Online Age Verification Is Not the Same as ‘Flashing Your ID at a Liquor Store’

June 20, 2024

Updated June 20, 2024

Nearly half of the states have enacted laws that require visitors to websites with “material harmful to minors” to verify their age, usually by uploading a government-issued ID, submitting a facial scan or other biometrics, or allowing a third party to verify identity via a credit bureau or other database.¹ These policies are ostensibly designed to prevent children from viewing age-inappropriate adult content online. Opponents claim these laws obstruct the right to free speech granted by the First Amendment because they restrict adults’ access to legal content. Historically, the courts have agreed. However, the Supreme Court recently changed course and ruled that the government doesn’t need as strong a justification to limit access to material they consider harmful to children.²

Proponents of the laws maintain that uploading one’s ID to access content online is no different than flashing your ID at the liquor store cashier. However, research suggests this is not the case. Specifically:

• In-person ID checks do not store the individual’s data in a database
• In-person ID checks do not keep a record of what specific item the individual is buying
• Sharing personally identifying information over the internet can allow third parties access to the information
• Even programs that endeavor to protect users’ private information admit the potential for hacking or data breaches³
• The process of uploading an ID or undergoing other verification processes is often difficult and complicated, and the loss of anonymity may dissuade adults from accessing legal content.

Obviously, these concerns are not a risk at liquor stores where no record is kept that includes the actual ID. Further, tying one’s ID to sensitive, sexually explicit content creates the risk of exploitation and extortion that does not exist in the liquor store analogy. Lastly, purchasing liquor is not a constitutionally protected activity, but adult content is protected by the First Amendment.

Protecting children from age-inappropriate material online is important. However, when laws and regulations significantly burden adults’ access to otherwise legal ideas, information, art, and entertainment, they function as censorship.

Myth 1: Is age verification easy and seamless?

No. Proponents of age verification laws claim that online age verification is an easy, seamless process and therefore would not stop anyone from accessing First Amendment-protected content.

However, the actual age verification process can be difficult and time-consuming. Following the passage of Utah’s age verification law, a journalist attempted to comply and found that some age verification processes required more than 50 steps to establish identity. They also encountered invasive and potentially dangerous protocols, including platforms that required the user to share access to their camera, submit a facial scan, or even identify their individual kinks and what type of pornographic content they like to view before being approved to continue.⁴

Others have faced different challenges. Following the enactment of Louisiana’s age verification law, Act 440, military veteran Elizabeth Henson found she couldn’t access certain sites in Louisiana because she didn’t have a Louisiana driver’s license; she was only there temporarily, as her partner had been transferred there by the Coast Guard. Because the state’s verification required a Louisiana ID, she was barred from access.⁵

Additionally, concerns about security, phishing, exposure, and hacking are enough to dissuade large numbers of visitors from accessing those sites. One platform, JustForFans, said that fewer than 5% of visitors have been willing to complete the age verification process, an experience echoed by other platforms that have attempted to do so.⁶ Research conducted at France’s Ecole Polytechnique found that just 1.7% of consumers were willing to proceed with age verification on adult sites, even with the promise of free content.⁷

When these laws go into effect, many people, including those without a government ID, those without a decent webcam or scanning device, and those who may be closeted or fearful of exposure, are locked out of large portions of the internet and denied their First Amendment right to access speech. These restrictions, unfortunately, fall most heavily on already marginalized populations.

Myth 2: Is the age verification process secure?

Legislators and advocates for age verification claim that the verification process is secure, pointing to language in the laws that regulates how much data can be collected and how long it can be retained, and outlining stringent security requirements. Unfortunately, research suggests that these protections fail to achieve their stated goals.

The most common method of age verification requires visitors to a site with “material harmful to minors” to upload their government ID, such as a passport or driver’s license, through a third-party system to confirm they are over 18. While this approach is the most likely to provide true and accessible age verification, it is also the most likely to lead to data breaches, intrusions on privacy rights, and a burden on access to constitutionally protected speech.⁸

Research shows that current age verification systems fail to accurately identify consumers’ ages without compromising their privacy or security. To ensure accuracy, age verification requires proof of identification through documents, facial recognition, or both. However, there is currently no technology that ensures total privacy and security of this data.^{9 10 11}

Third-party age verification providers are often utilized in an attempt to offset this risk and to prevent sites that require verification from saving or sharing users’ information. This means individuals need to upload their identification documents and risk the associated privacy breaches,¹² which happens because third-party providers are not automatically more secure. Some promise that the data is immediately deleted from their system, while others retain the individual’s data but commit to keeping it safe.¹³ Neither promise, however, ensures immunity from data breaches or hackers.

