Age verification laws in 2026: where your fans can reach you

A few times a month, a fan emails me to say my OnlyFans page won't load — or that the redirect drops them on a screen asking for a driver's licence scan before it'll let them through. The question underneath both emails is the same one most people are too polite to ask out loud: what does that ID check actually collect, where does it go, and is it safe to hand over just to see someone's page?

I'll answer that first, plainly, because it's the part that quietly stops people from clicking. Then it's the version I'd send to another creator watching the same emails come in — which states block what, what the UK changed, and where the federal bill that dropped this month actually fits.

I'm not a lawyer. None of this is legal advice. It's a creator's working read on the rules I have to plan around — written for the fans hitting these screens just as much as the creators behind them.

What changed: the Paxton ruling, in one paragraph

In June 2025 the US Supreme Court decided Free Speech Coalition v. Paxton — 6–3, with the majority written by Justice Thomas — and upheld Texas's age-verification statute for sites that publish a meaningful amount of sexual content. The Court treated the burden on adults as only incidental and applied intermediate scrutiny, not the stricter standard the challengers wanted. Before Paxton, a patchwork of state laws was being challenged on First Amendment grounds and several courts had blocked them. After Paxton, the legal oxygen for those challenges mostly disappeared, and any state that had been waiting passed its version within months. By 2026 the list of states with active age-verification mandates — at least two dozen — is large enough that "where can my fans actually reach me?" is a real planning question, not a hypothetical one.

The dissent (Justice Kagan, joined by Sotomayor and Jackson) didn't argue that kids should see porn. It argued the verification step sweeps up adults' protected access — and their data — and should have to clear a higher bar. Hold onto that data point; it's the part fans actually feel.

The threshold most state laws use is roughly one-third sexual content. Hit it and you're a regulated platform that has to age-verify every visitor; sit clearly below it and you're not. The line is fuzzier than that in practice — the precise definitions vary by state — but the one-third heuristic is what most platforms have been planning around.

What an age check actually collects — and where your ID goes

If you're a fan, this is the part you actually care about, so here it is without the hand-waving. When a site has to age-verify you, it's almost never the creator running the check — the platform hands you off to a third-party verification vendor. In practice you'll hit one of three methods:

• A government-ID scan. You upload a photo of your licence or passport plus a selfie to match it. The vendor confirms you're over 18 and is supposed to discard the image right after.
• Facial age estimation. A vendor (Yoti is the best-known) runs your selfie through a model that estimates your age without storing a named document. No ID — but it's still your face going to someone else's server.
• Credit-card or carrier checks. Indirect proxies for "this is an adult," with the privacy trade-offs you'd expect from attaching a card or phone account to the request.

The honest answer to "is it safe to hand that over?" is: it depends entirely on the vendor, and you usually can't see which one you've been handed to. The good ones verify and delete in seconds and never learn what you do next — and many state laws actually forbid keeping the ID after the check. But you're trusting that the site picked a reputable vendor and that the deletion really happens, which is exactly the privacy gap the Supreme Court dissent flagged. It's a real worry, not a paranoid one.

What I'd tell you as the person on the other side of the page: you never have to run that gauntlet just to reach me. My own site doesn't age-gate you — it's text and SFW images, well under the threshold — and the subscribe page it points to is the platform's check on the platform's terms, not a second ID grab by me. If a page is demanding your licence before you've even decided to subscribe, that's the state law talking, not the creator. The deeper version of this same pre-click worry — what a subscription shows on your bank statement — is in is OnlyFans safe, and what shows up on your statement.

The state map (rough, 2026)

I'm going to deliberately not list specific states because the count moves almost month to month. The shape, though:

• Roughly two dozen US states now have an age-verification mandate either in force or set to take effect. Most are red states. A handful of blue states have considered similar bills citing minor-protection rationales.
• Pornhub and several other large adult sites have geo-blocked some of those states entirely rather than implement ID verification. From a fan's perspective, the page just doesn't load.
• Smaller niche sites have generally chosen the same option — block the state, or run an interstitial that asks the visitor to acknowledge the page might violate local law. Compliance is expensive; geo-blocking is free.

What this means for you as a creator: a percentage of your potential US audience can no longer reach the platforms you sell on without a VPN. The percentage isn't catastrophic in any single state, but it adds up.

The UK side: Online Safety Act Part 5

The UK Online Safety Act came online in stages, and Part 5 — the piece aimed at platforms that "publish pornographic content" — is under active enforcement by Ofcom. The standard is "highly effective age assurance," which in practice means something more robust than a click-through age gate.

Same shape as the US: large platforms have either implemented verification, geo-blocked the UK, or are operating under enforcement risk. The audience that disappears from your numbers when this happens is mostly invisible — you don't get an alert when a UK fan fails an age check and bounces.

The EU is moving in a similar direction under the Digital Services Act and several member-state pilots, but the timing varies. Treat the UK as the early indicator for what other European markets will look like in twelve to twenty-four months.

The 1/3 threshold and why it matters for owned media

The one-third heuristic I mentioned earlier is the reason creator sites can exist on the safe side of these laws while the platforms they link to can't. Most state statutes — and the federal record- keeping rule under 18 USC § 2257 — are triggered by publishing sexually explicit material. Linking to a platform that publishes it, without hosting any of that material yourself, sits outside the trigger.

