Internet News

Pornhub recently had to make the difficult decision to block access to users in Virginia and Mississippi due to newly passed Age Verification laws. These states have joined Utah and Louisiana where, earlier this year, similar laws were introduced. While these new laws claim to protect children from accessing harmful material online -- something we fully support -- they not only fail to do this, but also jeopardize user safety and privacy.

What does age verification mean?

In the context of these laws, age verification requires users to prove that they are 18+ to view adult content.

There are multiple ways that a user can prove their age, but any effective method requires them to submit some form of personally identifiable information ("PII"). By assigning this responsibility to the platform(s) visited by a user, this means submitting private information many times to adult sites all over the internet, while normalizing disclosure of PII across the internet. This is not a privacy-by-design approach.

It also creates a substantial risk for identity theft. Since age verification software requires users to hand over extremely sensitive information, it opens the door for the risk of data breaches. Whether or not your intentions are good, governments have historically struggled to secure this data. It also creates an opportunity for criminals to exploit and extort people through phishing attempts or fake AV processes, an unfortunate and all too common practice.

Age verification is a good thing, if done correctly

Safety and compliance are at the forefront of our mission. We firmly believe age verification can make the internet a safer space for everyone, when it is done right. Unfortunately, the way these new laws are executed by lawmakers is ineffective and puts users' privacy at risk. Those seeking adult content will inevitably end up on irresponsible sites that don't enforce safety, privacy, consent, or content moderation.

Back in January, we saw the outcome of this firsthand when Louisiana passed a similar law. Pornhub was one of a tiny handful of websites to comply with the new state law requiring websites prevent minors from accessing them by employing age verification solutions.

The Louisiana law and other copycat state level laws have no regulator, only civil liability, which results in a flawed enforcement regime, effectively making it an option for platform operators to comply. Consequently, traffic to Pornhub dropped by approximately 80% in Louisiana, but we know that people didn't stop consuming porn overnight because of this new law. They just very easily moved to pirate, illegal, or other non-compliant sites that don't ask visitors to verify their age. Very few sites are able to compare to the robust Trust and Safety measures we currently have in place to protect both the users viewing content on Pornhub from engaging with potentially dangerous content and provide a safe platform for creators to monetize their content and engage with fans. Most other sites unfortunately do not take these same extensive measures towards community protection and without barrier to entry, is where viewers risk ending up. Therefore, these laws have not only failed at protecting children, but have introduced further harm by displacing traffic to sites with few or zero Trust and Safety measures.

What you need to know -- a device-based solution

More of these laws are coming, and the safety of our users is one of our biggest concerns. However, the best and most effective solution for protecting children and adults alike is to identify users at the source: by their device, or account on the device, and allow access to age-restricted materials and websites based on that identification. This means users would only get verified once, through their operating system, not on each age-restricted site. This dramatically reduces privacy risks and creates a very simple process for regulators to enforce.

Who will these new laws affect?

These new laws will affect everybody differently. For example, Content Creators will get redirected to a separate login flow that will still allow them on the site to upload content. This is because, as verified users on Pornhub, which is the required status for anyone wishing to upload, they have already verified their age with government issued ID using Yoti. However, for site visitors in Utah, Mississippi, and Virginia, they are greeted by a video featuring Cherie Deville who explains why we had to make the difficult decision to block them from accessing Pornhub.

What is the ideal solution?

The only viable solution that will make the internet safer, preserve user privacy, and stands to prevent children from accessing material harmful to minors is performing age verification at the source: on the device itself.

What can community members do?

To fight against these haphazard and dangerous laws, we encourage all members of our community to stand up for your freedom to enjoy and consume porn privately. There are a few ways you can do this.

First, spread the message on social media. Using your platform to raise awareness and to help your fans understand the implications of these poorly designed laws is the first step in making a change. Be loud, be vocal, and show how important it is for us to get this right. We believe the only way for these laws to be effective is to have age verification on the devices used to access adult content.

Second, contact your local government and encourage your fans to do the same! Change begins when the public applies pressure and contacts lawmakers. Write them letters or emails, call their offices, tweet at them, demand changes and demand answers. It is their job as civil servants to respond to concerned citizens. In your letters, you can request device-based age verification solutions. By doing this, your safety and privacy, as well as the safety of your children, are protected much better than entering your ID every time you want to visit an adult website. In the meantime, share this blog widely to help spread the word!

And third, stay informed on legislative updates. Please check back often on the Free Speech Coalition AV page.

Don't give up! We know that normalizing sex work and sexual expression is an uphill battle, but it can be done. We must be vocal about it. Change begins with raising our voices, educating others, and engaging in these important conversations on our socials to spread the message. For more information, visit the Free Speech Coalition .

Apple says it will remove services such as FaceTime and iMessage from the UK rather than weaken security if new UK government proposals are made law and acted upon.

The government is seeking to update the Investigatory Powers Act (IPA) 2016. It wants messaging services to clear security features with the Home Office before releasing them to customers. The act lets the Home Office demand security features are disabled, without telling the public. Under the update, this would have to be immediate.

Currently, there has to be a review, there can also be an independent oversight process and a technology company can appeal before taking any action.

