- Free Speech Coalition v. Paxton (27 June 2025) settled the US constitutional question: the Supreme Court upheld Texas's age verification law 6-3, applying intermediate scrutiny.
- State laws multiplied afterwards. Around 27 states now require commercial adult sites to verify age, with different thresholds, different enforcement and different penalties.
- In the UK, the Online Safety Act 2023 duties have been enforced by Ofcom since 25 July 2025: services allowing pornography must use highly effective age assurance. Self-declaration does not qualify.
- The duties fall on platforms, not on individual creators. But an agency that runs its own site, portal or community can be in scope, and so can a creator selling directly from their own website.
- Practical consequence for everyone in the sector: traffic patterns changed, VPN use rose, and direct-to-fan sites are now a compliance project rather than a weekend build.
Texts and figures checked on September 7, 2026. Sources are listed at the end of the article.
For twenty years, age verification for adult sites in the United States was a settled question with a settled answer: courts struck the laws down. That ended on 27 June 2025. Britain arrived at the same destination by a different road a month later. Between them, the two changes have done more to reshape how adult content is distributed than anything since the platforms themselves — and most of the people in this industry still think of it as somebody else's problem.
For a creator on a major platform, it largely is. For an agency thinking about building its own site, it is not.
The United States: what Paxton changed
Free Speech Coalition, Inc. v. Paxton was decided on 27 June 2025, 6-3, in an opinion by Justice Thomas. At issue was Texas House Bill 1181, which requires age verification for any commercial website where more than one third of the content is "sexual material harmful to minors", and provides for enforcement by the Texas Attorney General.
The doctrinal move that decided the case was the standard of review. The challengers argued for strict scrutiny, relying on the line of cases that struck down earlier federal attempts. The Court instead applied intermediate scrutiny, on the reasoning that the statute regulates access by minors to speech that is unprotected as to them, and burdens adults' access only incidentally. Under that standard, the law survived.
Two things follow.
The constitutional obstacle is gone. States that had been waiting now legislate freely, and challenges to laws that resemble HB 1181 have a much harder path.
The laws are not uniform. Around twenty-seven states now impose age verification requirements on commercial adult sites, and the count has moved repeatedly. They differ on the content threshold that triggers the duty, on what verification is acceptable, on data retention, and — crucially — on who enforces. Some rely on the state attorney general. Others create a private right of action with statutory damages, which is a very different risk profile: it means plaintiffs' firms, not regulators.
The practical result is that a US-facing direct-to-consumer adult site needs a state-by-state compliance matrix, geolocation, and a verification vendor. That is a project with a budget, not a plugin.
The United Kingdom: highly effective age assurance
The Online Safety Act 2023 put the duty on services rather than on states, and Ofcom has been enforcing the relevant children's safety duties since 25 July 2025.
The standard is "highly effective age assurance". Ofcom's guidance sets out what can meet it and what cannot.
Can meet it: photo-ID matching, facial age estimation, open banking, mobile network operator age checks, credit card checks, and digital identity wallets.
Cannot meet it: self-declaration of age, a tick-box, general disclaimers, or payment methods that under-18s can lawfully hold — debit cards included.
Ofcom assesses methods against four criteria: technical accuracy, robustness, reliability and fairness. The regulator has been explicit that a method that is easy to defeat does not qualify, however well-intentioned.
The sanctions are serious: the greater of £18 million or 10% of qualifying worldwide revenue, plus business disruption measures that can require payment providers and advertisers to stop dealing with a non-compliant service. Certain failures relating to information notices carry personal liability for senior managers.
Who this actually lands on
This is where the sector gets confused, so it is worth being blunt.
A creator on OnlyFans, Fansly or MYM. The platform is the service in scope. It implements the checks, it carries the liability, and it has done so. Nothing changes for you operationally beyond the platform's own verification of you as a creator, which is a separate obligation.
