Age verification law for adult websites comes with privacy, technical concerns

As Louisiana rang in the new year, Louisianians took to social media to express concerns about a new law that required age verification before accessing pornography websites. 

The new law, which sailed through the legislature with just a single vote against it, was sponsored by Rep. Laurie Schlegel, a Metairie Republican who also works as a sex addiction therapist. It went into effect Jan. 1. 

The law requires that pornography websites, specifically websites that feature at least one-third of “material harmful to minors,” use certain methods of age verification to ensure that minors cannot access the content. 

Users across social media platforms raised complaints about technical problems with the rollout of third-party age verification software and expressed concerns that the law invades the privacy of adults accessing legal content. 

“This bill is all about protecting children,” Schlegel said in an interview. “I believe that adults have the right to go to whatever website and see whatever legal material that they want to see.” 

Tech hiccups 

Users complained major adult content websites, such as PornHub, only used LA Wallet, a cell phone application that can carry a Louisiana driver’s license or other state-issued identification. When websites only verify through LA Wallet, people who do not have a Louisiana license are unable to access age-restricted websites. 

The law allows for various methods of age verification, including commercial data. Pornhub and its parent company MindGeek declined to comment as to why they had opted to only accept LA Wallet. 

Reddit users from as far away as Florida also complained they were being swept up in the new law. 

Ibrahim Baggili, a computer science professor at LSU, said that internet protocol (IP) addresses, which can identify the location where someone accesses the internet, are less accurate on mobile devices connected to a mobile carrier than a home internet connection. An increasing number of internet users in the United States access the internet solely on their phones.

Some people who don’t have Louisiana driver’s licenses, but were still asked to log into LA Wallet, said they had to set up a virtual private network (VPN), which disguises a user’s location. Virtual private networks typically take just a few minutes to set up. 

Privacy concerns

Other users expressed concern about using LA Wallet, specifically the state having knowledge of who accesses  content that some may consider taboo or immoral. 

Calvin Fabre, president of Envoc, which created and manages LA Wallet, explained the company does not keep any personally identifiable information. 

“If somebody is delivering alcohol, for example, using third party food delivery services like Uber Eats or Waitr … the driver’s license is scanned using LA Wallet to verify that they’re over 21,” Fabre said. “That scan goes back to the DMV. It doesn’t come to LA Wallet.” 

Matthew Boudreaux, a spokesperson for the Office of Motor Vehicles, said the agency does not record or possess any personally identifiable information related to LA Wallet users, including whether it is used by third-party age verification services. 

Fabre said that third-party age verification vendors don’t even get an individual’s date of birth when a user logs into LA Wallet, only a bit of data that says whether the user is under or over18. 

Fabre said that Envoc wrote specific code in anticipation of LA Wallet being used by adult websites for age verification purposes to protect user’s privacy. 

“We scrub any kind of logging of [personally identifiable information],” Fabre said. “Even law enforcement, litigation if it ever comes, it’s going to be very difficult for us to even know who was verified.” 

Baggili, the LSU computer scientist, said that there is no 100% secure way to handle this type of sensitive data, which he believes to be particularly attractive to hackers. 

“The third-party provider may be logging data, although they claim that they’re not collecting data, obviously,” Baggili said. For security reasons, a company would have to log data using an interface call that allows one application to request data from another, he said. If this is not done in a secure way, Baggili warned individuals can be linked to accessing material. 

Baggili pointed out some countries in Europe that want to verify the age of internet users but won’t because they cannot find a way to protect privacy. Baggili recommended Louisiana require rigorous testing of third-party age verification vendors. 

Schlegel pointed out the new law allows individuals to sue third-party age verification vendors that retain personally identifiable information. She said that she worked closely with Envoc and other experts to protect user data. 

“I feel like I probably care about people’s privacy more than any commercial entity on the internet does,” Schlegel said.