Age Verification Laws for Adult Websites in 2026

A working map of age verification law for adult websites, as of September 2026, built only from statutes and regulator publications we read in the original. This is not legal advice. We recommend, and your counsel decides what applies to you.

The shape of it, as of September 2026

Five years ago an adult site could treat "are you over 18" as a button. In several of the largest markets that is no longer the operating assumption. Legislatures and regulators have moved toward requiring a real check, and toward judging it on whether it works rather than on whether it exists.

The rules are not converging. They differ on who is covered, on how much of a site's content triggers the duty, on which methods count, and on what happens to the data. For an operator that means a policy per territory rather than one gate. Everything below is dated and sourced to the documents listed above; where we could not verify a jurisdiction that way, we left it out.

United States

The constitutional question was decided in 2025

In Free Speech Coalition, Inc. v. Paxton, decided June 27, 2025, the Supreme Court considered Texas H.B. 1181, which it describes as "requiring certain commercial websites publishing sexually explicit content that is obscene to minors to verify that visitors are 18 or older."

The Court held that the statute triggers and survives review under intermediate scrutiny, because it burdens the protected speech of adults only incidentally. The syllabus is direct: a state's power to keep minors from content obscene to them "includes the power to require proof of age before an individual can access such speech." For an operator, what matters is the effect: the main federal argument against this class of statute did not succeed, and legislatures acted accordingly.

What a state statute asks for

Texas H.B. 1181 covers a commercial entity that knowingly and intentionally publishes or distributes material on a website "more than one-third of which is sexual material harmful to minors." Covered entities must use reasonable age verification: per the enrolled bill analysis, digital identification, a commercial system relying on government-issued identification, or a commercially reasonable method using transactional data. Neither the entity nor the third party performing the check may retain identifying information. The analysis records civil penalties of up to $10,000 per day of violation, with further amounts for improper retention and for a minor actually accessing the material.

Louisiana R.S. 9:2800.29 reaches a similar place by a different route. It creates a civil remedy: an entity that publishes material harmful to minors "from a website that contains a substantial portion of such material" is liable if it fails to perform reasonable age verification, and is liable to the individual for damages, court costs and attorney fees. The same prohibition on retaining identifying information applies.

Two differences matter to a site owner: each state writes the coverage threshold differently, and the enforcement mechanism differs too. One is a penalty regime, the other a private lawsuit. With no federal statute covering adult websites, coverage is decided one legislature at a time and the list changes between sessions. We are not publishing a count, because a count is stale within weeks and the only check that holds up is the text of the state's own law.

United Kingdom

The Online Safety Act puts duties on services rather than content categories, and Ofcom is the regulator. In guidance published on 16 January 2025, Ofcom set the expectation that all services allowing pornography have highly effective age assurance in place "by July 2025 at the latest."

Ofcom's categories matter. Services that publish their own pornographic content are "Part 5" services, and Ofcom's own example of that category is "studios or pay sites." Services carrying user-generated pornographic content are "Part 3," with tube sites, cam sites and fan platforms given as the examples. If you run your own paysite, you are the publisher.

On the standard itself, Ofcom confirmed that a method must be "technically accurate, robust, reliable and fair," published a non-exhaustive list of methods capable of meeting that bar, and decided against numerical accuracy thresholds at this stage. It also opened an enforcement program focused first on Part 5 services.

France

France works through its regulator, Arcom. Under the law of 21 May 2024 on securing and regulating the digital space, known as the SREN law, Arcom adopted a reference framework on 9 October 2024 setting the minimum technical requirements for age verification systems used to reach online pornographic content. Arcom's published enforcement route is a formal notice first, and a financial sanction where the breach persists.

The European Union

On 14 July 2025 the European Commission published guidelines on the protection of minors under the Digital Services Act. They apply to online platforms accessible to minors, excepting micro and small enterprises, and the Commission says it will use them when assessing compliance with Article 28(1).

On age checks, the guidelines recommend methods that are "accurate, reliable, robust, non-intrusive, and non-discriminatory," and specifically recommend age verification for adult content such as pornography. The Commission is explicit that following them is voluntary and does not by itself establish compliance.

Australia

Australia regulates through industry codes that carry legal force. eSafety registered the Age-Restricted Material Codes in June and September 2025 and describes them as mandatory and enforceable, though industry-drafted.

For designated internet services, relevant electronic services, social media services, app distribution platforms and equipment providers, the codes took effect starting on 9 March 2026. Some obligations commence later: age checks for logged-in users of search engine services before 27 June 2026, and for downloads of R18+ apps from app distribution services before 9 September 2026.

The substantive standard reads familiarly. The Codes Head Terms require age checks to be "technically accurate, robust, reliable and fair," and eSafety guidance adds that providers should offer more than one method, should not rely on government-issued identification alone, and are expected to take reasonable steps against workarounds, including detecting whether a user is on a VPN.

Verify, block or allow

Across those five jurisdictions the decision is the same shape; only the input changes. Per territory, you choose one of three postures: verify before access, block, or allow as you do today. Verification adds friction and a vendor. Blocking removes a market. Allowing is a position you should be able to explain.

That decision is what our own product exists to hold. Verisdiction lets a site set the posture per jurisdiction rather than hard-coding one global gate, and it ships with every site we build. We are describing what the tool does, not what a regulator will make of your configuration. That judgment is yours and your lawyer's.

Why this keeps moving

Three forces keep the map unstable: legislatures pass and amend statutes, regulators publish guidance that changes what an existing duty means in practice, and courts test individual laws in ways that can change a jurisdiction's status with no new legislation at all. The maintainable answer is to treat jurisdiction rules as configuration rather than code, note why each territory is set the way it is, and review on a schedule.

Questions we get

Is this legal advice?

No. This post summarizes public statutes and regulator publications as of September 2026, and nothing more. The law differs by country and by state, and it changes often. We recommend; your counsel decides what applies to your business.

Do I have to store customers' ID documents?

Both statutes quoted above point the other way. Texas H.B. 1181 and Louisiana R.S. 9:2800.29 each prohibit retaining identifying information after access has been granted, and Ofcom and eSafety both treat privacy-preserving methods as part of a defensible approach. Hold as little as possible, and take advice before deciding what to keep.

Which verification method counts?

That depends on the jurisdiction. Ofcom lists methods capable of being highly effective without setting thresholds. Texas names categories of acceptable method in the statute. The EU guidelines and the Australian codes describe qualities rather than products. No single method satisfies every regime at once.

Talk it through

If you are deciding which territories to serve and how to gate them, bring the specifics: your markets, your traffic, your content, and what your counsel has told you. Book a call and we will walk through how the gate would be configured for your site.

Sources

• — Free Speech Coalition, Inc. v. Paxton, No. 23-1122 (U.S. Supreme Court, decided June 27, 2025)
• — Texas Legislature, H.B. 1181 enrolled bill analysis (88th Regular Session)
• — Louisiana State Legislature, R.S. 9:2800.29
• — Ofcom, Age checks to protect children online
• — Arcom, Technical guidelines on age verification for the protection of persons under 18 from online pornography
• — European Commission, Commission publishes guidelines on the protection of minors (DSA)
• — eSafety Commissioner (Australia), FAQs about access to online porn and other adult content