom guidance as methods that are technically robust, reliable, fair, and accurate.
Permitted methods include: government ID upload, credit card verification, face-scanning age estimation, mobile-carrier verification, and third-party verification services. The law does not mandate specific methods — platforms choose how to comply.
Enforcement is by Ofcom with fines up to £18 million or 10% of global revenue. Reference: Online Safety Act 2023.
US — state by state
The US lacks federal age-verification legislation. State laws are spreading rapidly. As of 2026, states with active AV laws include:
- Louisiana (2023) — pioneering implementation, government ID required.
- Texas (2023) — challenged in court, eventually upheld by Supreme Court (2025).
- Virginia (2023), Mississippi (2023), Arkansas (2023)
- Utah, Montana, North Carolina, Indiana — implementations active or pending.
State implementations vary in: required methods, liability structure (platform vs. ISP), exempt content thresholds (often "more than 33⅓% adult content"), and enforcement mechanisms. Many major platforms have chosen to block access in the strictest states rather than comply.
EU Digital Services Act
The DSA (Regulation 2022/2065) applies to all platforms serving EU users, with stricter requirements for "very large online platforms" (VLOPs — those with 45M+ EU users). Specifically:
- Platforms must implement risk-based age verification proportionate to harm.
- VLOPs face additional audit and transparency obligations.
- Pornhub, XVideos, and Stripchat were designated as VLOPs in 2023.
- Implementation is ongoing; specific AV standards being developed.
How verification actually works
Government ID upload
User uploads photo of government ID; platform or third-party service verifies authenticity and age. Strong on verification accuracy, weak on privacy unless combined with verify-and-discard practices.
Credit card verification
Card-network rules require credit cards be issued only to 18+ users (in most countries). A successful card charge thus proves adult age. Used by many subscription platforms. Limits: not all adult users have cards; doesn't prove the user is the cardholder.
Face-scanning age estimation
Algorithm estimates age from a brief facial scan. Privacy-preserving in principle (no ID required, scan can be discarded), but accuracy and bias concerns persist. Used by Yoti and other vendors.
Third-party verification services
Services like Yoti, AgeChecked, and OneID maintain verified accounts that users authenticate against multiple platforms with. Privacy advantage: ID stays with the verifier, not the adult platform. Adoption slow but growing.
Mobile carrier verification
UK mobile carriers verify age at SIM purchase; sites can ping carrier API to confirm age. Privacy advantage: no ID upload to the site. Limited to UK implementation.
Privacy implications
Centralized verification (each site stores IDs) creates aggregation risk — a breach exposes high-volume identity data linked to adult-site activity. Distributed verification (third-party services, ID hashes only) is materially better privacy-preserving but less common in early implementations.
Users in jurisdictions with strict laws sometimes use VPNs to access sites through other countries' implementations. This is not legal advice — VPN use to bypass jurisdictional law has varying status by country.
What platforms are doing
- OnlyFans: Mandatory ID verification at signup since 2021.
- Pornhub: Compliance varies by state; blocked in several US states rather than comply.
- Cam platforms: Most implement performer-side verification rigorously; user-side varies by jurisdiction.
- Smaller platforms: Many migrate away from regulated jurisdictions rather than comply.
Where this is going
AV regimes are spreading rapidly globally — Australia, Canada, and several Asian countries are considering similar laws. The technical landscape is consolidating around third-party services rather than per-site ID upload. Privacy implications remain contested, and major platforms are unlikely to fully comply with every jurisdiction's rules.
Sources
- UK Online Safety Act 2023
- Ofcom — UK communications regulator
- EU Digital Services Act (Regulation 2022/2065)
- Free Speech Coalition v. Paxton (Supreme Court, 2025) — US AV constitutional challenge
Frequently asked: age verification
Why are age verification laws spreading now?
Two reasons: rising political concern about minors' access to online adult content, and improved technical feasibility of verification (digital identity infrastructure, third-party verification services). The UK, US states, and EU are all moving toward harder verification regimes — though the technical and privacy implementations vary enormously.
Do age verification laws actually keep minors out?
Mixed evidence. Determined minors use VPNs to bypass jurisdictional rules and less-regulated platforms. Studies of the UK's phased implementation will provide more data over the coming years. The verification effort certainly affects adult users, who face friction and privacy costs.
Will my ID be stored permanently?
Depends on the verification method. Centralized ID-upload systems store data; "verify-and-discard" systems don't. The UK's approach permits multiple methods including third-party services that don't share data with the platform. The US state implementations vary — some require platforms to log verification events for compliance audits.
Why are major platforms blocking access in some US states instead of complying?
Compliance is technically complex (state-by-state implementations vary), legally risky (privacy law conflicts), and reputationally costly (perceived as legitimizing the law). Pornhub blocked access in Utah, Texas, Louisiana, and several other states rather than comply. Some platforms comply; some block; some run partial implementations.