Can Age Verification to Limit Access to Porn Really Work?| National Catholic Register

The U.S. Supreme Court on June 27 ruled that states are allowed to require that pornographic sites verify their users are at least 18 years old, finding that “adults have no First Amendment right to avoid age verification.” 

At issue in the case, Free Speech Coalition v. Paxton, was a 2023 Texas law requiring porn sites to verify users’ ages and allowing parents to sue those websites if their child accessed pornographic material when the website was not complying with the age-verification law.

The Supreme Court’s recent ruling validates not only Texas’ law, but also the laws of other states — in fact, nearly half of all U.S. states have passed laws requiring age verification for websites hosting substantial amounts of pornographic content, beginning with Louisiana in 2022. 

Pornhub, one of the largest pornographic websites in the world, has chosen to cease operations in nearly all of those states rather than comply with the age-verification laws.

While the Church has long denounced pornography as a “grave offense” that does “grave injury to the dignity” of participants and viewers (Catechism of the Catholic Church, 2354), the bishops of the United States have been especially vocal in recent years about the vital importance of protecting the innocence of children by preventing their exposure to online pornography — especially in an age in which 53% of 11-year-olds and 95% of teens own a smartphone. The average age of first exposure to pornography is 11 years old, the bishops say. 

“Almost all” young males and more than half of young females have seen pornography before age 18, the U.S. Catholic bishops wrote in a recent update to a major document on the Church’s response to pornography. In that document, the bishops also explicitly called for universal age verification for porn sites to protect children, “who are particularly vulnerable to exposure at earlier ages than ever before.” 

Catholics in Texas praised the Free Speech Coalition ruling as a step toward greater protection of children from “harmful images that are a threat to all people who consume them.” Jennifer Allmon, executive director of the Texas Catholic Conference of Bishops, said the Church continues to “pray for healing and recovery for those who have been victims or consumers of pornography and support parents in being vigilant in the protection of their children from this grave evil.” 

The Free Speech Coalition ruling has given age-verification laws solid legal standing, but practical questions remain. 

Among those questions: What, technologically speaking, is the most effective way for websites to verify users’ ages? Can such a process be done in a way that doesn’t infringe on users’ privacy, or expose them to data leaks? And how long will it take for tech-savvy teens to find a workaround?

In a liquor store or bar, the argument goes, a patron can simply flash their physical ID to the clerk or bouncer — who retains very little information about the person, if any — and be on their way. Uploading one’s ID to the internet, and especially to a porn site, would seem to be fraught with far more variables and uncertainties. 

These concerns have been raised not only by porn sites and by tech giants such as Facebook, but also by advocacy groups like the American Civil Liberties Union and the Electronic Frontier Foundation, the latter of which criticized the June 27 ruling as opening potentially “serious anonymity, privacy, and security concerns.” 

But several technology and policy experts interviewed by the Register said this narrative pushed by porn sites and tech companies — that universal age verification would be too expensive, too complex, and too fallible to work — simply isn’t true. 

A Question of Enforcement 

Technologically speaking, websites needing to comply with age-verification laws have several readily available options, all of which are laid out in a 2023 paper by Clare Morell and John Ehrett, scholars at the Washington-based Ethics and Public Policy Center. 

Not all the methods available today are created equal, though. 

By far the lowest and most impotent tier of verification — but one widely used today, even on porn sites — is the “age gate,” where a user voluntarily enters a date of birth. 

A slightly higher level of scrutiny — asking for a credit card number — raises valid concerns about financial theft and isn’t always effective for definitively proving a user’s age. Some sites today, such as TikTok, use AI to make strategic guesswork based on browsing history to estimate users’ ages, though the results can be imprecise. 

Stepping up from there, sites could require direct proof, such as a government-issued ID number, for age verification. But the idea of having to upload all the information contained in a government ID gives privacy advocates pause, especially — as previously mentioned — if it’s being handed directly to an unscrupulous adult website, or to a social-media giant that could use that information to wring more money out of its users. 

The method most readily advocated for by scholars and industry experts is third-party verification. 

Put simply, third-party verification means that a user has proven to a trusted third-party organization that he or she is over age 18, and then the third party — which, ideally, has already deleted any personal information on the user it’s received — informs the adult website simply that the user is an adult, using an electronic “token” or certificate, without revealing anything else. In most cases, there’s no need for the site to know anything about the user’s identity other than age. Though not strictly necessary, the token verifying the user’s age can be renewed every few months to enhance security even further.  

Iain Corby, executive director of the U.K.-based Age Verification Providers Association (AVPA), an international trade body, told the Register that third-party verification keeps users’ personal information out of the hands of adult websites — or any site, for that matter, that is using the method. 

“You never prove your age directly to an adult website. You prove it to an independent third party who you either trust, or who is closely regulated and audited and certified to not only do a good-quality age check, but also to make sure that they [treat] your data very carefully,” Corby said. 

