Age Checks Are Moving From Porn Sites Into Every App Store

On a phone in Louisiana, the policy once appeared as a plain button: “Verify with LA Wallet.” Pornhub users were directed to the state-backed digital wallet, which could confirm that the phone’s owner was over 18 without handing the site a conventional photograph of a driver’s license.

That button looked narrower than the usual upload screen. It also contained the blueprint for something much larger. The state set the legal demand, an identity system translated a government credential into an age signal, and a private platform decided whether the signal was sufficient to open the door. Each actor could say it was not building a list of pornography viewers.

The system still produced a verification event tied to a device, a network connection and a particular moment.

Louisiana’s law, in force since 2023, applied to commercial websites with a substantial share of material deemed harmful to minors. Similar laws followed elsewhere. Some adult platforms installed checks. Pornhub and other sites instead blocked access in several states, placing the cost of compliance and the political blame in front of users.

Then the model moved. State lawmakers began writing age requirements for social platforms, while Utah and Texas enacted laws that put app stores in the verification chain. The Pornhub button was no longer a specialist gate outside an adult venue. It was becoming a model for entering the mall.

Three different things sold as one check

Lawmakers often use “age verification” as if it describes a single technical act. It does not.

An age estimate is an inference. A vendor might analyze a selfie and predict whether the face belongs above or below an age threshold, sometimes adding a margin so that people near the boundary must use another method. Yoti and other vendors market versions of facial age estimation, commonly promising that the image can be deleted after analysis. The system does not need to learn a name to make its guess.

That distinction matters. An age estimate can exclude adults whose faces are read incorrectly, and its accuracy can vary across ages and populations, but it does not inherently require a government identity. The trade is uncertainty for less identification.

An identity check takes a different route. The user presents a driver’s license, passport, credit record or digital credential, and the system checks a stated birth date or adult status. Some services also compare a live selfie with the document photograph. This can establish much more than age, even when the website eventually receives only an over-18 result.

A retained identity record is what remains after the gate opens. It might be a stored license image and name, but it can also be a vendor transaction number, an account flag, an IP address, device information or a timestamp showing that one account completed a check. A site can truthfully say it never received your license while its contractor handled the document and both parties retained logs.

Those records are not equivalent. A reusable token saying “adult” carries less information than a passport scan. A token linked to the same account across services, however, can become a durable identifier through repetition. Data minimization, the practice of collecting and keeping only what a task requires, depends on contract terms, deletion schedules and system design rather than the comforting size of the button.

The “Verify with LA Wallet” screen therefore answers only part of the privacy question. It says how a user proves adulthood at the front end. It does not, by itself, disclose which logs exist behind the screen, who can reconcile them or how long each organization keeps them.

The law creates a market before it creates a standard

Age-check mandates make publishers, platforms and distributors buy compliance. Vendors sell document checks, face estimates, database queries and reusable age credentials; lawyers interpret each state’s trigger; engineers connect the result to an account or session. The user usually pays in delay, failed attempts and disclosure rather than at checkout.

The incentives are uneven. A regulated company wants evidence that it performed the required check if a regulator, plaintiff or payment partner comes calling. A privacy-preserving system wants to reveal as little as possible and discard the evidence. Those goals can coexist when a system records that a valid anonymous credential was presented, but companies must choose that architecture, test it and explain it.

The law’s demand for “reasonable” verification does not magically produce the least invasive implementation.

State statutes may forbid a covered website from retaining identifying information. That protection is binding where the statute applies, but its reach can be narrower than the verification chain: a separate vendor may operate under different language, technical logs may not be treated as identifying information, and a deletion promise still needs enforcement. A ban on keeping a driver’s license is useful. It is not the same as leaving no record.

The vendor market also rewards scale. One age provider can sit between many services and millions of checks, which reduces integration costs while concentrating valuable information about devices and verification attempts. Centralization is attractive because nobody wants to upload a license to every app. It is dangerous for the same reason.

Porn law did not remain porn law

The legal theory changes as the target widens.

In June 2025, the US Supreme Court upheld Texas’s age-verification requirement for commercial sites publishing large amounts of sexual material harmful to minors. The Court treated the burden on adults as incidental to a law aimed at minors and applied a less demanding form of First Amendment review than the adult-industry challengers sought.

