Pornhub Is Fighting Texas’ Age-Verification Law Again—This Time It’s a Policy Fight

Pornhub is fighting Texas’ adult-site age-verification law again, but the legal posture matters. This is not a new round at the U.S. Supreme Court. It is a policy campaign asking lawmakers to rethink the site-by-site model after the Court upheld Texas House Bill 1181 in 2025.

The Austin American-Statesman reported that Pornhub sent a July 29 letter to hundreds of state officials, including Texas Governor Greg Abbott and Attorney General Ken Paxton. The company argued that existing age-verification laws have not stopped minors from reaching explicit content and that requiring individual websites to collect personal information creates privacy and security risks. Pornhub favors an approach that places age assurance at the device or app-store level.

Those are Pornhub’s policy arguments, not judicial findings. The current law remains enforceable. But the dispute exposes a real governance problem: an age gate is not just a pop-up. It is an identity-data system with legal, privacy, security, vendor, and evidence obligations.

What Texas HB 1181 Requires

Texas HB 1181 applies to a commercial entity that knowingly and intentionally publishes or distributes material on an internet website when more than one-third of the site is “sexual material harmful to minors,” as the statute defines that term. A covered entity must use a reasonable method to verify that a person attempting to access the material is at least 18.

The law permits digital identification or a commercial age-verification system using government-issued identification or a commercially reasonable method based on public or private transactional data. A company performing the check—or a third party performing it—may not retain identifying information from the individual.

Pornhub and its parent company, Aylo, have blocked access to their sites from Texas rather than implement the required verification process.

The Penalties Make Privacy Part of the Compliance Design

The Texas Attorney General may seek an injunction and civil penalties for knowing violations. The statute authorizes up to $10,000 per day for operating a covered site without the required age verification, up to $10,000 per instance for retaining identifying information in violation of the law, and an additional amount up to $250,000 if one or more minors access covered material because of the age-verification violation.

That structure matters. Texas did not simply order websites to check identification and leave the data consequences to chance. It paired the access rule with a no-retention rule and a separate per-instance penalty.

For operators, the hard question is not only “Did we verify age?” It is also “What data did the user, browser, app, verification vendor, analytics service, fraud tool, logging system, support team, and backup process receive or preserve while we did it?”

What the Supreme Court Actually Decided

In Free Speech Coalition v. Paxton, the Supreme Court affirmed the Fifth Circuit on June 27, 2025, by a 6–3 vote. The Court held that HB 1181’s age-verification requirement is subject to intermediate scrutiny because it only incidentally burdens adults’ protected access to speech that is obscene to minors. The Court then held that the requirement survives that review.

The majority reasoned that Texas has an important interest in shielding children from sexual content and that requiring proof of age is an ordinary way to enforce an age-based restriction. Intermediate scrutiny did not require Texas to adopt the least restrictive possible alternative.

That is narrower and more precise than saying the Court approved every age-verification design everywhere. The decision upheld this requirement against the First Amendment challenge before the Court. It did not declare every verification technology effective, risk-free, or good policy.

Pornhub’s New Argument Is About Architecture

According to the Statesman report, Pornhub’s July 29 letter argues that site-level age verification has failed because users can turn to noncompliant sites or use virtual private networks to disguise their location. The company also argues that requiring many individual websites to collect personal information creates danger and says device-level verification would be more effective.

Again, those are advocacy claims. Whether a device-level, app-store-level, identity-token, estimation, or site-level system works better depends on legal design, coverage, implementation, bypass rates, privacy protections, and who bears the risk of error.

But Pornhub is pointing at the right systems question: where in the stack should age assurance happen? Moving the check from a website to a device does not eliminate governance. It reallocates it among operating-system providers, app stores, identity vendors, websites, parents, and users.

Age Assurance Is Becoming a Broader Product-Governance Issue

The Texas fight concerns adult content, but the operating problem is broader. Age assurance increasingly appears in debates over social media, app stores, AI companion chatbots, games, targeted advertising, privacy rights, and child-safety features.

A company may need to distinguish adults from minors without turning every ordinary interaction into permanent identity collection. That creates predictable tensions:

• ●Accuracy: false adult and false minor classifications can both cause harm.
• ●Data minimization: the system should collect only what is needed for the decision.
• ●Retention: “do not retain” must apply across logs, analytics, vendors, backups, support records, and fraud systems—not just the main database.
• ●Security: identification and age signals can become high-value targets.
• ●Vendor allocation: contracts must say who verifies, who receives data, who can retain it, and who produces evidence after an incident.
• ●Geolocation and bypass: the system needs a documented response to VPNs, shared devices, travel, and uncertain location without pretending bypass is impossible.
• ●Appeals and accessibility: users need a workable path when a system gets their age wrong or a verification method is unavailable to them.

A Practical Age-Assurance Governance File

Any company considering an age gate should keep a short, concrete record before launch. It should answer:

• ●Trigger: which law, product rule, or risk decision requires age assurance?
• ●Covered experience: which pages, features, content, accounts, or decisions are restricted?
• ●Method: ID check, transactional data, reusable age token, device signal, age estimation, parental approval, or another approach?
• ●Data flow: what enters the system, who receives it, what derived signal returns, and what appears in logs?
• ●Retention controls: how is identifying information deleted or prevented from being stored across every processor and subprocessor?
• ●Testing: what are the known error rates, bypass methods, edge cases, and accessibility limits?
• ●Vendor evidence: what security, privacy, deletion, audit, breach-notice, and change-control terms are in place?
• ●User remedy: how can a person challenge an incorrect result without exposing more data than necessary?
• ●Owner: who can approve the method, monitor performance, respond to incidents, and stop the system if it fails?

The Bottom Line

Pornhub lost the constitutional fight over Texas HB 1181’s age-verification requirement. Its July 29 letter opens a different fight: whether state lawmakers chose the right technical and policy architecture.

Texas can point to a Supreme Court ruling and an enforceable statute. Pornhub can point to bypass, coverage, and privacy concerns. Both can be true at the same time: a law may be constitutional while its implementation remains contested and operationally difficult.

For businesses, the lesson is not to wait for that policy debate to become tidy. If an age rule applies, build the verification system as a privacy and security program—not a cosmetic gate. Know what you collect, what vendors touch, what must be deleted, how you test it, and what evidence proves the process worked.

Related Regulations

Sources & References