Age verification is becoming one of the biggest privacy questions on the internet as the US and UK attempt to keep minors away from adult content.
For decades, websites generally operated on a simple assumption:
If you say you’re 18, you’re 18.
That model is disappearing.
The UK has already implemented mandatory age-assurance requirements for services allowing pornography.
In the US, dozens of states have introduced their own age-verification laws.
The next battle may therefore be less about whether people should be age-verified and more about something far more complicated:
Who gets to know your age, identity and browsing activity?
Why It Matters
Proving that someone is over 18 sounds simple.
Doing it online is not.
A website could ask for an ID document.
It could use facial age estimation.
It could use a credit card.
It could rely on a third-party identity provider.
It could receive an age token from an operating system or device.
Each method creates a different privacy architecture.
And adult-content browsing is particularly sensitive because the information being protected can reveal highly personal behavior.
The UK Is Already Testing Different Models
Britain’s Online Safety Act requires services offering pornography to use highly effective age assurance.
Ofcom says age-assurance systems must be accurate, robust and reliable.
At the same time, Ofcom’s guidance explicitly recognizes the importance of protecting privacy.
That creates a difficult design challenge.
The system needs enough information to establish age.
But ideally, the adult website should not need to know a user’s full identity.
The Ideal System
Imagine logging into an adult website.
Instead of uploading your passport, you receive a simple message:
“Age verified: 18+.”
The website knows you are old enough.
It does not necessarily know your name, address or date of birth.
That is the basic idea behind privacy-preserving age credentials.
Instead of sharing all your identity information, a trusted third party could confirm only the fact that you satisfy the age requirement.
Technically, this is much closer to how modern digital identity systems could eventually work.
The US Has a Different Problem
America’s decentralized approach makes privacy even more complicated.
The NBER found that 25 states had introduced age-verification laws affecting major adult websites since 2023.
The result has been a mixture of access restrictions, VPN use and substitution to other sites.
That means there isn’t one universal American standard.
A company could potentially face different technical and legal requirements in different states.
For consumers, that creates uncertainty.
For businesses, it creates compliance complexity.
The Data-Retention Question
The most important question may be one regulators cannot answer with legislation alone:
What happens to the data after verification?
If a company sees someone’s ID, does it store it?
For how long?
Who processes it?
Can it be sold?
Can it be hacked?
Can it be shared with another company?
Can law enforcement request it?
Can the verification provider connect the identity to browsing history?
These questions become especially important when age verification moves beyond simple self-declaration.
Why Big Tech Could Become Important
Apple, Google and other technology companies could potentially play a major role in age assurance because they already operate systems that know a user’s device, account and other signals.
That creates an alternative model:
Instead of every website independently collecting identity documents, an operating system or trusted identity provider could confirm that someone is an adult.
The UK is already seeing this type of architecture tested.
Ofcom’s current Pornhub investigation involves a process that relies on signals from Apple suggesting that a UK user has completed Apple’s age checks.
The regulator is now examining whether Aylo’s implementation was sufficiently effective.
The Bigger Internet Question
The adult industry could become the testing ground for a much larger change.
Once governments establish reliable online age verification, the same infrastructure could potentially be used for:
- Gambling
- Alcohol sales
- Dating platforms
- Social media
- Certain AI services
- Online marketplaces
- Age-restricted communities
That makes the privacy debate much bigger than pornography.
It becomes a question about digital identity itself.
What’s Next
The likely direction is not one giant database containing everyone’s browsing history.
Instead, the industry is likely to experiment with decentralized and privacy-preserving verification.
But regulation, technology and consumer expectations are moving at different speeds.
The winners may be companies that can prove two things simultaneously:
“This person is over 18.”
and
“We don’t need to know everything else about them.”
That could become one of the most important privacy technologies of the next decade.
FAQ
Does age verification always require an ID?
No. Different systems can use different forms of age assurance, including age estimation, verification providers and device-level signals.
Does the UK require websites to store users’ identities?
The regulatory framework focuses on effective age assurance while also requiring providers to consider privacy.
Why is this relevant to the US?
US states are increasingly adopting age-verification requirements, creating a large market for age-assurance technology.
Could age verification be used outside adult websites?
Potentially. Similar technology could be used anywhere governments impose age restrictions online.
Related Reading