Adult entertainment industry sues again over law requiring pornographic sites to verify users’ ages

bnew

Veteran
Joined
Nov 1, 2015
Messages
69,293
Reputation
10,627
Daps
187,249

‘Scan your face’ laws for the web are having unexpected consequences​


The age-verification laws rapidly expanding across the United States and United Kingdom are bringing with them some surprising downsides, including bursts of traffic to seedy parts of the web.

August 31, 2025 at 7:05 a.m. EDT Today at 7:05 a.m. EDT

f7cf5ccc159cd23110c6a5f6ec1b47b74df0e481.avif
(Washington Post illustration; iStock)

By Drew Harwell

When the United Kingdom began requiring thousands of websites to verify their users’ ages last month, one group saw an enormous burst of traffic: pornography sites ignoring the law.

The sites that complied — by mandating that users show their government IDs or scan their faces through their webcams, so an algorithm could estimate whether they were adults — saw visits from British internet addresses collapse. But some of the biggest porn sites that disregarded the “scan your face” rule entirely have been rewarded with a flood of traffic, a Washington Post analysis found. Some have doubled or even tripled their audiences in August compared with the same time last year.

Federal and state lawmakers in the United States have pushed to enact similar age-verification laws — not just for porn, but for social networks and video sites, too — arguing that protecting children online warrants government-mandated ID or face scans for all users. Sen. Mike Lee (R-Utah) said the technology could help “stop those who profit from stealing the innocence of America’s youth.”

But tech and privacy experts have warned that the laws bring with them some unavoidable downsides, including potentially driving people to seedier corners of the web. John Scott-Railton, a researcher at the Citizen Lab at the University of Toronto who studies surveillance and digital rights, called the U.K. case “a textbook illustration of the law of unintended consequences.”

The law “suppresses traffic to compliant platforms while driving users to sites without age verification,” he said. “The more the government squeezes, the more they reward the very sites that scoff at their rules.”

In the U.S., 25 states have passed laws requiring age verification for adult websites since 2022, according to the Free Speech Coalition, a porn-industry group that has fought the laws in court. A tech-industry effort arguing the laws violate the First Amendment failed in June when the Supreme Court affirmed Texas’s law, which Justice Clarence Thomas said had “only an incidental effect on protected speech.”

ae85e8e5cb50a439dd8dedf85c486cf4c0ab600f.webp
Texas’s age-verification law for adult websites withstood a First Amendment challenge by the tech industry, a case in which Supreme Court Justice Clarence Thomas, above, called its effect on protected speech “incidental.” (Jabin Botsford/The Washington Post)

The proponents of “age assurance” laws like the U.K.’s Online Safety Act have likened the idea to requiring people to show their ID before stepping into a nightclub. The checks depend on a small group of private contractors, such as Yoti and Incode, that have developed artificial-intelligence software allowing people to prove their age on porn sites by flashing their driver’s licenses, consenting to a facial age analysis or sharing access to their bank or credit card accounts.

Supporters say such measures are a necessary corrective for a wild web. “Clicking a box that says ‘Yes, I am 18’ is not gonna prevent a 15-year-old boy from going on that website,” Ohio state Rep. Steve Demetriou (R), who proposed a similar law, told a local journalist in March.

But civil liberties advocates have warned that the systems require both children and adults to give sensitive information to scattered websites, exposing them to data breaches or misuse. And leaks already happen all the time: Tea Dating Advice, an app where women anonymously reviewed their dates with men, said last month that a cyberattack had exposed thousands of women’s selfies and driver’s license photos, which the site had requested to assure that its users were women.

Some activists have warned that the “censorship movement” could expand far beyond porn to “wall off huge sections of the internet, with the government as the sole gatekeeper,” as the privacy group Fight for the Future said in an online petition. In the U.K., the music service Spotify, the social networks Bluesky and X, the chat apps Discord and Telegram and the message-board giant Reddit have all begun checking some users’ ages through measures like face scans.

Companies seeking to comply with the law must pay for the age checks, whose costs can quickly climb; an Indiana judge said last year that one porn site, Pornhub, faced potential charges of more than $13 million a day. A Yoti representative said last year the company typically charges between 10 and 25 cents per face.

Those kinds of costs aren’t shouldered just by big tech companies. Red Passion, a volunteer-run message board for fans of the Wrexham soccer club in Wales, said it faced “substantial legal and operational burdens” in complying with the U.K. law “that are disproportionately difficult for small platforms like ours to manage.” Some sites have blocked access to the U.K. entirely.

The face scans themselves can bring their own risks, sometimes misclassifying adults as children and vice versa. One 25-year-old woman with dwarfism told The Post last year that her TikTok account had been banned after the app falsely flagged her as a child. And they can be fooled: On social media, guides have proliferated showing how to trick the systems using the faces of video game characters.
 

bnew

Veteran
Joined
Nov 1, 2015
Messages
69,293
Reputation
10,627
Daps
187,249
“It’s a lot more complex than showing your ID before you enter a pub,” said Aliya Bhatia, a policy analyst at the Center for Democracy and Technology, a Washington think tank that has received some funding from tech companies. She said the U.K.’s law “rests on two false notions: that there’s a silver bullet — an easy, rights-respecting, affordable way to do age verification online — and that users don’t care about their rights and privacy.”

e5af66bb5e4465718fa31af3de303896b5d8a202.avif
Pornhub’s compliance with age check laws could cost it more than $13 million a day, an Indiana judge said last year. (Leon Neal/Getty Images)

To evaluate the early effectiveness of the law’s rollout, The Post gathered U.K. visitor estimates over the past year for 90 of the largest porn sites as ranked by the market intelligence firm Similarweb. The Post then used a software tool known as a virtual private network, or VPN, to appear online as a U.K. user and check whether the sites verified a visitor’s age.

