‘Scan your face’ laws for the web are having unexpected consequences
The age-verification laws rapidly expanding across the United States and United Kingdom are bringing with them some surprising downsides, including bursts of traffic to seedy parts of the web.
August 31, 2025 at 7:05 a.m. EDT Today at 7:05 a.m. EDT
By Drew Harwell
When the United Kingdom began requiring thousands of websites to verify their users’ ages last month, one group saw an enormous burst of traffic: pornography sites ignoring the law.
The sites that complied — by mandating that users show their government IDs or scan their faces through their webcams, so an algorithm could estimate whether they were adults — saw visits from British internet addresses collapse. But some of the biggest porn sites that disregarded the “scan your face” rule entirely have been rewarded with a flood of traffic, a Washington Post analysis found. Some have doubled or even tripled their audiences in August compared with the same time last year.
Federal and state lawmakers in the United States have pushed to enact similar age-verification laws — not just for porn, but for social networks and video sites, too — arguing that protecting children online warrants government-mandated ID or face scans for all users. Sen. Mike Lee (R-Utah) said the technology could help “stop those who profit from stealing the innocence of America’s youth.”
But tech and privacy experts have warned that the laws bring with them some unavoidable downsides, including potentially driving people to seedier corners of the web. John Scott-Railton, a researcher at the Citizen Lab at the University of Toronto who studies surveillance and digital rights, called the U.K. case “a textbook illustration of the law of unintended consequences.”
The law “suppresses traffic to compliant platforms while driving users to sites without age verification,” he said. “The more the government squeezes, the more they reward the very sites that scoff at their rules.”
In the U.S., 25 states have passed laws requiring age verification for adult websites since 2022, according to the Free Speech Coalition, a porn-industry group that has fought the laws in court. A tech-industry effort arguing the laws violate the First Amendment failed in June when the Supreme Court affirmed Texas’s law, which Justice Clarence Thomas said had “only an incidental effect on protected speech.”
The proponents of “age assurance” laws like the U.K.’s Online Safety Act have likened the idea to requiring people to show their ID before stepping into a nightclub. The checks depend on a small group of private contractors, such as Yoti and Incode, that have developed artificial-intelligence software allowing people to prove their age on porn sites by flashing their driver’s licenses, consenting to a facial age analysis or sharing access to their bank or credit card accounts.
Supporters say such measures are a necessary corrective for a wild web. “Clicking a box that says ‘Yes, I am 18’ is not gonna prevent a 15-year-old boy from going on that website,” Ohio state Rep. Steve Demetriou (R), who proposed a similar law, told a local journalist in March.
But civil liberties advocates have warned that the systems require both children and adults to give sensitive information to scattered websites, exposing them to data breaches or misuse. And leaks already happen all the time: Tea Dating Advice, an app where women anonymously reviewed their dates with men, said last month that a cyberattack had exposed thousands of women’s selfies and driver’s license photos, which the site had requested to assure that its users were women.
Some activists have warned that the “censorship movement” could expand far beyond porn to “wall off huge sections of the internet, with the government as the sole gatekeeper,” as the privacy group Fight for the Future said in an online petition. In the U.K., the music service Spotify, the social networks Bluesky and X, the chat apps Discord and Telegram and the message-board giant Reddit have all begun checking some users’ ages through measures like face scans.
Companies seeking to comply with the law must pay for the age checks, whose costs can quickly climb; an Indiana judge said last year that one porn site, Pornhub, faced potential charges of more than $13 million a day. A Yoti representative said last year the company typically charges between 10 and 25 cents per face.
Those kinds of costs aren’t shouldered just by big tech companies. Red Passion, a volunteer-run message board for fans of the Wrexham soccer club in Wales, said it faced “substantial legal and operational burdens” in complying with the U.K. law “that are disproportionately difficult for small platforms like ours to manage.” Some sites have blocked access to the U.K. entirely.
The face scans themselves can bring their own risks, sometimes misclassifying adults as children and vice versa. One 25-year-old woman with dwarfism told The Post last year that her TikTok account had been banned after the app falsely flagged her as a child. And they can be fooled: On social media, guides have proliferated showing how to trick the systems using the faces of video game characters.