That ruling is binding on the constitutional question it decided. It does not declare every age-check law valid, approve every vendor method or authorize a government database of adult browsing. Texas’s threshold, the covered material and the law’s privacy terms still matter. A state cannot paste the phrase “protect children” onto unrelated restrictions and inherit a blank check.

Social-media laws expose the difference. States including Arkansas and Utah pursued restrictions that required age checks or parental controls across broad categories of platforms, rather than at sites organized around material legally restricted for minors. Courts have blocked or disrupted several such efforts while litigation proceeds, often because definitions sweep across services with very different functions or because the rules burden access to protected speech.

This is where “age appropriate” becomes a distribution policy. A platform that knows a user’s bracket can restrict direct messages, search results, recommendations and advertising. Those choices may reduce specific risks. They can also encourage platforms to classify everyone, including adults who never asked for a child account, because the company cannot apply an age-based rule until it assigns an age.

The mechanism changes behavior before a final court ruling. Companies plan products around enforcement dates, payment partners avoid uncertain exposure, and smaller services may block a state rather than purchase verification. An injunction can pause a statute. It does not refund the engineering work or restore a market that already exited.

The app store becomes the checkpoint

Utah’s App Store Accountability Act moved the check up the distribution chain. Instead of making every app independently determine age, the law places duties on app-store operators and calls for age categories to be shared with developers, with parental approval involved for minors. Texas enacted its own app-store framework as well.

This arrangement can reduce repeated document uploads. Apple and Google already control accounts, payment systems and access to mobile software, so lawmakers see two convenient enforcement points rather than thousands of developers. Convenience here means expanded gatekeeping power. The app store can become the institution that assigns an age category before a person downloads a dating app, a browser, a social network or something with no sexual content at all.

The category shared with a developer may be less revealing than a birth date. Yet the store knows which account requested which app, while the developer learns that the user falls into a bracket and may record the resulting consent status. When those signals are attached to stable accounts, an age check stops being a moment at the door and becomes an account property that travels.

That is the wider consequence hidden inside the Louisiana button. Pornography supplied the politically easy test case because few legislators expect sympathy for its distributors, and “show ID at an adult store” sounds familiar. The digital version is different: the clerk may be a remote contractor, the ID may become a token, and the same gate can be installed at the operating-system level.

What a narrower system would require

A less invasive rule would start with the minimum fact a service needs. If the legal threshold is 18, the service generally needs an adult-or-minor answer, not a name, address and exact birthday. Anonymous credentials can let an issuer confirm that threshold without disclosing the underlying identity, though they still require trustworthy software and protections against linkable reuse.

Lawmakers could also specify deletion deadlines, prohibit use for advertising, limit disclosure to developers, require independent security testing and give users a non-biometric route. Those are policy choices, not features automatically included in “age assurance,” the industry term for methods that estimate or establish age.

The alternative is already visible. A person taps “Verify with LA Wallet,” receives access and moves on, while the meaningful decisions remain buried in vendor contracts, statutory definitions and retention logs. The screen asks for one fact. The infrastructure may remember considerably more.

Questions people ask

Do age-verification laws always require a photo ID?

No. Depending on the law and service, a user may verify through a digital credential, payment or transactional data, a database check, or facial age estimation. Some methods establish identity; others return only an age range. The label on the screen rarely explains the full difference.

Can a site say it stores no ID and still keep data about the check?

Yes. The site may receive only an adult-status result while a vendor handles the document, and either company may retain transaction identifiers, account flags, timestamps, IP addresses or security logs. Those records are less revealing than a license scan but can still link a verification event to an account or device.

Does the

Supreme Court ruling make every state age-check law legal?

No. The 2025 ruling upheld Texas’s requirement for certain commercial sites carrying sexual material harmful to minors. Broader laws covering social media or app distribution can raise different speech, privacy and drafting issues, and several have faced injunctions or continuing challenges.

Why are states putting age checks in app stores?

App stores offer a small number of enforcement points for a huge software market. One account-level check can pass an age category to many developers, reducing repeated uploads while giving Apple, Google and their verification partners a larger role in deciding how users enter ordinary apps.