This is The Stepback, a weekly newsletter breaking down one essential story from the tech world. For more on the downward spiral of the internet, follow Adi Robertson. The Stepback arrives in our subscribers’ inboxes at 8AM ET. Opt in for The Stepback here.
Back in 2018, two years after the UK government decided to implement mandatory hard age gates on adult websites, it floated an idea called the “porn pass.” The porn pass was a physical card you’d buy by handing over your ID to a brick-and-mortar shop attendant. It would contain authentication information that would act as a low-tech anonymization system, letting you verify you were over 18 years old online without entering personal details.
The idea of having to get internet porn by visiting a corner shop was largely considered funny. It revealed the tortured lengths regulators had stretched to balance their plan with the inevitable risks to privacy, inadvertently demonstrating how difficult that balance was in the process. Few were surprised when the whole verification project was scrapped in 2019, seemingly for good.
But the age verification wars were just beginning, and this year proponents have been chalking up win after win. The UK’s Online Safety Act now mandates age-gating on much of social media in addition to porn sites. The EU and Australia are currently trialing age verification measures and they’re hotly debated in other countries, including Canada. The US Supreme Court has overturned a decades-old precedent by greenlighting adult content age verification and at least temporarily allowing such requirements for social media. Critics who warned of threats to privacy and free speech have had their fears largely disregarded. Companies that once objected have started to comply.
What happened between 2019 and 2025? Arguably, a major factor is simply that the internet has taken over more and more of our lives and lots of people are souring on it. Critics of age verification long emphasized that even if you didn’t care about pure “know it when I see it” smut, you should worry that age verification laws would prevent children from reaching valuable educational resources while making adults hesitant to access meaningful speech on the internet. But a growing constituency across the political spectrum seems dubious there’s much of value online at all.
Early age verification launches are vindicating many of those critics’ warnings, at least in the short term. The UK’s splashy OSA rollout created a rapid demonstration of nearly every problem age verification poses. There was a thicket of different services to give an ID or facial scan to, each one creating a fresh security risk if a breach occurred. There were trivially simple circumvention methods, like video game photo modes. There was a flood of VPN usage followed by ominous (though so far denied) questions about VPN bans. And there were social networks blocking content many people believed was appropriate and worthwhile for minors, plus a number of small sites that chose to leave the country.
The US has seen much spottier rollouts, and many states were already age-gating porn while awaiting the Supreme Court’s ruling on it. But there are still clear indicators of the risks. The social network Bluesky began blocking users from Mississippi after the Supreme Court allowed that state’s social media age-gating law to take effect, saying some provisions, like keeping ongoing track of which users are children, would be too difficult to comply with. So on both sides of the Atlantic, there’s evidence that — as prophesied — age verification laws disproportionately burden smaller services.
About the only thing missing at this point is a large-scale exposure of personal information submitted specifically under a verification law. But we’re getting close. Earlier this month, a third-party customer service provider for Discord was breached, leaking user data that included potentially 70,000 users’ government IDs. Before that, a catastrophic hack of the dating advice app Tea offered a preview of how dangerous having your ID leaked online could be.
Any benefits that do result from age-gating will probably take time to emerge, so it’s hard to even have an argument about whether they’re worth the tradeoffs. Some of the alleged harms that justify age-gating are fairly easy to discount, like US conservatives’ unsubstantiated claims that porn impairs brain development. Others are complicated and unsettled questions, like whether social media overall harms teens’ mental health. And still others are obvious individual tragedies, like instances of harassment and sextortion — the question is whether there are other, less drastic ways to prevent them.
The OSA, which includes other provisions, like requiring sites to submit risk assessments, has become a political wedge. In July, UK Prime Minister Keir Starmer said he felt “very strongly that we should protect our young teenagers,” and a government response to a petition said there were “no plans to repeal the Online Safety Act.” But the law has antagonized American-owned sites like 4chan that are loosely aligned with Donald Trump, and Reform UK leader Nigel Farage has promised he’d repeal it over free speech concerns.
Other countries are still moving forward with their plans, too. The EU’s age verification measures are currently in testing, and Australia’s are scheduled to start taking effect in December.
Age verification on porn sites seems here to stay in the US, but blanket social media verification is on shakier ground. Despite allowing Mississippi’s state law to proceed for now, the only commentary the Supreme Court offered says it’s probably unconstitutional. The most complicated gray area may be sites that don’t ban porn but also host huge volumes of other material, like Reddit and Bluesky.
Companies are busy trying to pass the buck. Meta, Google, and Apple are in a US lobbying war over laws that put the responsibility for verifying ages onto app store operators instead of individual services — Meta unsurprisingly likes that idea, while Apple and Google unsurprisingly don’t.
But regardless of how the laws turn out, many platforms — including Roblox and YouTube — are beefing up verification measures on their own. The measures sometimes involve analyzing account creation dates and usage patterns rather than requiring IDs or facial scans. But if that analysis gets a user’s age wrong, they’ll often have to upload… you guessed it, a photo ID.
- Europe and North America aren’t remotely the pioneers of online ID checks. South Korea started requiring internet users to submit their real names as early as 2004, and China has regulated children’s internet use right down to the hours they can play video games. That said, South Korea’s rules have been repeatedly modified and in some cases overturned by courts due to practical problems and speech concerns, while China’s rules are part of a surveillance and censorship regime that’s now punishing people for being sad online.
- There are many child safety proposals that aren’t explicitly age verification mandates, but that may amount to backdoor gating — nearly any rule that adds special requirements for underage users logically implies that sites have to identify these users somehow.
- However, lawmakers do have meaningful alternatives. They include more funding for agencies that investigate online child exploitation and laws that target specific harmful behaviors like invasive ads and lax privacy standards for all ages. The EU and UK already have all-around digital privacy frameworks. The US very much does not.
- The US is overall in a spectacularly bad position to start limiting online anonymity — we’ve got much bigger problems that current child safety proposals will only make worse.
