What would ethical age verification look like online?

Age-verification laws are sweeping the world. These mandates typically require websites that host explicit content — and some that don't — to obtain personal data from visitors to ensure they're over 18. 

Lawmakers who put these laws forward say they do so to keep minors away from adult content. But experts have also warned Mashable about the privacy and security risks that could arise from these mandates. This year, multiple studies have suggested that these laws don't actually work to keep minors off porn sites. 

With that in mind, is age verification, as it stands, ethical? And what would constitute ethical age-verification? Mashable spoke to several experts, and they all had a similar answer: device-level filters.

Current age-verification systems

In most cases, from the majority of U.S. laws to the UK's Online Safety Act, age verification is platform-based. This means that it's the responsibility of websites to install these age checks — and it hasn't been going well. 

"Age gating, especially the current technology that is available, is ineffective at achieving the goals it seeks to achieve, and minors can circumvent it," said senior policy counsel for ACLU, Cody Venzke. 

A study published in November noted that when these laws took effect in different states, searches for VPNs (virtual private networks, which can mask someone's true location) have skyrocketed, suggesting that people are attempting (and succeeding) to circumvent the laws. Searches for porn sites also increase, which might indicate people searching for websites that don't comply with these laws. 

The ethics behind these systems are murky at best, Mike Stabile, director of public policy at adult industry trade organization, the Free Speech Coalition, told Mashable. "In practice, they've so far functioned as a form of censorship." 

Because of the fear around exposure and data processing — and already we're seeing IDs being exposed, like in October's Discord hack — adults are dissuaded from accessing porn sites. That same November study suggested that the cost of impeding on adults' First Amendment rights (the right to free speech and free expression) doesn't outweigh the benefit of limiting minors' access to porn.

"Unfortunately, we've heard many of the advocates behind these laws say that this chilling effect is, in fact, good. They don't want adults accessing porn," Stabile said. 

Indeed, some lawmakers believe that porn shouldn't be accessible to anyone. Project 2025, the blueprint for President Trump's second term, calls for an outright porn ban and the imprisonment of creators. A Project 2025 co-writer, Russell Vought (who heads the Office of Management and Budget) was caught on a secret recording in 2024, reportedly calling age-verification laws a porn ban from the "back door."

But there is another solution: Device-level filters.

An ethical age assurance method?

"Storing people's actual birth dates on company servers is probably not a good way to approach this, especially for minors... you can't change your birth date if it gets leaked," senior director of AI programs at nonprofit Common Sense Media, Robbie Torney, told Mashable. 

"But there are approaches that are privacy-preserving and are already established in the industry that could go a long way towards making it safer for kids to interact across a wide range of digital services."

We can also distinguish between age verification and assurance. While some people use this interchangeably, the difference is that "age assurance" is more of an umbrella term that includes all the methods you could use to determine age without being prescriptive as to how, while verification typically applies to confirming exact age, like checking ID, Torney said. 

One real age assurance approach that's more privacy-preserving, according to Torney, is outlined in California's law AB 1043, which will take effect in 2027. 

AB 1043 requires operating systems — the software that powers phones, tablets, and computers — to request an age or birthday during setup. Then, it creates an age bracket signal (not your exact age, but a range) on the device, and that signal will be sent to applications, blocking someone if they're underage. 

The law, therefore, requires a device-level filter, something that Aylo (Pornhub's parent company) and free speech experts have recommended for years. 

"Any solution should be easy to use, privacy-preserving, and consumer-friendly. In most cases, that means the verification is going to happen once, on the device," Stabile said. 

Founder and CEO of child safety nonprofit Heat Initiative, Sarah Gardner, told Mashable the same. "Device-level verification is the best way to do age verification because you're limiting the amount of data that you give to the apps. And many of the devices already know the age of the users," she said. 

Apple already implements different safeguards at the device level, she explained. The Communication Safety feature, for example, warns children when they receive or send media containing nudity through iMessage and allows them to get help. Apple recently expanded age-appropriate protections to kids aged 13-17, which includes web content filters.

So it's possible for tech giants like Apple to implement this (and in 2027, they will have to, given the California law). 

But AB 1043 doesn't apply to websites, including adult websites. It only applies to device makers and app stores, allowing apps to restrict age.

"Frankly, we want AB 1043 to apply to adult sites," Stabile said. "We want a signal that tells us when someone is a minor. It's the easiest, most effective way to block minors and doesn't force adults to submit to biometrics every time they visit a website."

Last month, Pornhub sent Apple, Google, and Microsoft letters urging them to enable device-level age assurance for web platforms. Each of the letters, which were shared with Mashable, mentions AB 1043.

Venzke told Mashable that the ACLU is watching the conversations on device-based verification closely and questioning whether they protect people's privacy. 

Will device-level age assurance be adopted more broadly?

Whether the tech giants will go for Pornhub's proposal is a different story. Microsoft declined to comment to Mashable, while an Apple spokesperson linked to a Newsroom update regarding the changes to under-18 accounts. The spokesperson also linked to a child online safety white paper that states, "The right place to address the dangers of age-restricted content online is the limited set of websites and apps that host that kind of content."

Regarding the letter, Google told Mashable that it's "committed to protecting kids online, including by developing and deploying new age assurance tools like our Credential Manager API [application programming interface] that can be used by websites. We don't allow adult entertainment apps on Google Play, and certain high-risk services like Aylo will always need to invest in specific tools to meet their own legal and responsibility obligations."

Torney said that a layered approach to age assurance will likely be necessary in many cases, and Common Sense's stance is that the responsibility lies on both sites, like Pornhub and operating systems. "This has been a little bit like hot potato" between the two, he said.

Despite all these efforts, no age assurance method will be 100 percent effective, Torney said. "But if you're operating from a vantage point of wanting to reduce harm, to increase appropriateness, and to increase youth wellbeing, a more robust age assurance system is going to go much farther to keep the majority of teens safe."