Half of the US Is Now Under Age Verification Laws

Hey there, new milestone just passed: Missouri marks the 25th state to enact restrictive age verification legislation that threatens to makes the internet less safe for everyone.

Today is Giving Tuesday! If you're in a giving mood and want to support our work, including suing the DHS and ICE or investigations into book bans, you can become a subscriber or send a gift a subscription. If you'd like to make a larger, tax deductible donation, please contact us at donate@404media.co.

As of this week, half of the states in the U.S. are under restrictive age verification laws that require adults to hand over their biometric and personal identification to access legal porn.

Missouri became the 25th state to enact its own age verification law on Sunday. As it’s done in multiple other states, Pornhub and its network of sister sites—some of the largest adult content platforms in the world—pulled service in Missouri, replacing their homepages with a video of performer Cherie DeVille speaking about the privacy risks and chilling effects of age verification. 

SPONSORED

Attack surfaces are expanding fast—driven by shadow IT, supply chains and rapid cloud adoption. Intruder’s 2025 Exposure Management Index—built from data across 3,000+ organizations—reveals how security teams are adapting to this new reality. Key findings: AI is helping attackers weaponize the back catalog of CVEs, turning old vulnerabilities into new opportunities for exploitation. In a reversal from 2024, European organizations are pulling ahead of North America in critical vulnerability management, facing fewer critical issues. Thousands of CVEs are published each year, but only a handful truly matter. We’ve identified the five vulnerabilities that defined 2025 and what they teach defenders about real-world risk. Discover how exposure management is evolving and where your peers stand in 2025. Download the full report

The other states include Louisiana, Utah, Mississippi, Virginia, Arkansas, Texas, Montana, North Carolina, Idaho, Kansas, Kentucky, Nebraska, Indiana, Alabama, Oklahoma, Florida, South Carolina, Tennessee, Georgia, Wyoming, South Dakota, North Dakota, Arizona, and Ohio.

“As you may know, your elected officials in Missouri are requiring us to verify your age before allowing you access to our website. While safety and compliance are at the forefront of our mission, giving your ID card every time you want to visit an adult platform is not the most effective solution for protecting our users, and in fact, will put children and your privacy at risk,” DeVille says in the video. On the blocked homepages there’s also a link to an explanation of the “Restricted to Adults,” or RTA label, which porn site administrators place on their sites to signal to device-based parental controls that the websites are inappropriate for minors.  

Like most of the other 24 laws across the country, Missouri’s age verification law requires websites containing more than one third of material that’s considered “harmful to minors,” or sexual content, to perform age verification checks. Similar or more restrictive laws have swept the country since Louisiana became the first state to enact age verification legislation in 2023.

Age Verification Laws Drag Us Back to the Dark Ages of the Internet

Invasive and ineffective age verification laws that require users show government-issued ID, like a driver’s license or…

404 Media •Emanuel Maiberg

Age verification laws reach beyond porn sites, however. In Wyoming, South Dakota, Mississippi and Ohio, where the laws are written broadly enough to cover social media sites and any platform hosting adult content, Bluesky users have to submit to a face scan by the third-party company Yoti or upload a photo of their credit card to verify they’re over 18 years of age. In July, Bluesky started requiring all UK users to verify their ages in response to the Online Safety Act. We’ve previously reported on the security risks in uploading sensitive personal data to identity verification services, including the potential for hackers to then get ahold of that information themselves. In October, after Discord started requiring UK users to verify ages, the platform announced hackers breached one of its third-party vendors that handles age-related appeals, and said it identified around 70,000 users who may have had their government ID photos exposed as part of the breach. 

Last week, Pornhub’s parent company Aylo sent letters to Apple, Google, and Microsoft, urging them to support device-based age verification in their app stores and operating systems, WIRED reported. “Based on our real-world experience with existing age assurance laws, we strongly support the initiative to protect minors online,” Anthony Penhale, chief legal officer for Aylo, said in the letter. “However, we have found site-based age assurance approaches to be fundamentally flawed and counterproductive.” 

Instead of protecting minors, age verification laws spike usage of virtual private networks and send users—including, potentially, minors—to unregulated or unmoderated sites that don’t care about complying with U.S. or UK laws. In Missouri, searches for VPNs spiked following the law’s enactment. 

Missouri schools are not required to teach sex education, leaving it up to local school boards to decide what, if anything, children are taught about sexual health. School districts that do teach sex ed are required to promote abstinence, a modality long recognized as ineffective at protecting children from engaging in risky sexual behaviors. Even if a district offers sex ed, parents are allowed to pull their kids out of that class altogether. But despite research showing age verification laws don’t work either, Missouri Attorney General Catherine Hanaway believes forcing adults to undergo age verification protects the children in her state. “We are proud to stand on the side of parents, families and basic decency. Missouri will not apologize for protecting children,” Hanaway said in a press release.