Age verification laws in 2026: where your fans can reach you

A few times a month, a fan emails me to say my OnlyFans page won't load — or that the redirect drops them on a screen asking for a driver's licence scan. The state list keeps getting longer, the UK is now in the same conversation, and the workarounds creators tried in 2023 don't all work anymore. This is the version I'd send to another creator who's seeing the same emails and trying to figure out what's actually going on.

I'm not a lawyer. None of this is legal advice. It's a creator's working read on the rules I actually have to plan around in May 2026.

What changed: the Paxton ruling, in one paragraph

In June 2025 the US Supreme Court decided Free Speech Coalition v. Paxton and upheld Texas's age-verification statute for sites that publish a meaningful amount of sexual content. Before Paxton, a patchwork of state laws was being challenged on First Amendment grounds and several courts had blocked them. After Paxton, the legal oxygen for those challenges mostly disappeared, and any state that had been waiting passed its version within months. By May 2026 the list of states with active age-verification mandates is large enough that "where can my fans actually reach me?" is a real planning question, not a hypothetical one.

The threshold most state laws use is roughly one-third sexual content. Hit it and you're a regulated platform that has to age-verify every visitor; sit clearly below it and you're not. The line is fuzzier than that in practice — the precise definitions vary by state — but the one-third heuristic is what most platforms have been planning around.

The state map (rough, May 2026)

I'm going to deliberately not list specific states because the count moves almost month to month. The shape, though:

• Roughly two dozen US states now have an age-verification mandate either in force or set to take effect. Most are red states. A handful of blue states have considered similar bills citing minor-protection rationales.
• Pornhub and several other large adult sites have geo-blocked some of those states entirely rather than implement ID verification. From a fan's perspective, the page just doesn't load.
• Smaller niche sites have generally chosen the same option — block the state, or run an interstitial that asks the visitor to acknowledge the page might violate local law. Compliance is expensive; geo-blocking is free.

What this means for you as a creator: a percentage of your potential US audience can no longer reach the platforms you sell on without a VPN. The percentage isn't catastrophic in any single state, but it adds up.

The UK side: Online Safety Act Part 5

The UK Online Safety Act came online in stages, and Part 5 — the piece aimed at platforms that "publish pornographic content" — is under active enforcement by Ofcom. The standard is "highly effective age assurance," which in practice means something more robust than a click-through age gate.

Same shape as the US: large platforms have either implemented verification, geo-blocked the UK, or are operating under enforcement risk. The audience that disappears from your numbers when this happens is mostly invisible — you don't get an alert when a UK fan fails an age check and bounces.

The EU is moving in a similar direction under the Digital Services Act and several member-state pilots, but the timing varies. Treat the UK as the early indicator for what other European markets will look like in twelve to twenty-four months.

The 1/3 threshold and why it matters for owned media

The one-third heuristic I mentioned earlier is the reason creator sites can exist on the safe side of these laws while the platforms they link to can't. Most state statutes — and the federal record- keeping rule under 18 USC § 2257 — are triggered by publishing sexually explicit material. Linking to a platform that publishes it, without hosting any of that material yourself, sits outside the trigger.

That's why my own site is built the way it is. Everything explicit lives on the third-party platforms that already age-verify their own users. The site you're reading right now is text, SFW images, and outbound links — well under any "third of the content" threshold, and not on the hook for the verification regime at all.

This isn't a clever loophole; it's the way the statutes were written. The carve-out for information-location tools (sites that link to but don't host) is explicit in the federal rule and tracks with how most state laws define a regulated platform. The longer piece on why every adult creator needs their own website goes deeper into the strategic upside of owning the page your fans land on.

What I do (and what I'd suggest other creators do)

Three things, in order of how much they actually move the needle:

1. Funnel through platforms that aren't blocked

Reddit and Bluesky are not adult platforms in the regulatory sense, even though plenty of NSFW content lives on them. They aren't geo-blocked by state-level age-verification laws because they don't trip the publication threshold. Same for X/Twitter, with caveats about the platform's own moderation cycles. Same for TikTok, Threads, and Instagram for the SFW tip of your funnel.

A blocked-state fan can almost always reach your Reddit profile, your Bluesky page, and the SFW landing page on your own site, even when they can't reach the OF page directly. Make sure those entries all point to the same destination.

2. Run a mailing list

This is the highest-leverage move and the one most creators delay the longest. A mailing list is exempt from the entire framework because it's not a publication of pornographic content; it's a private message you sent to a specific opted-in person. If a fan gives you their email, you can reach them in any state, in the UK, and across most of Europe regardless of how the geo-blocking shifts next quarter.

Use it for the obvious — drop announcements, sale links, new posts — but also for the link to your subscribe page, which a blocked-state fan can then click through their VPN. You're not getting around the law; you're keeping the relationship intact while they handle the last-mile compliance themselves.

3. Don't pretend VPNs solve this

A meaningful share of your blocked-state audience already uses a VPN, and the rest of them won't start. Telling fans to "just use a VPN" works for the technical 20% and loses the rest. Plan for both groups: the VPN-savvy will route around any block; the rest need a funnel that meets them where they actually are (Reddit, Bluesky, email).

If you're a fan and your creator's page won't load

Quick aside, because this post will probably reach a few of you too. If a creator's OnlyFans, Pornhub, or other adult page suddenly won't load and you're in the US or UK, the most likely cause isn't that the creator did anything wrong — it's that the platform geo-blocked your state or country to avoid the verification regime. Three things that usually get you back in:

• Subscribe to the creator's mailing list if they have one. That's the channel that survives the next policy swing.
• Follow them on Reddit, Bluesky, or X, where the SFW announcements and updated links get posted.
• Check the creator's own site, if they have one. The links there are usually maintained and will route to whatever's currently accessible.

Geo-blocking is the platform's response to a state law, not the creator's. Most of us would prefer you didn't have to deal with it at all.

What I'd plan for over the next twelve months

Three things I'm watching:

• Federal action. A federal age-verification standard has been proposed in multiple bills. Whether one passes in the current Congress is uncertain, but the political pressure is in that direction. A federal version would make the state-by-state patchwork moot and standardise the threshold nationally.
• Payment-processor pressure. This is older than the verification laws but moves in the same direction. Visa and Mastercard periodically tighten what they'll process for adult platforms, which has cascading effects on platform policies that have nothing to do with statutes. The OnlyFans vs Fansly vs LoyalFans piece has more on which platforms are most exposed to processor swings and which sit further from US payment-processor leverage.
• EU Digital Services Act enforcement. The DSA's age-assurance expectations are still being tested. The first big enforcement actions against adult platforms are likely to set the tone for the rest of the bloc.

None of this is reason to panic; it's reason to stop running your business as if the platform layer is permanent. The platforms will keep changing what they let you do and where they let your fans reach you. The funnel you own — your site, your mailing list, your direct relationship with the people who already pay you — is what keeps the next policy swing from costing you a quarter.

If you want the deeper version of the owned-media argument, the post on running your own site instead of a Linktree is the one I'd start with. The platform layer is rented. The site you point fans to is yours.

— Sly