Big privacy turn-off: Porn sites ask Americans for ID

Since January this year, people living in the US state of Louisiana have had to bend over backwards to access the most popular porn websites. The sites now greet Louisianians with a full-page notice that they must submit to an age-verification procedure before they can go on to do what they intended to do. The law, which requires porn sites to make sure their visitors are not minors, is a courtesy of conservative Republican lawmakers and aims to protect children from early exposure to indecent content.

The only visible effect of the law so far has been a spike in downloads of an official government app that generates a digital copy of a driver’s license accepted as the legal equivalent of a physical ID in the state. Daily downloads of the LA Wallet app tripled to 5,000 per day early this year. This is because of the peculiarities of the law, which all but forces users to disclose their real identity to others if they want some adult entertainment.

Which sites have implemented the law?

The law requires websites with a “substantial amount” (that is 33.1% or more) of pornographic content to verify the age of the visitors via a “reasonable” age verification method. This may include forcing them to show a digital ID or requiring them to “comply with a commercial age verification system.” This system may in turn require visitors to provide a government-issued ID, or it may be “any commercially reasonable method that relies on public or private transactional data to verify the age of the person.” As the law suggests, a website should decide for itself which age verification method to use. However, the sites that have implemented the law so far all require users to provide their ID.

At least three popular porn websites, Pornhub, Redtube, and Youporn, are now asking users with Louisiana IPs to verify their age with AllpassTrust, a third-party identity verification site that works with the LA Wallet.

First, the would-be pornography viewer must create an account with AllpassTrust. Then they are granted a “universal login” with which they can access the porn sites.

Any website or third-party platform that verifies the age of users is prohibited from retaining any of their identifying information once access to the site has been granted. The law also states that any service provider who “knowingly” retains such information will be liable for damages.

The lawmakers’ aim — to protect children from harmful content — is virtuous, but the means they have chosen may cost adults their privacy and expose their most intimate secrets. Despite assurances that third-party verification services won’t share visitors’ personal information with anyone, it does not mean that it won’t happen in practice, either deliberately or due to oversight.

What can go wrong?

The mere thought of having to reveal your identity in order to access NSFW content can be chilling. And it’s not ‘chilling’ as in ‘Netflix and chill.’ The law shatters the promise, however false, of online anonymity, and you can’t help but wonder what will happen if this data falls into the wrong hands.

As the saying goes, one person can keep a secret, but not two. The more hands a piece of information passes through, the greater the risk that it’ll be mishandled, shared or leaked. Apart from these risks, it also could be passed on to law enforcement under a perfectly legitimate pretext. For example, AllTrustPass’ privacy policy states that it does not share your personal information with third parties or allow them to access it, except for third party suppliers, such as a hosting provider, and the police. The information AllTrustPass may collect includes email address and password (stored as a hash), age status, technical data such as an IP address (which may also be hashed), cookie data, including two Google Analytics cookies, and approximate location. It may not be a lot, but it’s probably enough to make you uneasy.

We also have yet to see what intermediaries other adult sites will use to verify the age of the users when (or if) they decide to implement the law. And here we bump into yet another unknown.

Breeding ground… for fraud

Barely two months after the law came into force, it is still unclear to which sites it will apply. Currently, it is up to the sites themselves to determine whether they meet the definition of a porn site and build in an age verification system. The law does make an exception for bona fide news sites, public interest broadcasters, and news gathering organizations. However, it’s unclear whether public forums such as Reddit, which has a huge number of NSFW-related subreddits, fall within its scope. It does not help that the criteria for what constitutes a child-unfriendly site are murky. For example, how do you measure that 33.1% of the site’s content is pornographic? What if it’s 29%?

Scammers can exploit this uncertainty and create clones of porn sites that trick users into giving up their personal information or even providing copies of their ID documents. Depending on what data the site swindles from users, scammers can steal their money or take a loan in their name. Since not many porn sites sport an elaborate or in any way distinctive design (web design isn’t what one pays attention to when browsing them), mimicking their interface should be a walk in the park for even non-experienced fraudsters.

There’s also the possibility that unscrupulous porn sites could take advantage of the situation to collect users’ data and milk it for money, for example by selling it to data brokers, who can then sell it to advertisers. The porn industry has always been a gray area of the law, full of shady characters, so you can’t expect much integrity there. And even if website owners won’t intentionally break the law, nobody is safe from blunders, especially when you’re dealing with a law fresh out of the legislative oven.

More states can pass similar laws

Louisiana was the first US state to pass a law requiring porn sites to verify the age of their visitors, but it is unlikely to be the last. Lawmakers in more than a dozen other US states have introduced, or plan to introduce, legislation requiring adult websites to verify the age of their viewers. Seven states, including Florida, Virginia, and South Dakota, have introduced what have been described as copycat versions of the Louisiana bill.

It makes sense that Louisiana is paving the way for others, given its pioneering role in digitisation in the US. Thus, in 2018, Louisiana became the first US state to allow law enforcement agencies to accept a driver’s license in digital form.

Age-verification laws like Louisiana’s could put the privacy of many adults at risk if more states adopt them. Whether this is a fair price to pay for making children safer, and whether these laws will actually make children safer, is not a simple question to answer.

Satisfying everyone will be hard

Age verification laws can spell a privacy disaster, especially if not implemented as intended, which is always a huge risk. But that is not to say that the spread of pornography to children is not a problem that needs to be tackled. A recent survey suggested that the majority of children see adult content for the first time before the tender age of 13. What’s even more worrying is that 58% of children report they have seen pornography unintentionally, by stumbling across it online. Studies suggest that early exposure to porn can have lasting negative effects on children’s psyche, such as a distorted view of sexuality and themselves.

Weighing the pros and cons of laws restricting access to pornographic content will be a balancing act. That means lawmakers should not shoot from the hip when dealing with such sensitive and multifaceted issues. For one thing, we hope that the noble desire to protect children won’t backfire on innocent, law-abiding adults.

As for how the latter can get around the current restrictions and preserve their privacy, using a VPN is probably the most simple and effective way. But it’s not the only way. For more tips on how to access PornHub and similar sites even when they’re blocked in your region, see our guide.