Pornhub sends letter to U.S. lawmakers about ineffective age verification

Today, Pornhub sent a letter to various U.S. governors, attorneys general, and state reps, the company shared with Mashable. The letter details concerns over "performative, ineffective, and unenforceable" age-verification laws, calls for releasing data on how these laws protect children, and advocates for device-level filters.

Age-verification laws require submitting personal information — such as a facial scan or a government ID — to view certain content, typically explicit content. These laws have been enacted in around half of U.S. states since 2023, starting with Louisiana. Pornhub has blocked itself in most of these states due to the burden of complying.

Meanwhile, initial research has suggested that age-verification laws don't work due to software like VPNs (which can hide someone's real location) and non-compliant websites.

In its letter, Pornhub mentions these pitfalls, as well as digital safety and privacy concerns.

The company sent the open letter to elected officials in Alabama, Arizona, Arkansas, Florida, Georgia, Idaho, Indiana, Iowa, Kansas, Kentucky, Louisiana, Mississippi, Missouri, Montana, Nebraska, New Jersey, North Carolina, North Dakota, Ohio, Oklahoma, South Carolina, South Dakota, Tennessee, Texas, Utah, Virginia, West Virginia, and Wyoming.

"These laws demonstrably do not work and, as a result, have put your constituents' children and adults' personal data at risk. If you truly intend to protect minors online, you must acknowledge the facts and introduce a real solution," the letter states.

The solution Pornhub offers is mandating operating system providers like Apple, Microsoft, and Google to enable parental controls on the device level. Pornhub sent a letter to these tech giants in Nov. 2025, asking them to do so.

In the UK, Apple enabled device-level filters on devices with iOS 26.4, prompting Pornhub to reverse its decision to block the country back in May. The UK's age-verification law, the Online Safety Act, went into effect in July 2025.

Pornhub has experimented with this solution since April 2026 and found that it prevents minors from accessing adult content in the UK. VPNs also don't work to circumvent it. "It is our view that children in the UK using Apple devices with the most up-to-date version of iOS are benefitting from the strongest level of protection from age-inappropriate content online," the letter reads. "Your constituents deserve the same."

The company wrote that Apple, Microsoft, and Google should make this the default on all devices globally.

It also mentions the recent report from Ofcom, the UK's communications regulator, stating that current age checks "leave major gaps." It also mentions similar findings in Texas, where an online search for "free porn" showed that nine out of the top 10 search results had no age verification at all. (The latter findings are in an appendix in the letter.)

In Australia, which enacted a social media ban for children under 16 in December 2025, 85 percent of those teens are still using social media, according to a study published in June. Meanwhile, Pornhub states, "The longer this goes on, the longer these non-compliant sites are accessed by more minors and adults. As outlined by Lucy Faithfull Foundation, we know that when faced with age verification, some adults are choosing riskier, irresponsible sites to avoid age checks."

The letter also asks, "How many minors have been protected in the weeks, months and years since age verification laws have come into effect in your jurisdictions?" It asks for the officials to publicly release data about this, if such data exists

"Platform-by-platform age verification laws were designed to fail. These laws may be simple and attractive, but the evidence shows they are impossible to enforce at scale, easy to evade, weak at protecting minors and increase privacy risks for adults," the letter goes on, linking to various reports by The Independent and the BBC.

Pornhub finishes the letter, again asking for device-level filters. Free speech advocates have long called for this as a solution that doesn't infringe on adults' free speech rights.

Here is the letter in full:

Dear lawmakers,

We are writing to you because, as a community, we are deeply concerned about the harm being caused by the performative, ineffective, and unenforceable age verification laws you have taken part in passing despite your intention of protecting minors. Everyone subjected to these laws is more at risk than ever before of encountering online harm.

We are serious about protecting minors, and lawmakers like yourselves must recognize that these laws have failed at that objective. Voting for age verification laws that require hundreds of thousands of individual websites to collect personal information from every user, every time they want to access content restricted to adults, is dangerous.

These laws demonstrably do not work and, as a result, have put your constituents’ children and adults’ personal data at risk. If you truly intend to protect minors online, you must acknowledge the facts and introduce a real solution. You have the power and the responsibility to mandate operating system providers like Apple, Microsoft and Google to render all mobile phones, tablets and computers child safe by enabling parental controls at the source and by default.

You should be aware that in the United Kingdom, where they’ve introduced the Online Safety Act with the goal of making the UK “the safest place in the world to be online”, Apple has shown what meaningful action looks like. With a quick software update, Apple set a new benchmark for child safety that turned parental controls on by default for users who have not verified they are adults. This means making every phone or tablet kid-safe as a starting point. Adults can then verify their age once in their mobile phone settings, instead of every time they want to browse an adult website, use a dating app or scroll social media. It’s a more consistent, privacy-conscious, global approach to protecting children online than requiring every individual website or application to build and enforce its own age verification system.

