(Credit: PCMag/fokas.pokas /Adobe Stock/ Mininyx Doodle/iStock via Getty Images)
The UK just passed age verification laws that require users to submit personal information to access websites that contain adult themes. Many US states have enacted similar restrictions, and it is likely that more are to follow suit. These laws are aimed at protecting children from accessing adult content. However, these restrictions come at the cost of your data and privacy, and may have side effects that harm marginalized groups. With frequent breaches and data leaks, the move to require even more personal information to browse the web is questionable at best.
What Do Age Verification Laws Actually Do?
As of July 2025, the UK and the US have passed ordinances that require certain sites to restrict access to adult content. Age verification laws require a user to submit identifying documents such as a government ID, face scan, or selfie to access content that the laws consider explicit in nature. According to the UK government, the stated intent of the Online Safety Act (OSA) is that:
“... platforms have a legal duty to protect children online. Platforms are now required to use highly effective age assurance to prevent children from accessing pornography, or content which encourages self-harm, suicide or eating disorder content.”
The US introduced a similar bill in March 2025 called the Kids Online Safety Act (KOSA). While a nationwide law has not been passed, 24 states have already issued age verification laws that require users to verify their identity to access sensitive content.
The scope of what these restrictions will cover has yet to be determined. Porn sites are undoubtedly impacted, but some speculate that the language of the laws implies that any site that houses content with adult themes could be censored. Additionally, depending on who you ask, information about reproductive health, sexually transmitted infections, or even LGBTQ+ rights can all be classified as "adult themes." Social platforms like Discord, Reddit, Instagram, and Facebook have content that caters to multiple audiences. While all three of these sites have their own protective measures in place, there’s no telling as of yet whether or not those will be enough to comply with the new laws.
This risk extends beyond social media as well. Many forums, image boards, and creative-focused websites could potentially fall under the purview of these acts. In practice, there is a future on the horizon where you could be required to submit identifying information to access the majority of websites.
I’m wary of the implications these restrictions carry for online privacy. Just recently, Tea suffered a breach that resulted in thousands of users having their full government IDs leaked. When a site is forced to take in personal data without protections in place, there could be disastrous consequences.
What Happens to the Information I Provide for Age Verification?
If you’re lucky, your data will be validated and properly wiped after use. However, age verification laws do not require businesses or websites to handle personal identifying information (PII) securely. While some states and regions have laws in place to protect consumer data, you’re still left placing your trust in the website to adhere to them. Unless a site has been independently verified by a trusted security firm, you’re going off of little more than the site’s word. For the same reasons that I don’t trust VPNs that haven’t undergone similar audits, I wouldn’t place my faith in a site being forced to hold sensitive data.
Many of these sites will implement the least expensive option that still meets the letter of the law. This will equate to long-term storage of your personal information in unsecured, unencrypted storage. Data breaches happen frequently, and these laws make the stakes even higher. Having your email and name that was used on a site made public is bad enough. Your government ID, address, and payment information being leaked could be devastating.
What Happens to Leaked Age Verification Data?
No data breach is going to be exactly the same. Sometimes, user data is sent out to the masses without any use or alteration. Other times, it is used in more nefarious manners like identity theft, impersonation, credit card fraud, and even blackmail. Advertisers and data brokers are likely to harvest that information for analytics. Spam agencies could buy that data and inundate you with ceaseless, annoying emails and phone calls. Such leaks also pose threats to at-risk people, such as those with restraining orders against stalkers and abusive partners. There’s a chance that someone could take advantage of a data leak to enact violence on another person for their beliefs or identity.
While admirable in aim, the execution of these laws poses significant threats to everyone’s online privacy. It’s not simply a matter of hiding your porn habits from prying eyes. Allowing sites to collect PII with little to no restrictions is a direct threat to the safety of many users, and it is a big win for businesses that deal in this data.
Considering that these restrictions are often trivial to bypass with a VPN or proxy, I question whether these laws will truly improve the safety of children. What I can say for certain is that there will be lasting consequences to user privacy if countries and states continue down this path of censorship.
How Can I Prevent My Age Verification Data From Being Leaked?
The best way to prevent your data from being leaked is to not provide it in the first place. Granted, that is easier said than done. Most sites want your email and phone number just to make a purchase. Then there are cookies and trackers that every site pushes at you to accept whenever you land on the homepage. Rejecting what you can of those is a good first step. Paired with an ad blocker and private browser, you can mitigate some of the fingerprinting that advertisers use to identify you. Lying is another good tactic. Don’t give your real information. I recommend using burner emails, phone numbers, and one-time-use payment cards when possible.
A VPN can offer another layer of security by obfuscating your location and encrypting the data that does get sent out. That said, even the best VPNs out there won’t stop you from filling out forms or making payments with your real information. I also recommend investing in a good password manager to safeguard your logins and an antivirus to stop any malicious files from compromising your identity.
Is It Legal to Bypass Age Verification Laws?
For now, the onus is mainly on the website hosting the adult content to verify users. Sites can face legal penalties and fines for non-compliance. While skirting age verification laws doesn’t currently result in any penalties for the user, that could change. The legal situation surrounding these laws is constantly developing.
However, you can be banned from the site you’re trying to access due to violating its terms of service. Similar to streaming Netflix with a VPN, you might be blocked if a site detects you’re using a tool to bypass local restrictions. Granted, it is unlikely that most sites being forced to adopt these restrictions will have advanced VPN blocking technology right away. It will take time for them to adapt to the laws.
This isn’t likely to change anytime soon, even if sites put a concerted effort into blocking VPNs. After all, streaming services have tried and failed for years to prevent VPN and proxy users from accessing regional catalogs. Without a massive leap forward in blocking technology, I don’t see these laws resulting in more than a minor inconvenience to bypass, even by children, who are more informed and immersed in technology than ever before.
Ultimately, these laws do little to protect our youth and instead pose a significant threat to our online privacy by placing sensitive data directly into the hands of companies and potentially hackers that can and will use it for financial gain.