Porn Sites Must Block VPNs To Comply With Indiana's Age-Verification Law

Indiana Attorney General Todd Rokita is suing dozens of porn websites, claiming that they are in violation of the state's age-verification law and seeking "injunctive relief, civil penalties, and recovery of costs incurred to investigate and maintain the action." Last year, Indiana Senate Bill 17 mandated that websites featuring "material harmful to minors" must verify that visitors are age 18 or above. Rather than start checking IDs, Aylo—the parent company of Pornhub and an array of other adult websites—responded by blocking access for Indiana residents. Now, Indiana says this is not good enough.

The State's Suggestion: Blocking VPN Access

To successfully comply, Pornhub and other Aylo platforms (which include Brazzers, Youporn, and Redtube, among others) must also block virtual private networks and other tools that allow internet users to mask their IP addresses, the state suggests. The state argues that because some Indiana residents could use tools to get around location-based blocks, location-based blocks "are insufficient to comply with Indiana's Age Verification Law." This is an insane—and frighteningly dystopian—interpretation of the law.

In a section of the suit detailing how Aylo allegedly violated the law, Indiana notes that investigators accessed Pornhub.com from Indiana using a Virtual Private Network (VPN) with a Chicago, Illinois IP address. "Defendants have not implemented any reasonable form of age verification on its website Pornhub.com," the suit states. It goes on to detail how Indiana investigators also accessed Brazzers.com, Faketaxi.com, Spicevids.com, and other adult websites using a VPN.

Broad Anti-Privacy Logic and Online Censorship

The logical conclusion from this is that if a porn platform doesn't want to check IDs or to stop existing, it must then stop anyone from using a VPN. This is the sort of logic that won't stop with porn platforms, of course. Increasingly, states are trying to require social media platforms, app stores, and other web services to verify users' ages. Indiana's logic could be used to justify sanctioning all sorts of apps and services for failing to block VPNs and other anonymity-aiding tools. You might prevent a few more teens from seeing boobs or watching TikTok videos, but at the cost of massively impeding privacy for people of all ages.

It's a regrettable situation in any circumstance, but especially bad for people in countries or situations where free speech online could be dangerous or where repressive governments have blocked access to outside information. No longer could they turn to popular social media platforms to access news or communicate with wider audiences. Furthermore, VPNs are used by people whose employers require them in order to access work email and websites, college students, and others.

Legal Criticism: 'Failure To Accomplish Impossibilities'

David Greene of the Electronic Frontier Foundation (EFF) called this "quite ridiculous." He told AVN: "It essentially bases liability on the failure to accomplish impossibilities." It's also part of two larger trends when it comes to online censorship and surveillance: trying to use deceptive trade practices to punish online entities for not suppressing certain sorts of content, and trying to ban VPNs and other tools that may help people avoid any number of state- or country-specific internet restrictions. The latter represents a disturbing doubling down on attempts to end online privacy and anonymity.

Comparison of Age Verification Approaches

Based on the provided material, the following table summarizes the different methods and their associated risks:

Method	Description	Privacy and Security Implications
Platform-based Checks	Websites install age gates or request ID data.	Ineffective; risk of birth dates being leaked; exposure of IDs (e.g., Discord hack).
Location-based Blocking	Restricting access based on a user's IP address.	Insufficient to comply with Indiana law as users can bypass via VPNs.
Device-level Filters	Operating systems (AB 1043) request age during setup.	Privacy-preserving; uses age bracket signals instead of storing exact birth dates.

The Search for Ethical Solutions

Age-verification laws are sweeping the world, typically requiring websites to obtain personal data from visitors to ensure they're over 18. However, multiple studies have suggested that these laws don't actually work to keep minors off porn sites. Mike Stabile of the Free Speech Coalition told Mashable: "In practice, they've so far functioned as a form of censorship."

There is, however, another solution: Device-level filters. One real age assurance approach that's more privacy-preserving is outlined in California's law AB 1043, which will take effect in 2027. AB 1043 requires operating systems—the software that powers phones, tablets, and computers—to request an age or birthday during setup. Then, it creates an age bracket signal on the device, and that signal is sent to applications, providing a way to determine age without being prescriptive as to how.