Iowa Wants Your Driver's License. Nobody Will Say Where It Goes.

Picture this: you're a normal adult, on your phone, minding your own business. A website pops up a screen. It says: Prove you're 18. Upload your ID. You do it, because what choice do you have? And then you wonder — for exactly three seconds before you move on — where did that photo of your driver's license just go?

That three-second wonder is the entire point of this article. Because Iowa just answered half of a question and left the other half completely open.

Iowa Governor Kim Reynolds signed House File 864 into law, and it takes effect July 1. The law says adult websites must verify that users are at least 18. Fail to comply? Up to $10,000 in fines. Per day. With every single instance of a minor getting through counted as a separate violation. That penalty structure is enormous — and it matters more than you'd think, because it's quietly shaping exactly how your ID will be handled.

First, the Part That's Hard to Argue With

Kids are getting to this content way too young. The average child first encounters online pornography at 11 years old. Eleven. That's a fifth-grader. Nobody reasonable looks at that number and says "yeah, that's fine." The harm is real. The instinct to do something about it is completely understandable, and Iowa is one of at least 25 states that have now passed some form of age-verification law since 2022.

But here's where "understandable" and "safe" start to separate. This article is part of a series — start with Age Verification Identity Data Security Risks.

The Part the Law Left Blank

Iowa's law says sites must use "reasonable age verification." That phrase sounds responsible. It is, in fact, almost meaningless. It doesn't say whether sites can store your ID. It doesn't say they have to delete it after checking. It doesn't say a third-party company — the kind you've never heard of, running a server somewhere you'll never visit — can't keep a file with your name, your birthdate, your face, and your home address sitting in a database for years.

Compare that to Louisiana, which already has an age-verification law on the books. Louisiana mandates that verification records be kept for up to seven years. Seven years of your identity information, held by websites and the companies that check IDs for them, all because you wanted to prove you were a legal adult. That's not a safety net. That's a data honeypot — a big, tempting target for hackers — just waiting to be broken into.

This isn't paranoia. The Electronic Frontier Foundation has documented exactly this risk: identity-verification companies have been breached before, and when government-issued ID documents get stolen in those breaches, the downstream damage — identity theft, fraud, financial ruin — is dramatically worse than a stolen password. You can change a password. You cannot change your face or your Social Security number.

"Users forced to hand over identity information lose the ability to access the web anonymously, and because removing minors' ability to communicate requires sorting minors from adults, all users' ability to surf the web privately and speak freely goes away." — Center for Democracy and Technology

That's the uncomfortable trade hiding inside these laws. To separate kids from adults online, every adult has to give up a piece of their anonymity. Every single time.

There Are Actually Better Ways to Do This

Here's where it gets interesting — because the technology to do this more safely already exists. Researchers call it attribute-based verification (meaning: a system that confirms only "yes, this person is over 18" without ever sending their name, address, or ID photo anywhere). Think of it like a bouncer who checks your ID, nods, and immediately forgets your name — versus a bouncer who photographs your license and files it in a cabinet.

Some countries are already moving this direction. Poland recently adopted an age-verification law and officially recommended using a digital wallet approach — the kind where your phone confirms your age to an app without the app ever actually seeing your government ID. According to TechPolicy Press, this "zero-knowledge" method — where a system proves a fact without revealing the underlying data — presents dramatically lower privacy risk than document-based verification. Previously in this series: Mom Dont Wire That Money The 6 Word Rule That Stops A 1m Dee.

So why aren't U.S. states requiring that approach? Partly because it's newer and less tested at scale. But also — and this is the part that should make you raise an eyebrow — because platforms facing $10,000-per-day fines have every incentive to collect more data, not less. If you're a company terrified of a lawsuit, you want a paper trail (or a digital one). You want to be able to prove, years later, that you checked. That means storing records. That means a database. That means risk for you, the user.

The Bigger Pattern Worth Watching

Iowa is not an outlier. It's a preview. According to Super Lawyers, the U.S. Supreme Court upheld Texas's age-verification law in a recent case called Free Speech Coalition v. Paxton, which means the legal path for these laws is now pretty clear. States will keep passing them. Courts are unlikely to strike them down. The "prove your age" moment is coming to a website near you — probably soon, and probably more than once.

What's not yet clear is the patchwork of rules that will govern what happens next. Arbiter's state-by-state analysis shows that retention policies, acceptable verification methods, and third-party data rules vary wildly from state to state. One company complying with Iowa's law might handle your data completely differently than one complying with California's. You, the user, have no easy way to know which rules apply to the site you're visiting right now.

One response some platforms have already chosen: just block users in states with these laws entirely. One major adult-content platform geo-blocked all of Louisiana when that state's law passed rather than deal with the compliance headache. That's technically legal. It's also a preview of what the internet could start to look like — fragmented by state lines, with your access to legal content depending on your zip code.

And that's before we even get to the accuracy question. Age-verification systems that scan faces or ID documents make mistakes. Carnegie Mellon University's privacy law researchers have flagged that these systems can fail differently across racial and demographic groups — meaning a system that works fine for one population may wrongly flag or block users from another. When the stakes are "prove you're allowed to see this content," those errors have real consequences for real people.

If you ever get a "verify your age" prompt and want to actually assess the risk before clicking upload, here's one concrete thing to look for: does the site use a named third-party verification service, and does that service have a published data-deletion policy? Not a privacy policy buried in 40 pages of legalese — an actual, findable answer to "how long do you keep my ID?" If that answer doesn't exist, or it takes 20 minutes to find, that's important information about who you're trusting with your identity.

That kind of verification — checking whether an identity behind a prompt is actually what it claims to be, and whether the system behind it is trustworthy — is exactly the problem that tools like CaraComp are built to think about. Not just "is this person real?" but "is this process safe?"

Iowa's law goes live July 1. The fine for letting a minor through is up to $10,000 per incident. There is no fine — not one cent — for storing your ID longer than necessary, sharing it with a data broker, or losing it in a breach.

Make of that asymmetry what you will.

So here's the question we're genuinely curious about: If a website has to verify your age, what would actually make you trust the process — no stored ID at all, a third-party service with a deletion guarantee, proof done entirely on your own device, or something else? Drop it in the comments. There's no wrong answer here, and honestly, your instinct on this is as informed as most of the people writing these laws.