For years, a checkbox asking “Are you 18?” was the industry standard for age-gating adult content. That era is over. Following the US Supreme Court’s June 2025 ruling in Free Speech Coalition v. Paxton, which upheld Texas’s mandatory age-verification law under intermediate scrutiny, the constitutional debate in the US is settled. In the EU, enforcement under the Digital Services Act is accelerating. Regulators on both sides of the Atlantic are moving fast, and the trajectory runs one way.
As of June 2026, more than 25 US states have active age-verification laws requiring adult websites to confirm users are of legal age before granting access. Most apply when a “substantial portion” of content, typically one-third or more, is sexually explicit. What counts as compliant varies by state: government-issued ID, digitised ID cards, transactional data such as mortgage, employment or credit records, and in some states at least one privacy-preserving anonymous option.
The variations bite. Florida requires an anonymous path. Ohio requires periodic re-verification. Tennessee resets verification every 60 minutes. North Dakota has pushed responsibility upstream to device manufacturers and app stores entirely. The patchwork is itself the problem: a platform serving US traffic is simultaneously subject to more than two dozen frameworks, each with its own threshold, method, data-retention rule, and enforcement mechanism.
United States
26 states in forceEurope & UK
DSA · 27 EU statesThe DSA sets a baseline across all 27 EU member states; the countries above have live national ID-grade frameworks on top of it, and the EU’s shared age-verification app is already running in pilot states ahead of a full rollout by end of 2026. The UK enforces its own checks under the Online Safety Act.
Snapshot as of July 2026, compiled from the Free Speech Coalition and AVPA trackers. The roster is fluid, with further state laws dated through 2026–2027. Not legal advice.
The EU Picture
The EU runs on a different architecture but converges on the same outcome. The Digital Services Act, fully in force since 2024, requires every platform accessible to minors to implement appropriate and proportionate protective measures. The Commission’s July 2025 guidelines under Article 28 made the implication explicit: self-declaration is insufficient for high-risk content such as pornography. ID-grade verification is expected.
Enforcement is no longer theoretical. In March 2026 the Commission issued preliminary findings against Pornhub, Stripchat, XNXX and XVideos for failing to adequately protect minors, the clearest signal yet that adult platforms face DSA liability regardless of their size or where they are registered. Non-compliance can attract fines of up to 6% of global annual turnover.
At member-state level the picture is uneven but tightening. France operates one of the strictest frameworks: verification must be handled by an independent third party, sites cannot process age checks themselves, and identity cannot be linked to browsing activity. Germany requires certified verification under its JMStV framework, with identity-level assurance and liveness checks. The UK, outside the EU but aligned in direction, enforced mandatory age checks under the Online Safety Act in mid-2025.
The longer-term solution is structural. The Commission released an age-verification blueprint in July 2025, a privacy-first “mini-wallet” built on the same specifications as the forthcoming EU Digital Identity Wallets, and declared it feature-ready in April 2026. Member states are expected to roll out compatible national implementations by the end of 2026. The design principle: a token confirming a user is 18-plus without transmitting any other personal information.
Over 25 US states and the EU now require ID-grade age checks.
What This Means for Your Merchant Account
Age verification was already an informal acquirer expectation before the legislative wave. Visa and Mastercard both require adult merchants to demonstrate that depicted performers are adults, and Mastercard has mandated government-ID verification for content uploaders since 2021. State and regulatory law has raised the stakes by adding civil liability and, in some jurisdictions, criminal exposure for non-compliance.
Acquirers underwriting adult merchants now treat age-verification infrastructure as a hard requirement, not a best practice. During onboarding, expect to document which verification method you use, which vendor supplies it, how records are stored and for how long, and how you handle jurisdictional variation. A site that geo-blocks non-compliant states rather than verifying will be asked whether that blocking is technically robust.