The analysis found that 14 sites didn’t do an age check, and that all 14 had seen major boosts in their traffic from U.K. users. One explicit site saw its U.K. visitor count double since last August, to more than 350,000 visits this month.

Even the sites attempting to comply with the law showed some odd or awkward results. Several sites showed explicit ads and thumbnail images, or allowed visitors to watch the first few minutes of its videos before prompting for their age.

Many of the sites voiced outrage at the law, linking to an unsigned porn-industry blog post on the “scam of age verification” that said lawmakers should push for better parental controls instead of “mass surveillance and regulatory theater.”

Other sites instructed users how to navigate around the age gate by, for instance, using a special browser called Tor, which was built to browse what’s known as the “dark web.” One site directed British users to sign a petition urging Parliament to repeal the law alongside the comment, “Ur gov is dumb.”

The Post shared its findings with the U.K.’s internet regulator, Ofcom, which declined to comment on individual sites. The agency said late last month that it had launched four investigations into porn companies over whether they had complied with the age-check rule, but only one of the 14 sites identified in The Post’s analysis was named in those cases.

An Ofcom spokesperson said the agency is monitoring daily user numbers for thousands of porn sites and added that certain indicators — including sites that saw huge swells of traffic or that encouraged circumventing the law — would play a role for investigators in deciding which companies to prioritize.

Ofcom representatives have met with officials in the adult-entertainment world — including at a porn-industry conference last year in Los Angeles, called XBIZ — in hopes of boosting compliance. The regulator has warned that it could impose penalties in the tens of millions of dollars on noncompliant sites and, in the most serious cases, forbid advertisers or internet service companies from working with the sites, effectively shutting them down.

The industry, however, remains divided over how well the law will work. Aylo, the owner of Pornhub, said in a statement last month that it believed in Ofcom’s “intent and ability” but that similar laws in other places were failing. Viewers who refuse to verify their age don’t stop looking for adult content, the company said; they just move on to more unmoderated and “irresponsible platforms.”

Some site owners have warned that copycat porn services that are “openly hostile to enforcement” will just mask their operations and multiply so they can sidestep regulatory action. A porn-industry blog post estimated that thousands of “clones” of their sites were already stealing their content and were “soon to be massively rewarded.”

Some sites have also vowed to fight the law in court. The anonymous message boards ***** and Kiwi Farms sued Ofcom in U.S. District Court for D.C. on Wednesday, saying the British regulator’s threats to fine the American companies violated their First Amendment rights to host content from users who declined to share their ages. “American citizens do not surrender our constitutional rights just because Ofcom sends us an e-mail,” Preston Byrne, a lawyer for *****, said in an emailed statement.

An Ofcom spokesperson said any service visited by a significant number of U.K. users must comply with the law, “no matter where in the world it is based.”

Several U.S. states have gone beyond targeting adult-content sites, passing age-check laws for users to access social media. Most of them are being challenged in court and have yet to take effect. The Supreme Court this month declined to block one of the more aggressive laws, in Mississippi, which demands that all social media platforms identify the name and age of any user in the state and get a parent’s permission for anyone younger than 18.

The state argued the law asked only for “efforts of reasonable care based on a platform’s resources,” but it has already led to its own ripple effects. Bluesky said last week it would block access to Mississippi users rather than shoulder the “substantial” age-check costs that “can easily overwhelm smaller providers.” Ashton Pittman, the editor of the Mississippi Free Press, a news outlet that had built a robust audience on Bluesky, wrote in a column that the move had severely undermined its ability to promote its reporting.

More laws could be on their way. Last month, South Dakota and Wyoming began requiring age verification for all websites hosting anything that could be deemed “harmful to minors,” a loose definition that the civil liberties group Electronic Frontier Foundation has warned could include Barnes & Noble and Netflix. Wyoming’s law, the group noted, also says parents can sue any website they think is violating the law, “effectively turning anyone into a potential content cop.”

In the U.K., officials have celebrated their age-gate law’s first weeks of enforcement. But they have also urged people to think twice before looking for a way around the scans, including by using VPNs, which people can use to pretend they’re logging in from another country.

Peter Kyle, a member of Parliament and the British government’s secretary of state for science, innovation and technology, said in a BBC appearance last month that the law represented the “biggest step forward in child safety since the internet was created” and told “everybody who’s out there thinking of using VPNs … let’s just not try and find a way around.”

The message was received — but likely not how he wanted. In the days afterward, VPN apps soared to the top of the country’s app-store download charts.

“The government getting on national TV to warn that VPNs let people slip past age verification,” Scott-Railton said, “might be the slickest free advertising the VPN industry has ever received.”
 
Top