Why porn sites started asking you to prove your age

Where it applies

What each method actually collects

These are the approaches Ofcom accepts as capable of being highly effective. Age inference — guessing from behaviour or an existing account — was explicitly ruled out for pornography. The exposure rating is our own reading of how much identity data leaves your hands, not a regulator's grading.

• Facial age estimation

  Medium exposure

  Collects A selfie or short video, processed to estimate age

  No document changes hands, but a biometric image does. The estimate carries roughly a two-year margin for younger adults, so providers commonly check against 23 or 25 rather than 18 — which is why people well over 18 still get pushed to photo ID.

• Photo-ID matching

  High exposure

  Collects A government ID image, usually with a selfie to match against it

  The most data-exposing option and the one behind most of the breaches below. An ID image contains your name, date of birth and document number, none of which you can change after a leak.

• Open banking

  Low exposure

  Collects A bank authorisation confirming you are over 18

  The bank confirms the fact of your age without handing the site your documents. Low document exposure, but it links the check to a named financial account.

• Credit card check

  Medium exposure

  Collects Card details, verified as belonging to an adult cardholder

  Long-standing and quick, but it ties an adult-site visit to a payment instrument, and debit cards are generally not accepted because minors can hold them.

• Mobile network operator check

  Low exposure

  Collects Confirmation from your carrier that the line is not age-restricted

  Your carrier already knows your age, so nothing new is disclosed to the site. Only works on mobile data, and not if the line is registered to someone else.

• Digital identity wallet

  Low exposure

  Collects A signed attestation that you are over 18

  Structurally the best of the options: the wallet asserts the single fact required and withholds everything else. Availability is still patchy.

What has happened to the ID data so far

• Discord October 2025

  Attackers compromised a third-party customer-service vendor and took at least 70,000 government-ID images submitted for age verification, along with names, usernames, email addresses and support transcripts.

• IDMerit November 2025, disclosed February 2026

  An identity-verification provider left a database of roughly one billion identity records across 26 countries open on the public internet with no authentication, including names, national ID numbers and dates of birth. The public disclosure came 99 days after discovery.

• Tea July 2025

  An open storage bucket exposed around 72,000 images from the app's verification flow, including roughly 13,000 selfies and photo IDs.

The common thread is retention rather than accuracy. A check that confirms your age and immediately forgets it is hard to steal from; a check that files your ID image is a target for as long as the file exists. And unlike a password, a face and a document number cannot be reissued after they leak. Where a site offers a choice of method, that is the reason to prefer one that asserts the fact without storing the proof.

Common questions

Why do porn sites suddenly ask me to verify my age?

Because the law changed. In the UK, the Online Safety Act has required 'highly effective age assurance' on sites hosting pornography since 25 July 2025. In the United States, the Supreme Court upheld Texas's age-verification law in Free Speech Coalition v. Paxton on 27 June 2025, and roughly 27 states now require a check before access. Sites operating in those places are complying with a legal obligation, not adding friction by choice.

Which US states require age verification?

Around 27 as of September 2026, including Texas, Florida, Louisiana, Utah, Virginia, Arkansas, Montana, North Carolina, Indiana, Idaho, Kentucky, Nebraska, Georgia, Alabama, Kansas, Oklahoma, Mississippi, South Carolina, South Dakota, Wyoming, North Dakota, Missouri, Arizona, Ohio and West Virginia. The number has risen steadily since the 2025 Supreme Court ruling and trackers disagree by a state or two depending on when a law takes effect, so treat any fixed count as a snapshot.

Is my ID safe when I upload it?

Not reliably. The data is usually handled by a third-party provider rather than the site itself, and that chain has leaked repeatedly: about 70,000 government IDs taken in the Discord vendor breach of October 2025, and roughly a billion identity records left publicly exposed by the provider IDMerit. The underlying problem is retention — verification data that is stored can be stolen, and a face or a document number cannot be reissued the way a password can.

Why am I asked for ID when I am obviously an adult?

Facial age estimation carries a margin of roughly two years around the late teens, so providers set the threshold at 23 or 25 rather than 18 to avoid letting minors through. If you read as under that threshold, the system escalates you to document checks. It is a deliberately conservative setting, not a judgement about you.

Do all porn sites check now?

No, and that is not always a good sign. Ofcom found that of the top 100 dedicated pornography services, 77 had age assurance in place by the end of January 2026 and a further 7 had blocked the UK entirely. A site in a covered jurisdiction that asks for nothing at all is either outside the rules' reach or ignoring them, which says something about how it treats the rest of its obligations too.

Which verification method gives away the least?

A digital identity wallet or a mobile-network check, where the provider confirms only the single fact that you are over 18. Open banking is close behind. Photo-ID upload gives away the most and is the method behind most of the known breaches, so where a site offers a choice it is worth taking any option that does not involve sending a document image.

Does this site help people get around age checks?

No. This page explains what the checks are, what they collect and where that data has leaked, because those are reasonable things for an adult to want to know. It does not explain how to defeat them. Age assurance exists to keep minors out of adult content, and helping anyone around it is not something we will publish.