The link to payment risk is direct. Verified users dispute less. A properly gated checkout reduces the privacy-driven chargebacks that have long plagued adult subscriptions, where customers dispute a charge not because it was fraudulent but because they don’t want it on a bank statement. Under Visa’s VAMP program, which now treats fraud and dispute ratios as a single metric, those disputes are a direct threat to processing access. Compliance and chargeback management are no longer separate conversations.
What Compliant Looks Like in Practice
There is no single globally-mandated standard, so merchants serving both US and EU markets have to build to the strictest applicable requirement in each jurisdiction. The practical baseline emerging from the current landscape:
- ✓ID verification through a third-party vendor able to check government-issued documents
- ✓An anonymous or privacy-preserving option wherever a jurisdiction requires one
- ✓No long-term retention of raw identity data
- ✓A documented, auditable data-deletion process
The Providers With Traction
Several vendors have established real traction in the adult space. Here’s how the leading options compare on coverage, verification method and specialism, so you can match a provider to the jurisdictions you serve and the acquirer questions you’ll need to answer.
Independent reference. The Payments Edge has no commercial relationship with any provider listed and earns no referral fees. Order is not a ranking.
AgeChecked
- Best for
- Adult-industry specialist
- Founded
- 2014 · UK gov-approved
- Coverage
- Global; UK-certified provider
- Methods
- Document IDDatabase / creditMobile & email
- Pricing
- Per-verification
Yoti
- Best for
- Facial age estimation at scale
- Founded
- 2014
- Coverage
- Global; widely deployed UK/EU
- Methods
- Facial estimationDocument IDDigital ID app
- Pricing
- Per-verification
Veriff
- Best for
- Broad global document coverage
- Founded
- 2015 · Estonia
- Coverage
- 12,500+ doc types, 230+ countries
- Methods
- Waterfall checksDocument IDLiveness
- Pricing
- Per-verification, tiered
Sumsub
- Best for
- Combined KYC/AML & age checks
- Founded
- 2015
- Coverage
- 220+ countries & territories
- Methods
- Document IDLivenessFull KYC/AML
- Pricing
- Per-verification / platform
AgeID
- Best for
- Single sign-on across networks
- Founded
- Aylo (formerly MindGeek)
- Coverage
- Participating adult sites
- Methods
- SSODocument IDAV partners
- Pricing
- Varies by integration
Go.cam
- Best for
- Free, privacy-first webcam estimation
- Founded
- GSI Développement · France
- Coverage
- EU/UK; in-browser, on-device
- Methods
- Facial estimationDocument IDCredit card
- Pricing
- Free · open-source (AGPL)
Per-verification pricing is the most common model, and cost varies by provider and volume. The conversion impact is real: sites in early-implementing states and in France reported measurable traffic declines once verification went live. For most merchants the question is not whether to absorb that friction but how to minimise it through UX while staying compliant.
The drift toward device-level and app-store-level age signals, already law in North Dakota, baked into California’s Digital Age Assurance Act from 2027, and underpinning the EU’s wallet rollout, points to verification moving upstream and away from individual websites. That may ease the per-site burden eventually. For now, the obligation sits squarely with the merchant.
Age verification is no longer a legal nicety. It is a condition of holding a merchant account, managing chargeback exposure, and operating across the majority of the US market and the EU. Merchants who treat it as a checkbox are carrying acquirer risk, legal risk and chargeback risk at once, across multiple jurisdictions.
- Congressional Research Service, “Supreme Court Upholds State Age-Verification Requirement (Free Speech Coalition v. Paxton),” congress.gov.
- European Commission, “Safeguarding minors from pornographic content under the Digital Services Act,” digital-strategy.ec.europa.eu.
- Biometric Update, “Regulators crack down on EU age assurance — self-declaration no longer enough,” biometricupdate.com.
- Sidley, “Texas Age Verification Law Upheld: U.S. Supreme Court Balances Free Speech and Child Protection,” datamatters.sidley.com.