That's why my own site is built the way it is. Everything explicit lives on the third-party platforms that already age-verify their own users. The site you're reading right now is text, SFW images, and outbound links — well under any "third of the content" threshold, and not on the hook for the verification regime at all.

This isn't a clever loophole; it's the way the statutes were written. The carve-out for information-location tools (sites that link to but don't host) is explicit in the federal rule and tracks with how most state laws define a regulated platform. The longer piece on why every adult creator needs their own website goes deeper into the strategic upside of owning the page your fans land on.

What I do (and what I'd suggest other creators do)

Three things, in order of how much they actually move the needle:

1. Funnel through platforms that aren't blocked

Reddit and Bluesky are not adult platforms in the regulatory sense, even though plenty of NSFW content lives on them. They aren't geo-blocked by state-level age-verification laws because they don't trip the publication threshold. Same for X/Twitter, with caveats about the platform's own moderation cycles. Same for TikTok, Threads, and Instagram for the SFW tip of your funnel.

A blocked-state fan can almost always reach your Reddit profile, your Bluesky page, and the SFW landing page on your own site, even when they can't reach the OF page directly. Make sure those entries all point to the same destination.

2. Point everything at a site you own

This is the move I actually make, and most of the reason this site exists. A page you own — your own domain, not a platform profile — is the one link that doesn't geo-block your fans, doesn't change its rules next quarter, and doesn't vanish in someone else's moderation sweep. It sits under the publication threshold (text and SFW links, nothing explicit hosted on it), so the verification regime never touches it, and it can quietly route a blocked-state fan to whatever subscribe option is currently reachable.

Every other entry point — Reddit, Bluesky, X — should aim back at that owned page, so there's always one address you control sitting between you and the next policy swing. A direct opt-in channel you own (an email or broadcast list) is the most durable version of this in theory, since a private message isn't a publication and sidesteps the framework entirely — but I haven't set one up yet, and I'd rather send you somewhere real than push a channel I don't actually run.

3. Don't pretend VPNs solve this

A meaningful share of your blocked-state audience already uses a VPN, and the rest of them won't start. Telling fans to "just use a VPN" works for the technical 20% and loses the rest. Plan for both groups: the VPN-savvy will route around any block; the rest need a funnel that meets them where they actually are (Reddit, Bluesky, email).

If you're a fan and your creator's page won't load

Quick aside, because this post will probably reach a few of you too. If a creator's OnlyFans, Pornhub, or other adult page suddenly won't load and you're in the US or UK, the most likely cause isn't that the creator did anything wrong — it's that the platform geo-blocked your state or country to avoid the verification regime. Three things that usually get you back in:

• Check the creator's own site first, if they have one. The links there are usually maintained and route to whatever's currently accessible — it's the channel that survives the next policy swing.
• Follow them on Reddit, Bluesky, or X, where the SFW announcements and updated links get posted.

Geo-blocking is the platform's response to a state law, not the creator's. Most of us would prefer you didn't have to deal with it at all.

Update — June 2026: a federal bill, but nothing new in force

Since I first wrote this, the federal piece I was watching got a name. On June 10, 2026, Senator Jim Banks introduced the Safety and Age Filtering Enforcement (SAFE) for Kids Act — a national age-verification mandate for sites where more than a third of the content is sexual material harmful to minors, the same threshold the state laws use. As introduced, it would add FTC enforcement, let the DOJ investigate platforms that knowingly violate it, and give parents a private right to sue. (Don't confuse it with New York's SAFE for Kids Act — an unrelated social-media law that happens to share the nickname. Different bill, different target.)

One thing to be clear about, because I'm not a lawyer and it's the part people get wrong: it's a bill, not a law. It's been introduced, not passed; it doesn't have a public-law number; nothing about it is in force. A separate federal vehicle — Senator Mike Lee's SCREEN Act — is sitting in the same queue. The only thing actually binding today is still Paxton and the state laws it cleared the way for.

So the honest takeaway hasn't moved: the patchwork may consolidate into one national standard eventually, but nothing about how you reach me — or how I reach you — changed this month. If it does pass, it standardises the ID check nationwide instead of state-by-state, which makes the privacy section up top matter more, not less.

What I'd plan for over the next twelve months

Three things I'm watching:

• Federal action. This is now concrete — see the June 2026 update above on Senator Banks's SAFE for Kids Act and Senator Lee's SCREEN Act. Whether either passes the current Congress is uncertain, but the pressure is clearly toward a single national standard that would make the state-by-state patchwork moot.
• Payment-processor pressure. This is older than the verification laws but moves in the same direction. Visa and Mastercard periodically tighten what they'll process for adult platforms, which has cascading effects on platform policies that have nothing to do with statutes. The OnlyFans vs Fansly vs LoyalFans piece has more on which platforms are most exposed to processor swings and which sit further from US payment-processor leverage.
• EU Digital Services Act enforcement. The DSA's age-assurance expectations are still being tested. The first big enforcement actions against adult platforms are likely to set the tone for the rest of the bloc.

None of this is reason to panic; it's reason to stop running your business as if the platform layer is permanent. The platforms will keep changing what they let you do and where they let your fans reach you. The funnel you own — your site and your direct relationship with the people who already pay you — is what keeps the next policy swing from costing you a quarter.

If you want the deeper version of the owned-media argument, the post on running your own site instead of a Linktree is the one I'd start with. The platform layer is rented. The site you point fans to is yours.

— Sly