Age verification laws regarding porn access have been toughened across the US recently. We’re now at a point where Aylo has officially blocked access to its porn sites, including Pornhub, in around half of all US states, with the company saying it can’t comply with supposedly unworkable age verification rules in them.
An easy workaround has typically been available. Virtual Private Networks (VPNs) allow you to change your device’s geolocation to outside an age verification jurisdiction, and access porn sites without robust age checks.
VPNs can be free or cheap, and turned on with one click. VPN downloads typically spike whenever and wherever a new porn age verification law kicks in.
This raises a question: what the heck is the point of toughening age verification rules, if anyone can just flick their VPN and browse porn like they’re in New York (where no formal ID check is required to access porn)?
Some recent US law changes and proposals seem to be finally catching up to this, raising the prospect of the easy VPN porn access loophole disappearing.
Utah: a VPN crackdown test case
In Utah, an online age verification amendments bill was recently signed into law that puts VPN use squarely in scope.
Bill SB73 states that, “An individual is considered to be accessing the website from this state if the individual is actually located in the state, regardless of whether the individual is using a virtual private network, proxy server, or other means to disguise or misrepresent the individual’s geographic location to make it appear that the individual is accessing a website from a location outside this state.”
This wording raises the legal potential for a porn site to be found liable for not implementing proper Utah age verification processes, if someone in the state uses a VPN to access porn on their site.
Stipulations like this could lead to porn sites being forced to invest in technology that blocks VPN use for their sites, and could lead to there being no easy workaround to access porn sites within the state without going through the full age check process, which many people object to on privacy and security grounds.
SB73 doesn’t become law until October 1, 2026, so it’s far too early to know if and how VPN use for porn access will be cracked down on as a result of it. But it’s part of a slowly growing trend for VPN usage to be addressed in new age verification for porn bills.
In Ohio, the HB84 bill that would strengthen a bill known as the Innocence Act was recently passed by the House of Representatives, and must now go through the Ohio senate before potentially being signed into Ohio state law by the governor. HB84 would require porn sites to use a geofence system to ascertain whether a site user is physically in Ohio and subject to age verification.
As is the case for the Utah bill, this raises the prospect of porn sites operating in Ohio becoming at risk of falling foul of state laws if they don’t crack down on VPN use. As is also the case with Utah, it’s controversial because geofencing involves location tracking users, again raising privacy and safety concerns.
Also, many people use VPNs as a baseline security measure, hiding their real device location and IP address from sites that might track them for potentially nefarious purposes, like infiltrating their device for scamming. Requiring porn sites to block VPN traffic doesn’t just close an age verification loophole, it would force users to choose between their general digital security practices and complying with a porn-specific ID check.
In Washington state, meanwhile, a bill has been proposed that would force porn sites to take “reasonable measures” to tackle age verification circumvention such as VPN use. The wording is vague – never great for a legal bill – but it’s added to the pile of VPN-focused legal stipulations that feels like it could reach tipping point in the near future.
The enforcement problem
VPN use has been no secret when it comes to age verification for porn. But authorities have generally operated on the theory that if official blocks are in place, forcing users to take extra circumvention steps will at least reduce the volume of circumvention. The evidence for this is mixed at best. Major UK porn sites lost significant traffic after age verification launched, but a meaningful portion of that traffic migrated to smaller, less-regulated sites without any age checks — which is arguably the worst possible outcome from a child safety perspective.
That has indeed seemed to be the case. As we reported, Pornhub lost 77 percent of its UK traffic after tougher age verification rules kicked in, with users migrating to less-regulated alternatives rather than simply stopping.
But still, VPN use remains the one big age verification workaround, and one often used for privacy reasons rather than people simply trying to access sites they shouldn’t. Many users have serious concerns about the security of third-party age verification tools, some of which require face scans or submission of official ID, and the closure of VPN loopholes could force them into these processes.
The Discord age verification breach earlier this year, which exposed 70,000 government IDs, is precisely the kind of outcome that makes privacy-conscious users reluctant to submit documents to any platform, and it’s why closing the VPN loophole without a credible alternative to third-party ID submission is a meaningful policy failure, not just an inconvenience.
Aylo has lobbied Apple, Google, and Microsoft to support device-level age verification, arguing that putting the compliance burden on individual sites is both ineffective and privacy-invasive. What that lobbying effort doesn’t acknowledge is that Aylo simultaneously blocks users in some jurisdictions rather than invest in site-level solutions, which is a useful negotiating position if your goal is to make site-level verification look unworkable globally. It’s also worth noting that Aylo has signed up for the European Commission’s age verification app pilot, which rather undermines the consistency of its public lobbying line. The company’s positions shift depending on the jurisdiction and the audience, which somewhat undermines the core argument.
It has been argued that device level age verification could negate the need for third-party verification, and therefore potentially reduce privacy risk and therefore the desire to use VPN circumvention. So far there’s been little response from lawmakers or firms, and site and platform-level verification remains the onus of most legislation in the US and beyond.
Whether legislating against VPN use is technically enforceable, or just another provision that looks decisive on paper while changing nothing in practice, is what the next few years will reveal.
Leave a Reply