Age verification in Australia: Pornhub back for Apple users

Picture a site you used to visit that vanished from your screen in March. Now it's back, with one catch: you have to prove your age first. That is the story of age verification in Australia right now, and the question nobody answers at the front door is simple. Where does that proof go?

Age verification is the process of proving you're an adult online, and one site's return to Australia doesn't tell you whether the check protects your privacy, so look at how it works and what happens to your information before you finish it.

Age verification: what one site's return actually tells us

Here is the short version. Pornhub's parent company, Aylo, blocked Australians from its adult content in March. The reason was new age verification rules that carried fines of up to $49.5 million, according to Inkl's roundup of the coverage. The company said at the time that collecting personal details from users for age verification created real privacy risks.

Then, per ABC News Australia, the site came back. Not for everyone, though. Apple users whose phones have already completed age verification get access again.

So one company changed its mind. Did the privacy risk it warned about disappear? Nothing in the reporting says so. What changed is where the age verification happens. That is a real difference, but it isn't the same as "problem solved."

How an online age verification system works when it happens on your phone

Think of it like a bouncer who checks your ID once, at the door of the whole building, instead of at every room. Your phone's maker completes the age verification. The websites just get a yes or no. Fewer companies hold a copy of your passport scan or card details. That is the idea, and the industry has pushed it for years, as the Australian Computer Society explains in its coverage of Aylo's response. This article is part of a series, start with Uk Shop Face Recognition Innocent Shoppers Named As Thieves.

But notice what that means. The pile of sensitive information doesn't vanish. It moves to one place. If you trust that one place, the trade can be a good one. If you don't, you've just put all your eggs in one basket.

---

Australia age verification: why Apple users got in and everyone else didn't

Here's the part that made me wince. According to Mysterium VPN's analysis, people on Android phones, and people without a smartphone, still can't get in. So Australia age verification now works like a two-lane road. One lane has a single trusted checkpoint. The other lane has no way through at all.

Why does that matter for your privacy? Because people who fail age verification and lose access go looking for workarounds. Some of those workarounds ask for even more of your information. That's a pattern worth watching, and it's a side effect nobody puts in the press release.

Approach	What it means for your information
Device-level age verification (Apple users in Australia)	Your phone confirms you're an adult once, and the site gets a yes or no instead of your documents
Site-by-site age verification process	Each website, or the third-party verification services it hires, may ask for an ID scan, a card or a face, so more places could hold your details
Android users and people without smartphones	No route into the site in Australia, according to Mysterium VPN
Age estimation from a face (guessing age from a photo)	Can land within two to three years, but can be fooled by a printed photo or a mask

Who holds the proof once a system can confirm your age?

This is the question the headline skips. The research behind this story points to credit cards, passport scans and government IDs as the kinds of proof used in age verification, which edges it toward full identity verification. The public still doesn't know what happens to that proof afterward. Is it deleted in minutes? Kept for years? Seen by whom?

Investigators care about this for a different reason than you do. They need an audit trail (the record of who looked at what, and when) to know an age verification check was done properly. You need the same record for a simpler reason: so you can tell if something went wrong with your own information.

---

What are the privacy risks of online age verification?

It depends on the method, and nobody can honestly say yes across the board. The Electronic Frontier Foundation, a digital rights group in the United States, warns that these verification systems have been breached before, exposing the very details people handed over. A safer age verification setup keeps less data, deletes it fast, and says so in plain words.

Age verification can tie a person's "most sensitive and immutable data" to what they do online.

Electronic Frontier Foundation, in 10 Not-So-Hidden Dangers of Age Verification (paraphrased summary with the quoted phrase)

"Immutable" just means you can't change it. You can reset a password. You can't reset your face or your date of birth. The EFF's list of what's at stake includes names, faces, birthdays and a home address. Tie age verification records to someone's browsing and you've built a file most people would never agree to if it were described that way. Previously in this series: Facial Recognition Indias Top Court Weighs Wrong Matches.

Can age estimation from a selfie be fooled?

Yes. Some systems use age estimation to look at a face and guess a user's age. That guess can come within two to three years, but Syracuse University News describes how such tools can be tricked with spoofing (holding up a printed photo, a mask, or a screen to pose as someone else). The defense is called liveness (whether the camera is looking at a real, live person or a picture of one), and the gaps in it are the weak spot.

Here's the part I find genuinely odd. If age verification can be fooled, then the data it collects may not even be reliable. So why keep it? The Tech Policy Press piece on age gating points toward data minimization (collecting only what you need and tossing it as soon as you're done). That's the standard to hold any age verification method to.

---

What to look for before finishing an age verification check

Let's get practical. You're at the screen, you might be asked for proof, and you're tired. Here's the one thing to do first, before you verify your age: look for a plain statement of what happens to your proof once the age verification passes. A good answer names a time (deleted right away, or within a set number of days) and says who can see it. A bad answer is silence, or a wall of legal fine print.

If you've ever wondered whether a photo or profile is really who it claims to be, that's the exact question this kind of technology exists to answer. The same logic runs both ways. An age verification system that checks you should be able to show its work.

Also ask whether the age verification happens on your device or on someone else's server. On the device is generally the lighter footprint. Then ask whether age verification needs a face scan at all, or whether a simpler proof will do. Fewer pieces of you in the pipeline is almost always better.

And here's my honest opinion. A returning site is a business decision, not a privacy audit. Aylo went from "this is too risky" to "we're back" in months, and the public still lacks the details that would show whether anything about the risk actually changed. That gap is the real story.

So here is the line I can't shake. One site reversed course in a matter of months, but the question it raised in March, who keeps the proof, still has no public answer. Would you hand over your passport to find out?

Age verification: Frequently Asked Questions