“And the essence of the data protection approach is data minimization. So you don’t retain any data you don’t need to. And it turns out, for the job we do, we don’t need to retain any personal information. I just need to know that this particular user, at some point in the past, has proven to [us] that they were over 18.”

Texas’ newly upheld law, H.B. 1181, does not prescribe a specific verification method, thereby leaving the door open for websites to choose from a variety of options that best suit their technological capabilities and user needs. It does, however, include a provision that any adult websites or third-party verifiers must delete any personal information used to verify the user’s age after access has been granted.

Corby said some of the most sophisticated methods of third-party age verification available today, such as ones being sought by lawmakers in France and Italy — known as “zero-knowledge proof” — are effective and private, almost to the point of being “overkill.” 

Under zero-knowledge proof, “When we tell the adult site that this user is over 18, we do so in a way that makes it completely untraceable, so that the adult site cannot find anything in that certificate that can possibly identify that user. In the other direction, as the age-verification provider, we don’t know which adult website they’ve gone to,” he explained. 

AVPA submitted an amicus brief in the Free Speech Coalition case that noted that AVPA members’ technology is readily available in Texas and already widely in use in the U.S. and in Europe “for all kinds of age-restricted purchases, from cigarettes to marijuana to gambling to pornography.” 

Corby said, going forward, he would like to see U.S. state laws explicitly require that adult websites adopt the third-party verification model as a means of assuring users that they are dealing with a trusted and regulated entity and not handing any personal information over to the adult sites themselves. 

He also noted that a method commonly cited as a “workaround” for age-verification laws — the use of a Virtual Private Network (VPN) to disguise one’s location and make it seem as though one is not in an age-verification state — actually is not a workaround at all, legally speaking.  

“The liability remains with the adult site if they allow children to access them, whether they access them directly or through a VPN,” Corby said. 

“Those sites can perfectly easily know which traffic is coming to them via a VPN. To be safe, they should just age verify everything coming through a VPN, or they should ask you to prove that you are not in a state that requires age verification. … You can agree to share the GPS coordinates from your phone, what Wi-Fi you’re on at the moment, which cell towers you’re connecting to. These things can give us a very good degree of confidence that you’re in Alaska, not in Louisiana.”

What About ‘Face Scanners’?

Of course, having a third party do the actual age verification doesn’t solve all the potential problems, but rather shifts them. In this model, the party doing the verification must find a way to ensure the user is over 18 before it can attest to that fact in a trustworthy manner. 

In many cases, however, this may be as simple as uploading a government-issued ID, with the added assurance from the third party that the personal information it contains will not be retained or linked back to the user. 

Other, more high-tech options are being explored, too. Annie Chestnut Tutor, policy analyst at the Washington-based Heritage Foundation, told the Register that there are companies, such as FaceTec, currently pioneering biometric face-scanning technology, which have so far proven to be very accurate at determining a person’s age. Such technology could prove useful for those who lack a government ID. 

Tutor noted that Louisiana has been a pioneer in offering secure and effective age verification through its state digital ID system, LA Wallet, allowing adult websites to comply with the state’s age-verification law. Louisiana’s A-RAV system, part of LA Wallet, allows users to generate an anonymized code that proves their age to adult sites, while withholding all other personal information. 

Tutor said the success of Louisiana’s model is further proof that the porn industry’s protestations over age verification are being made in bad faith.  

“It’s just dishonest to say [effective age verification] doesn’t exist, because it does,” Tutor said. 

“They don’t want to lose users, because if they actually do this, then they are going to lose the eyeballs of kids, which is good; but for them, it’s less revenue, less early adoption of viewing this content and getting hooked on it. But [the porn sites] are not going to say that. They’re just going to hide behind ‘What about privacy? What about the First Amendment?’ And they can no longer really make the First Amendment claim, because of the Supreme Court’s decision.”

Greyson Gee, policy analyst for the Better Tech for Tomorrow Campaign at the Texas Public Policy Foundation (TPPF), offered similar sentiments. He said the Texas Legislature has been very active in recent years in pursuing laws to further child protection online, despite resistance from tech companies.

“The tech companies have come before the legislature, session after session after session, saying, ‘It’s not possible. We can’t do this. It would violate privacy. We’re doing it on our own. Don’t regulate us. We can take care of it.’ They continue to not put their money where their mouth is,” Gee told the Register. 

In addition to the porn-site age-verification law, Gee said the TPPF has advocated strongly in favor of another new Texas law signed by Gov. Greg Abbott in May that requires App Store operators to verify users’ ages and obtain parental consent for minors before they can download apps or make in-app purchases, beginning Jan. 1, 2026. 

Gee said, “What this does is it forces Apple to have actual knowledge of the users’ age on their platforms. And so now they can’t get away scot-free collecting data on minors.”