Since April 2026, Pornhub has experimented with Apple’s solution and has seen it successfully prevent minors from accessing adult content websites in the UK. It is our view that children in the UK using Apple devices with the most up-to-date version of iOS are benefitting from the strongest level of protection from age-inappropriate content online. Adult sites are blocked by default, and VPNs do not work to circumvent these blocks. Your constituents deserve the same.

This is a big step for online safety that can go even further. We believe all device manufacturers, like Microsoft, Apple and Google – the three companies responsible for the operating system of 97% of mobile phones, tablets and computers currently in use around the world, should make this the default setting on all devices globally. Because clearly, more could and should be done. Your role here is to mandate them to do it by including this in their next software updates.

For nearly a year, Ofcom, the UK internet regulator, has monitored and collected data. Like your existing laws, the UK Act relies heavily on adults repeatedly submitting personal information, such as a driver’s licence, facial scan, or credit card, to access lawful content. Ofcom has now released its first six-month implementation report. Its findings make clear that site-by-site age checks leave major gaps. “Since January 2026, the number of services in the top 100 with age assurance in place has decreased steadily, as services without age assurance become more popular.” Ofcom also noted that site-by-site rules can “inadvertently strengthen the market position of non-compliant firms.” In other words, dangerous websites that are breaking the law by refusing to implement any kind of age assurance are benefitting from the law by winning traffic over from the compliant websites that have.

None of the age verification laws that have been passed in any of your jurisdictions are working or can effectively be enforced. An excellent example of this exists in the UK. Ofcom is one of the world’s strongest online safety regulators, but it has been given an impossible mandate. This outcome was predictable: responsible platforms comply, while non-compliant operators remain discoverable, gain traffic and continue exposing minors to age-inappropriate content. And this is not unique to the UK. For example, in Texas, where age verification was introduced in September 2023, a simple online search showed 9 out of the top 10 search results for “free porn” had no age verification at all.

This issue does not only apply to adult content laws. Since December 2025, kids under the age of 16 in Australia have been prohibited from having social media accounts. However, three months after the ban more than 85% of teenagers are still using social media. Search results are constantly replenished with new, non-compliant sites, demonstrating how easily new players can enter the market. This revolving door means the internet remains wide open to unmoderated, unverified and potentially unsafe content, regardless of how many times authorities attempt to crack down.

The longer this goes on, the longer these non-compliant sites are accessed by more minors and adults. As outlined by Lucy Faithfull Foundation, we know that when faced with age verification, some adults are choosing riskier, irresponsible sites to avoid age checks. According to the Free Speech Coalition, “Less than 5% of consumers actually go through with age-verification for adult content. When confronted with a request for a facial scan and government ID, most consumers simply hit the back button and find a non-compliant site outside the mandate or log on to a VPN.” The internet is global and it's impossible to patrol millions of different sites based in hundreds of different countries. Site-based regulation is always going to encourage evasion.

We can no longer accept laws that create the appearance of action while failing to address the challenge of keeping kids safe online. It is particularly concerning when these laws drive regulated business out of your jurisdictions and aid in creating a lush market for bad actors online, when a viable solution exists today.

Phones, tablets and computers could start as kid-safe devices by default, where only verified adults would be able to disable safeguards designed to protect minors from age-inappropriate content, including pornography. This method protects minors without requiring adults to surrender unnecessary personal information to multiple websites. It also avoids creating systems that are easily circumvented through tools like VPNs. Some governments and major technology companies recognize that kid-safe phones can provide a more consistent and privacy-protective way to help keep minors away from age-restricted content.

How many minors have been protected in the weeks, months and years since age verification laws have come into effect in your jurisdictions? The public deserves to see the data on how these laws are protecting children and reducing access to age-inappropriate content. We don’t believe such data exists. Platform-by-platform age verification laws were designed to fail. These laws may be simple and attractive, but the evidence shows they are impossible to enforce at scale, easy to evade, weak at protecting minors and increase privacy risks for adults.

We urge you to focus on putting into action policies that produce measurable improvements in child safety rather than legislation that grabs headlines. The technology exists. A precedent exists. The responsibility now lies with you to pursue solutions that truly protect children across the entire internet. We are determined to be part of this solution and want to collaborate with government, civil society and tech partners to arrive at an effective kid-safe-by-default solution.

Signed,

Pornhub