Age-verification laws for porn sites don’t tell visitors how to prove their age. They tell sites which methods count, and the site, or a vendor it hires, runs the check [3]. Most methods fall into five groups: ID documents, digital ID wallets, record checks, face-based estimates and signals from the device itself.
The laws also differ on what happens to the data afterwards, which is where most of the privacy argument sits.
How does an ID upload with a selfie work?
The most familiar method is photo-ID matching. The visitor photographs a driver’s license or passport and takes a selfie, and software compares the two to confirm the ID belongs to that person [2]. Ofcom, the UK regulator, lists photo-ID matching among the methods it considers capable of being highly effective [2][1].
US laws usually allow ID checks run through a commercial age-verification system. Texas, for example, accepts government-issued ID checked that way [3]. Tennessee’s 2024 law spells out the selfie step: it accepts matching a photo of the user, taken on the same device at the time of access, to a state-issued photo ID [11]. Tennessee’s law also makes each check last for a 60-minute session, after which the user must verify again [8].
The method is not new. The Supreme Court noted in 2025 that a federal court had found in 1999 that users of tens of thousands of adult sites verified their age by sending a copy of a passport or driver’s license to a third-party service [4].
What is a digital ID wallet, such as LA Wallet?
A digital ID wallet is a government-issued ID stored in a phone app that can answer an age question without handing over the ID itself. Texas’s law accepts “digital identification”, which it defines broadly as identity information stored on a digital network that a site can access [3]. Texas told the Supreme Court it had no such state ID [4].
Louisiana does, and Pornhub checks ages there through it [5]. In the process Government Technology described in 2024, a visitor clicks to check their age, receives a code and enters it in LA Wallet, the state’s digital driver’s license app [5]. The company that runs it described the data shared as minimal: “The only thing that a resident is sharing is if they are 18 or over” [5]. It also said the app does not learn which site asked, and reported more than 2.9 million remote age checks by then [5].
What are database, transactional-data and credit-card checks?
These methods check records rather than documents. Virginia’s law, for example, accepts a commercially available database of the kind businesses and government agencies use for age and identity verification, or another commercially reasonable method [6].
Transactional data is a related idea: proof of age drawn from a person’s dealings with lenders, schools or employers. Texas defines it to include mortgage, education and employment records [3]. The Supreme Court called ID and transactional-data checks established methods already used for online gambling, alcohol and tobacco sales and car rentals [4].
Credit cards work only where an account requires an adult holder. Wyoming accepts credit or debit cards except those that do not require the account holder to be 18 or older [7]. Ofcom accepts credit card checks but rejects debit-card payments, which do not require the holder to be 18 [1].
How does facial age estimation work?
Facial age estimation analyses the features of a person’s face, usually from a selfie, to estimate how old they are, without checking a document [2]. Ofcom lists it among the methods capable of being highly effective in the UK [2].
The US laws cited in this guide do not name it: Texas’s lists ID, digital ID and transactional data [3], while Virginia’s adds a catch-all for other commercially reasonable methods [6]. Before the Supreme Court, the challengers to Texas’s law said it did not permit face scans, which they argued raise fewer privacy concerns, while Texas said it did; the Court left that dispute unresolved [4].
What are device-level age signals, such as Apple’s?
Device-level checks move verification from each website to the phone’s operating system, which confirms a user’s age once and then passes on an answer [14]. Apple’s Declared Age Range tool lets app developers learn a user’s age range without seeing their birth date [13].
In the UK and Australia, Apple asks users to confirm they are over 18 with a credit card, passport, driver’s licence or other government ID, and keeps child-safety features on until they do [14]. Pornhub now gives Apple-confirmed iPhone and iPad users full access in both countries [15][14]. Ofcom opened an investigation in September 2026 into whether Pornhub’s use of that check is effective enough [15].
In the US, California’s AB 1856 requires operating systems with an account-setup feature to send app stores and developers an age-bracket signal from 2027 [16]. State app-store laws are tracked in our guide to app store and device age-verification laws.
Is clicking “I am 18” enough?
Not under the rules covered here. Ofcom says self-declaration of age is not highly effective [1]. In March 2026 the European Commission preliminarily found that Pornhub, Stripchat, XNXX and XVideos breached EU law by letting users in with a click confirming they were over 18, and said self-declaration is not an effective measure [17].
US state laws list the methods they accept, and a checkbox is not among them [3][6]. The SCREEN Act, which the House passed in June 2026 as part of the KIDS Act, would say so expressly: a user confirming they are not a minor would not be enough to verify age [18]. Ohio, where Pornhub shows only a click-through gate [23], is a special case: its law exempts providers of an “interactive computer service” [12].
Can porn sites keep a copy of my ID?
Under most US state laws, no. Texas bars the site and any outside verifier from keeping identifying information, with penalties of up to $10,000 for each instance [3]. Arizona adds that the information may not be passed, directly or indirectly, to any federal, state or local government body [10]. Florida’s law provides an anonymous option, run by an independent US-based verifier that may not keep, reuse or share the data [9].
The details vary. Tennessee requires seven years of anonymized verification records while barring personally identifying information after access is granted [8]. Ohio requires deletion once verification is complete, except what is needed for account access and billing [12]. Virginia’s law contains no retention rule at all [6].
Has age-verification data ever leaked?
Yes, at verification and support vendors outside the porn industry. In June 2024, 404 Media reported that AU10TIX, an identity-verification company used by TikTok, Uber and X, had left administrative credentials exposed for more than a year, which could have given access to users’ face photos and driver’s license images [19]. In October 2025, Discord said about 70,000 users may have had government-ID photos exposed after hackers breached an outside vendor that reviewed age-related appeals; the hackers claimed far more, which Discord disputed [20].
Neither case involved a porn site. But they show why critics focus on what vendors hold. Justice Kagan’s dissent in the Texas case warned that an operator holding such data might sell it, be hacked or be subpoenaed [4]. Designs such as LA Wallet’s, which pass on only an over-18 answer, are meant to limit that risk [5].
How will the EU’s age-verification app work?
The EU’s app is built from an open-source blueprint published by the European Commission [21]. A user first gets a proof-of-age attestation from an approved issuer, which checks their identity through a national eID, by scanning a passport or ID card and matching it to a selfie, in person, or through a bank or mobile-operator app [21]. The attestation holds only age attributes, such as over 18 [21].
When a site asks, the app presents that proof, and the site learns only whether the age threshold is met [21]. Attestations are single-use and issued in batches so visits to different sites cannot be linked, and zero-knowledge proofs, which confirm the answer without transmitting the attestation, are preferred where available [21]. Commission President Ursula von der Leyen said on April 15, 2026 that the app was technically ready; Denmark, France, Greece, Italy and Spain piloted it [22]. The Commission says the app will be interoperable with future EU Digital Identity Wallets [17].
Places in this guide
Texas · Louisiana · Tennessee · United Kingdom · European Union