Unfortunately, there have been several cases in which data breaches led to users’ personal information being leaked despite commitments to keep consumer data safe:

• In 2025 alone, the Electronic Frontier Foundation reported thousands of data breaches that affected millions of users, including names, emails, and selfies required for age verification.¹⁴
• At the end of 2025, hackers stole over 200 million records of PornHub’s premium users, including their search and watch history.¹⁵
• Louisiana, the first state to pass age verification legislation, requires the use of a state-run age verification system. In 2023, this state-run program suffered a major data breach affecting over 6 million residents.¹⁶
• In 2015, when “affair” site Ashley Madison was hacked, millions of users were exposed, and thousands were estimated to have been extorted. At least two committed suicide, despite the site’s website having reported using proper encryption techniques to protect customers.¹⁷

More so, some age verification processes link one’s identity with a record of their sexual preferences and browsing history. These provide opportunities for nefarious actors to blackmail or extort users, as some cases of data breaches have resulted in consumers being blackmailed over the type of pornographic content they consume. In 2020, the FBI ranked exposure threats related to porn as one of the top three internet scams. One 18-year-old hacker in England made over $850,000 by blackmailing porn users to pay or have their sexual interests exposed.¹⁸

International governments have raised concerns about the security of age verification systems.

• A national law in the UK aimed at implementing similar age verification has been found to be largely ineffective at guaranteeing citizens’ privacy and has faced similar issues related to data breaches and overall effectiveness.^{19 20}
• France’s data protection agency, the Commission Nationale de l’Informatique et des Libertés, said it was unable to identify a third-party service that accurately verifies age while respecting users’ privacy and security.²¹
• A review of the age and identification verification system in the EU likewise found that third-party verifiers largely fail to offer security and respect users’ privacy, noting that far more development and research in the field is needed to adequately protect children from viewing pornography without infringing on users’ security.²²
• In Australia, an eSafety commission tasked with implementing an age verification law found such extensive privacy and security issues with current age verification technology that the plan was scrapped. Instead, the country’s eSafety commissioner said it would work with the tech industry to develop code that educates parents on filtering software and limits children’s access to age-inappropriate content.²³

Policy Suggestions

• Increase awareness and access to and development of device-level age restrictions. Device-based filters are a more effective solution that doesn’t compromise the privacy of consenting adults. Parental controls are much harder to bypass and can not be evaded with a VPN.²⁴
• Educate lawmakers regarding the risks and burdens of mandatory age verification and the significant constitutional concerns.

References

1. Free Speech Coalition, n.d. State Age Verification Laws: Laws in effect. https://action.freespeechcoalition.com/age-verification-resources/state-avs-laws/ Retrieved March 25, 2026

2. Free Speech Coalition 2025. In Radical Decision, Supreme Court Rules Age Verification Constitutional
https://www.freespeechcoalition.com/blog/in-radical-decision-supreme-court-rules-age-verification-constitutional

3. Yar, Majid. “Protecting Children from Internet Pornography? A Critical Assessment of Statutory Age Verification and its Enforcement in the UK.” Policing 43, no. 1 (2020): 183-197. doi:https://doi.org/10.1108/PIJPSM-07-2019-0108.

4. Cole, Samantha. “Accessing Porn In Utah Is Now a Complicated Process That Requires a Picture of Your Face.” Vice. May 3, 2023.
https://www.vice.com/en/article/z3mnqx/utah-age-verification-pornhub-xhamster-laws

5. Schwedel, Heather. “The Porn Patriot.” June 25, 2023. Slate. https://slate.com/human-interest/2023/06/louisiana-porn-id-age-verification-act-440.html

6. Poleo, Germania Rodriguez. “Is this the end of internet porn? Pornhub pulls out of Utah over a strict new law – and dozens more states may be affected… Now DailyMail.com lays bare the $100 BILLION war over online erotica.” The Daily Mail. May 5, 2023.
https://www.dailymail.co.uk/news/article-12043365/Is-end-internet-porn-Pornhub-pulls-Utah-100B-war-online-erotica.html

7. Stanford Cyber Policy Law Center. (2024, May 7). Online Age Verification and Privacy Protection: An Impossible Equation? [Video]. Youtube. https://www.youtube.com/watch?v=OkE5EwuLV9o

8. Yar, Majid. “Protecting Children from Internet Pornography? A Critical Assessment of Statutory Age Verification and its Enforcement in the UK.” Policing 43, no. 1 (2020): 183-197. doi:https://doi.org/10.1108/PIJPSM-07-2019-0108.

