Welcome to the ‘papers, please’ internet

It is Hindsighta weekly newsletter featuring an essential story from the world of technology. For more on the Internet’s downward spiral, follow Adi Robertson. Hindsight arrives in our subscribers’ inboxes at 8 a.m. ET. Register for Hindsight here.

In 2018, two years after the British government decided to implement mandatory age barriers on adult websites, it launched an idea called the “porn pass.” The porn pass was a physical card that you purchased by handing your ID to a brick-and-mortar store clerk. It would contain authentication information that would act as a low-tech anonymization system, allowing you to verify that you are over 18 online without entering any personal data.

The idea of ​​having to obtain pornography from the Internet by visiting a corner store was widely considered amusing. This revealed the lengths to which regulators went to balance their plan with inevitable privacy risks, inadvertently demonstrating how difficult that balance was in the process. Few were surprised when the entire audit project was abandoned in 2019, apparently for good.

But the age verification wars were only just beginning, and this year, advocates have racked up victory after victory. The UK’s Online Safety Act now imposes an age restriction on much social media, in addition to porn sites. The EU and Australia are currently testing age verification measures and they are the subject of heated debate in other countries, including Canada. The U.S. Supreme Court overturned decades-old precedent by greenlighting age verification of adult content and at least temporarily allowing such requirements for social media. Critics who have warned of threats to privacy and free speech have had their fears largely ignored. Companies that opposed it began to comply.

What happened between 2019 and 2025? Arguably one of the main factors is simply that the Internet has become more and more of our lives and many people don’t care about it. Critics of age verification have long pointed out that even if you doesn’t If you care about pure “know it when I see it” smut, you should be concerned that age verification laws are preventing children from accessing valuable educational resources while making adults hesitant to access meaningful discourse on the Internet. But a growing public, across the political spectrum, seems to doubt that there is much value online.

Early age verification launches justify many of these critics’ warnings, at least in the short term. The dramatic rollout of OSA in the UK has created a rapid demonstration of almost all the problems with age verification. There were a multitude of different services to give an ID or facial scan to, each creating a new security risk in the event of a breach. There were trivially simple workaround methods, like photo modes in video games. There has been a flood of VPN usage followed by worrying (though so far denied) questions about VPN bans. And there were social networks that blocked content that many people considered appropriate and interesting for minors, as well as a number of smaller sites that chose to leave the country.

The United States has seen much more uneven rollouts, and many states already had age restrictions on pornography pending the Supreme Court’s decision on the matter. But there are still clear indicators of risks. The social network Bluesky began blocking Mississippi users after the Supreme Court allowed that state’s social media age law to take effect, saying some provisions, such as continued tracking of users who are children, would be too difficult to comply with. So, on both sides of the Atlantic, there is evidence that – as expected – age verification laws disproportionately burden smaller services.

The only thing missing at this point is a large-scale exposure of personal information submitted specifically under a verification law. But we are getting closer. Earlier this month, a third-party customer service provider for Discord was hacked, leaking user data potentially including the government IDs of 70,000 users. Before that, a catastrophic hack of dating advice app Tea provided a glimpse into the danger of leaking your identity online.

The benefits from the age limit will likely take time to manifest, so it’s hard to question whether they’re worth it. Some of the alleged harms that justify age restrictions are fairly easy to ignore, such as American conservatives’ unsubstantiated claims that pornography impairs brain development. Others are complex, unresolved questions, such as whether social media harms adolescent mental health overall. And still others are obvious individual tragedies, like cases of harassment and sextortion – the question is whether there are other, less drastic ways to prevent them.

The OSA, which includes other provisions, such as requiring sites to submit risk assessments, has become a political wedge. In July, British Prime Minister Keir Starmer said he felt “very strongly that we should protect our young teenagers”, and a government response to a petition said there were “no plans to repeal the Online Safety Act”. But the law has irked US sites like 4chan, which are loosely aligned with Donald Trump, and Britain’s reform leader Nigel Farage has promised he would repeal it over free speech concerns.

Other countries are also continuing their projects. The EU’s age verification measures are currently in the testing phase and Australia’s are expected to come into force in December.

Age verification on porn sites appears to remain in the United States, but general social media verification is on shakier ground. Although it has allowed the Mississippi state law to apply for now, the only comment offered by the Supreme Court indicates that it is likely unconstitutional. Perhaps the most complicated gray area is sites that don’t ban pornography but also host huge volumes of other content, like Reddit and Bluesky.

Companies are trying to pass the buck. Meta, Google and Apple are engaged in a lobbying war in the US over laws that put responsibility for age verification on app store operators rather than individual services – Meta unsurprisingly likes the idea, while Apple and Google don’t.

But regardless of how the laws evolve, many platforms – including Roblox and YouTube – are strengthening verification measures themselves. Metrics sometimes involve analyzing account creation dates and usage patterns rather than requiring IDs or facial scans. But if that analysis is wrong about a user’s age, they will often have to upload… you guessed it, a photo ID.