If your platform serves adult content and you haven't touched your age-gate in the last year, it's almost certainly non-compliant somewhere. What used to be a single checkbox ("I am 18+") has turned into a patchwork of 25+ US state laws, a French regulator with the power to order ISP blocking within 48 hours, and an EU-wide age verification app rolling out across the bloc. The laws don't ban adult content — they ban serving it to unverified users, and enforcement has moved from warning letters to actual blocking in the last twelve months.

This is a compliance article, not a legal one — talk to counsel about your specific jurisdictions. But here's the operating picture every adult merchant needs before their next board meeting or payment processor review.

The US Patchwork: 25+ States and Growing

Louisiana was first, requiring age verification starting January 1, 2023. Since then the list has grown fast: Arkansas, Mississippi, Montana, North Carolina, Texas, Utah, and Virginia followed in 2023; Alabama, Idaho, Indiana, Kansas, Kentucky, Nebraska, and Oklahoma in 2024; and Arizona, Florida, Georgia, Missouri, North Dakota, Ohio, South Carolina, South Dakota, Tennessee, and Wyoming in 2025. That's 25 states with laws actively in effect as of mid-2026, with several more expected to pass legislation before year end.

The trigger is usually a "substantial portion" test — commonly one-third or more of a site's content being classified as adult material — which pulls in far more than dedicated tube sites. Subscription platforms, cam sites, and creator platforms with a mixed content library all need to evaluate whether they cross that threshold in each state they serve.

Two things changed the legal landscape recently and are worth knowing:

  • Free Speech Coalition v. Paxton (June 2025): The Supreme Court upheld Texas's HB 1181 in a 6-3 ruling, which removed the main legal uncertainty that had kept some operators from complying. Most subsequent state laws are modeled closely on the Texas approach and are expected to survive similar challenges.
  • Penalties are real money, not theoretical: Louisiana imposes $5,000 per day in fines, or $10,000 if the violation is found to be knowing. Arizona set a $10,000-per-day fine. Kentucky and North Dakota allow civil suits for violations, and Tennessee classifies violations as a Class C felony.

Why Pornhub's Approach Isn't a Playbook for Most Merchants

Aylo (Pornhub's parent company) chose to geoblock rather than comply in most states with age-verification laws, arguing the requirements push users toward handing sensitive ID data to third parties. The company has confirmed the strategy costs real traffic — it saw roughly an 80% drop in Louisiana after that state's law took effect, and similar drops elsewhere as it exited market after market.

That's a defensible strategy for a free, ad-supported tube site where the business model doesn't depend on individual account relationships. It's a much harder call for a subscription platform, cam site, or creator platform where the customer relationship — and the recurring billing — is the entire business. For most paid adult merchants, geoblocking an entire state means giving up the revenue permanently rather than converting it. Compliance is usually the better economic bet once the state's population is large enough to matter.

France: The Strictest Regime Merchants Will Encounter

If you have any French traffic, France's SREN Law (Law n° 2024-449) is worth understanding on its own, because ARCOM — the French digital regulator — has built one of the most prescriptive frameworks in the world and has shown it will act on it.

ARCOM's technical standard, finalized in October 2024, requires:

  • Verification at every session, not just at first registration
  • No pornographic content displayed on the landing page before verification completes
  • At least two distinct verification methods offered, with at least one operating as "double-blind" — meaning the age-verification provider never learns which site the user is trying to access, and the site never learns the user's identity, only a yes/no signal
  • An independent third-party provider, not a verification flow built and run by the adult site itself

ARCOM doesn't wait long to act. In one enforcement round, it issued formal notices to five EU-established pornographic sites after finding no verification in place, with the power to order court-mandated blocking if a site doesn't respond. The law applies to any site accessible from France, regardless of where it's hosted — so a US-based platform with French traffic is in scope even without a French entity.

Where the EU Is Headed

France is a pilot member of a broader EU age verification app, which began rolling out in April 2026 and uses zero-knowledge proof technology — the same privacy-preserving approach behind France's double-blind requirement — to confirm a user is over 18 without the site or the verification provider learning who they are. Expect this model, not the "upload your driver's license" approach, to become the EU default over the next few years, and expect other member states to follow France's enforcement posture rather than wait for Brussels.

What "Third-Party Verification" Actually Means for Your Checkout Flow

Almost every law in this space — US state laws and ARCOM alike — pushes merchants toward using an independent age-verification provider rather than building an in-house age gate. There are two structural reasons for this, and both affect how you should shop for a vendor:

  • Liability separation. If age verification is handled by a specialized third party and something goes wrong, regulators and courts generally look at whether the merchant used a "reasonable" method — and an established third-party provider is much easier to defend as reasonable than an in-house solution built without compliance expertise.
  • Data minimization. Several state laws (Utah and Louisiana explicitly) prohibit the verification provider from retaining identifying information once access is granted. That's a hard requirement to meet if the adult platform itself is doing the verifying and storing the data.

In practice, verification methods fall into three tiers, and most compliant setups now offer more than one:

  • Government-issued ID checks — the most accurate, but also the highest-friction and highest-liability option, since it involves handling actual ID documents.
  • Facial age estimation — a selfie-and-liveness check that estimates age without confirming identity. Lower friction, avoids ID document handling, but works best paired with a document fallback for edge cases near the age threshold.
  • Transaction-data-based verification — confirming age indirectly through existing records like mortgage, education, or employment data, without the user submitting anything new. Several state laws explicitly recognize this as an acceptable "commercially reasonable method."

What This Means for Your Payment Processor Relationship

Age verification isn't just a legal requirement — it's increasingly something your payment processor and acquiring bank will ask about directly during underwriting and renewal. Adult content already carries elevated scrutiny; a merchant who can point to an active, documented, third-party-run verification system is a materially easier account for a high-risk processor to keep on the books. A merchant who can't is a growing liability the processor has to weigh against its own compliance exposure.

If you're shopping for or renewing a high-risk merchant account for an adult platform, be ready to show your age-verification vendor, which states or countries it covers, and how recently it was updated for the newest state laws. Compare high-risk merchant account providers who work with compliant adult platforms rather than waiting for your current processor to raise the question first.

Frequently Asked Questions

Do I need age verification if my site is hosted outside the US or EU?

Usually yes, if you have users in those jurisdictions. Most of these laws apply based on where the user is located, not where the site is hosted — France's SREN Law explicitly applies to sites established outside the EU, and several US state laws work the same way.

What counts as an "adult" site under these laws?

Most US state laws use a "substantial portion" test, commonly one-third or more of total content being classified as pornographic or harmful to minors. Thresholds vary by state, so a mixed-content platform should check each state's specific definition rather than assuming a blanket exemption.

Can I just require a credit card as age verification?

Some laws allow card-based verification as a transitional or fallback method, but it's increasingly disfavored on its own — France phased it out except as one option among several, and most current laws expect a dedicated verification method rather than treating checkout itself as the age gate.

What happens if I don't comply?

Penalties vary by state but are substantial: Louisiana and similar states impose daily fines in the thousands of dollars, some states allow civil lawsuits, and France's ARCOM can order ISP-level blocking. Non-compliance also creates real risk to your merchant account, since processors increasingly treat verification status as part of ongoing risk review.