WhatsApp and Signal are among the platforms to have opposed a clause in the Online Safety Bill allowing the communications regulator to require companies to install technology to scan for child-abuse material in encrypted messaging apps and other services.

The government has opened an eight-week consultation on the proposed amendments to the IPA. , which already enables the storage of internet browsing records for 12 months and authorises the bulk collection of personal data.

Apple has made a  9 page submission to the current consultation opposing the snooping proposal:

It would not make changes to security features specifically for one country that would weaken a product for all users. Some changes would require issuing a software update so could not be made secretly The proposals constitute a serious and direct threat to data security and information privacy that would affect people outside the UK.

A US federal appeals court has upheld key portions of a federal internet censorship law Congress passed to supposedly combat sex trafficking, but in reality censors all aspects of consensual adult sex work. However the court did reject some broad readings of the statute that censor even debate about prostitution.

Advocates for legalizing prostitution, the operators of the Internet Archive website, Human Rights Watch and a massage therapist who said he lost business when Craigslist pulled many categories of ads after passage of FOSTA in 2018 sued to block enforcement of the law.

The D.C. Circuit Court of Appeals ruled that language in the 2018 Fight Online Sex Trafficking Act -- better known as FOSTA -- is not unconstitutionally vague and doesn't violate free-speech rights.

However, the court did slightly restrict the reach of the censorship, saying:

We therefore hold that [FOSTA's] mental state requirement does not reach the intent to engage in general advocacy about prostitution, or to give advice to sex workers generally to protect them from abuse. Nor would it cover the intent to preserve for historical purposes webpages that discuss prostitution. Instead, it reaches a person's intent to aid or abet the prostitution of another person.

Judge Millett conceded that the language of the law could be seen as encompassing all sorts of conduct that arguably promotes or encourages prostitution. But she said the more limited reading was justified in this instance.She said:

Undoubtedly, the term 'facilitate' could be read more broadly. But nothing in [FOSTA] compels us to read 'facilitate' that way. Doubly so when a more expansive reading could raise grave constitutional concerns.

Ofcom writes:

We have today published our Annual Report and Accounts covering the period from 1 April 2022 to 31 March 2023.

The report sets out our performance against our plan of work for the past financial year, capturing the progress we have made in our work across major projects and ongoing regulatory responsibilities.

Mozilla, the foundation that produces the Firefox browser explains:

In a well-intentioned yet dangerous move to fight online fraud, France is on the verge of forcing browsers to create a dystopian technical capability. Article 6 (para II and III) of the SREN Bill would force browser providers to create the means to mandatorily block websites present on a government provided list. Such a move will overturn decades of established content moderation norms and provide a playbook for authoritarian governments that will easily negate the existence of censorship circumvention tools.

While motivated by a legitimate concern, this move to block websites directly within the browser would be disastrous for the open internet and disproportionate to the goals of the legal proposal -- fighting fraud. It will also set a worrying precedent and create technical capabilities that other regimes will leverage for far more nefarious purposes. Leveraging existing malware and phishing protection offerings rather than replacing them with government provided, device level block-lists is a far better route to achieve the goals of the legislation.

The rest of the post will provide a brief overview of the current state of phishing protection systems in browsers, the distinction between industry practices and what the draft law proposes, and proposes alternatives to achieve the goals of the legislation in a less extreme manner.

It might seem that current malware and phishing protection industry practices are not so different from the French proposal. This is far from the truth, where the key differentiating factor is that they do not block websites but merely warn users about the risks and allow them to access the websites if they choose to accept it. No such language is present in the current proposal, which is focused on blocking. Neither are there any references to privacy preserving implementations or mechanisms to prevent this feature from being utilized for other purposes. In fact, a government being able to mandate that a certain website not open at all on a browser/system is uncharted territory and even the most repressive regimes in the world prefer to block websites further up the network (ISPs, etc.) so far.

Forcing browsers to create capabilities that enable website blocking at the browser level is a slippery slope. While it might be leveraged only for malware and phishing in France today, it will set a precedent and create the technical capability within browsers for whatever a government might want to restrict or criminalize in a given jurisdiction forever. A world in which browsers can be forced to incorporate a list of banned websites at the software-level that simply do not open, either in a region or globally, is a worrying prospect that raises serious concerns around freedom of expression. If it successfully passes into law, the precedent this would set would make it much harder for browsers to reject such requests from other governments.

We remain engaged in conversations with relevant stakeholders and hope that the final law leads to a more palatable outcome for the open internet.

One of the most visited sites in the world, Pornhub, has blocked users in Virginia over the state's new age verification law.

The new law taking effect July 1 now requires websites with pornographic content being viewed in Virginia to verify that users are at least 18 years old before they can view the site. The law, proposed by Republican state Sen. William M. Stanley Jr. (Franklin), sailed through the Virginia General Assembly.

Pornhub decided that it would be blocking all Virginia users rather than try to implement unsafe and privacy endangering age verification.

Pornhub wrote in a message to those attempting to log in:

The safety of our users is one of our biggest concerns. We believe that the best and most effective solution for protecting children and adults alike is to identify users by their device and allow access to age-restricted materials and websites based on that identification.

Until a real solution is offered, we have made the difficult decision to completely disable access to our website in Virginia.'