9. Weissman, Shoshana. “The technology to verify your age without violating your privacy does not exist.” RStreet. May 16, 2023 https://www.rstreet.org/commentary/the-technology-to-verify-your-age-without-violating-your-privacy-does-not-exist/

10. Lively, Taylor K. “Facial Recognition in the United States: Privacy Concerns and Legal Developments.” AsisOnline. December 1, 2021. https://www.asisonline.org/security-management-magazine/monthly-issues/security-technology/archive/2021/december/facial-recognition-in-the-us-privacy-concerns-and-legal-developments/

11. Roth, Emma. “Online age verification is coming, and privacy is on the chopping block.” May 15, 2023. TheVerge.
https://www.theverge.com/23721306/online-age-verification-privacy-laws-child-safety

12. Kelley, Makena. “Child Safety Bills Are Reshaping the Internet for Everyone.” TheVerge. August 29, 2023. https://www.theverge.com/2023/8/29/23849375/kosa-child-safety-free-speech-louisiana-utah-parental-consent

13. Yar, Majid. “Protecting Children from Internet Pornography? A Critical Assessment of Statutory Age Verification and its Enforcement in the UK.” Policing 43, no. 1 (2020): 183-197. doi:https://doi.org/10.1108/PIJPSM-07-2019-0108.

14. Klosowski,T., Budington, B., Alajaji, R., Romero, C., Cohen, L., Tsukayama, H. & Quintin,C. (2025, December 17). The Breachies 2025: The Worst, Weirdest, Most Impactful Data Breaches of the Year. Electronic Frontier Foundation.
https://www.eff.org/deeplinks/2025/12/breachies-2025-worst-weirdest-most-impactful-data-breaches-year

15. Doffman, Z. (2025, December 17) Porn Hack—Has Your Pornhub Search And View History Leaked?https://www.forbes.com/sites/zakdoffman/2025/12/17/pornhub-confirms-breach-user-search-watch-and-download-activity-stolen/. Retrieved April 9, 2026

16. Finn, James. “Here’s what to know three weeks after massive data breach hit Louisiana’s OMV.” The Times-Picayne. July 9, 2023. https://www.nola.com/news/what-to-know-weeks-after-huge-data-breach-at-louisiana-omv/article_a3fbf162-1cff-11ee-a898-4f965b21693a.html

17. Matthews, Lee. “Apparent xHamster Hack Puts 380,000 Users In Compromising Position.” Forbes. November 29, 2016. https://www.forbes.com/sites/leemathews/2016/11/29/apparent-xhamster-hack-puts-380000-users-in-compromising-position/?sh=667191985951

18. Dearden, Lizzie. “Hacker who blackmailed porn users into handing him money after they clicked on his pop-up adverts jailed.” Independent. April 9, 2019.
https://www.independent.co.uk/news/uk/crime/porn-hacker-blackmail-zain-qaiser-trial-prison-sentence-a8861236.html

19. Yar, Majid. “Protecting Children from Internet Pornography? A Critical Assessment of Statutory Age Verification and its Enforcement in the UK.” Policing 43, no. 1 (2020): 183-197. doi:https://doi.org/10.1108/PIJPSM-07-2019-0108.

20. Castro & Ambrose, 2025 The UK’s Online Safety Act’s Predictable Consequences Are a Cautionary Tale for America
https://itif.org/publications/2025/09/03/the-uks-online-safety-acts-predictable-consequences-are-cautionary-tale-for-the-us/

21. Weissman, Shoshana. “The technology to verify your age without violating your privacy does not exist.” RStreet. May 16, 2023 https://www.rstreet.org/commentary/the-technology-to-verify-your-age-without-violating-your-privacy-does-not-exist/

22. Crepax, Tommaso, Victor Muntés-Mulero, Jabier Martinez and Alejandra Ruiz.
“Information technologies exposing children to privacy risks: Domains and children-specific technical controls.” Computer Standards & Interfaces 82, (2022): 103624. https://doi.org/10.1016/j.csi.2022.103624.

23. Taylor, Josh. “Australia will not force adult websites to bring in age verification due to privacy and security concerns.” The Guardian. August 30, 2023. https://www.theguardian.com/australia-news/2023/aug/31/roadmap-for-age-verification-online-pornographic-material-adult-websites-australia-law

24. Cole, Samantha. “Accessing Porn In Utah Is Now a Complicated Process That Requires a Picture of Your Face.” Vice. May 3, 2023.
https://www.vice.com/en/article/z3mnqx/utah-age-verification-pornhub-xhamster-laws

Download PDF