An agency running its own website, fan portal, members' area, Discord or forum. You may well be the service. If users can access pornographic content there, or interact with each other, the duties can apply directly to you. This is the single most-overlooked exposure in the UK and it arises from a decision agencies make casually — "let's build our own platform and keep the 20%".
A creator selling directly from their own site. Same answer. The economics of going direct look excellent until you price in geolocation, a verification vendor per visitor, state-by-state US compliance, and the UK duties. Then the platform's cut starts to look like an outsourced compliance department, which is largely what it is.
Age verification is not the same as age records
Two different obligations get conflated, and both matter to an agency.
Verifying the audience is what everything above is about: keeping minors out.
Verifying and recording the performers is separate, older and stricter. In the US, 18 U.S.C. § 2257 imposes record-keeping obligations on producers of sexually explicit content: verified proof of age, legal names and stage names, indexed and retained. Platforms impose their own verification on creators. An agency must keep, for every person appearing in content it handles — the creator and every guest — government ID, a signed release, and a record of what was shot when.
There is no version of the industry in which this is optional, and no contractual arrangement that survives getting it wrong. Verify every face on camera, every time, including the friend who appears once.
The data problem nobody planned for
Age verification means collecting identity documents or biometric data from subscribers. That data is a liability the moment it exists.
In the UK, ID documents and facial estimation data engage the UK GDPR, and facial data is special category data requiring an Article 9 condition. Ofcom's guidance and the ICO both push towards approaches that do not retain the underlying data: a third-party verifier that returns a yes-or-no token, rather than a database of driving licences on your server.
The design rule is simple and worth stating once: do not hold what you can avoid holding. Use a specialist provider, take the token, keep the audit trail of the check rather than the document. A breach of an adult site's verification database is the worst-case scenario in this entire field, and it is entirely a function of architecture choices made early.
What has actually happened in the market
Three effects are now visible.
Traffic moved. Compliant sites recorded steep drops in traffic from jurisdictions that introduced checks, while VPN downloads spiked in the same places on the same days. Some traffic went to non-compliant offshore sites rather than disappearing.
Consolidation. Compliance has a fixed cost, which large platforms absorb and small independent sites cannot. The rules push the market towards exactly the concentration that policymakers elsewhere complain about.
Payment friction. Processors and banks, already cautious about this sector, now add regulatory compliance to their reasons for declining accounts. That interacts badly with problems the industry already had, which we cover in banking for creators and agencies in the US and UK.
In short
The constitutional argument in the US is over, and roughly twenty-seven states now require verification with inconsistent rules and, in some cases, private lawsuits as the enforcement mechanism. The UK requires highly effective age assurance, enforced by Ofcom since July 2025, with penalties that scale to global revenue. If you sell through a platform, the platform carries it. If you are thinking of going direct, price the compliance before you price the margin — and keep performer age records regardless, because that obligation was always yours.
This guide is general information, not US or UK legal advice. We advise agencies and creators on structuring and compliance across jurisdictions, alongside local counsel where a specific regulatory position is needed.
Frequently asked questions
Do I have to verify my subscribers' ages?
What did the Supreme Court decide in Paxton?
How many US states require age verification now?
What does 'highly effective age assurance' mean in the UK?
What are the penalties in the UK?
Has any of this actually changed the market?
Sources and legal texts
- Free Speech Coalition, Inc. v. Paxton, 606 U.S. ___ (2025) Supreme Court of the United States, 27 June 2025
- Online Safety Act 2023 legislation.gov.uk
- Protecting children from harms online Ofcom, age assurance duties enforced from 25 July 2025
- Guidance on highly effective age assurance Ofcom
- Texas House Bill 1181 (2023) Texas Legislature Online
- 18 U.S.C. § 2257 — Record keeping requirements Legal Information Institute, Cornell Law School
This article is general information and does not replace advice tailored to your situation. OFM Legal is not a law firm: court proceedings are handled by our partner lawyers.
