Utah Age Verification: What Adult Sites Do With Your ID

Picture this. You click a link, and instead of a page, you get a box asking for a photo of your driver's license or a quick selfie. That is what Utah age verification looks like now that Utah has started enforcing its rules. Before you tap "upload," there is one question worth asking: where does that picture go afterward?

Utah age verification: what changed on November 2, 2026

Here is the short version. Utah's age-verification law, known as SB 73, says adult websites must use "reasonable" verification methods to keep minors out. Enforcement started November 2, 2026. The state also warned sites ahead of time that penalties are coming, according to local reporting from outlets like KSL News.

The people doing the enforcing sit in the Utah Division of Consumer Protection. If a site lets minors in, the division can take it to court. The state's own announcement lays out the details at the Utah Department of Commerce.

That number matters because it explains the mood of every site you are about to visit. A site facing fines would rather over-collect than under-collect. Asking for more from you is the safe move for the company. It is not always the safe move for you. This article is part of a series, start with Facial Recognition False Arrest 9 Wrong Alerts 1 38m Faces.

How Utah age verification works for an ordinary adult

For most people, it will feel like a gate. You arrive at a site. It asks you to prove you are 18 or older. You either upload a government ID, take a selfie so software can guess your age from your face, or give up and leave.

Notice who is holding the data. Utah does not collect your ID or your face. The website, or a company the website hires, does. That is a big difference from showing your license to a bartender, who glances at it and hands it back.

---

Is online age verification safe? What happens to your ID or selfie

It depends entirely on the company handling it. A selfie or an ID photo is biometric data (information about your body or identity that is uniquely you, like your face). Unlike a password, you cannot change it if it leaks. Some vendors say they delete your image right away. Others may keep it. From the outside, you often cannot tell which is which.

Privacy advocates have been loud about this. The Electronic Frontier Foundation has laid out the risks, including data breaches and the tracking of who looks at what. The concern is not abstract. Recent breaches of age-checking vendors, and leaks of government ID images, show how a pile of ID photos becomes a target for extortion.

Submitting your ID to third-party companies raises concerns over who receives, stores, and controls that data.

Privacy concern as summarized in coverage by Reclaim The Net

Read that line twice. Three separate questions are hiding in it. Who gets your image? Who keeps it? Who decides what happens to it next? A privacy policy should answer all three. If it answers none, that tells you something too.

Old-school ID check versus online age checks

The easiest way to see the gap is to put the two side by side.

Question	Showing ID in person	Online age checks
Who sees your ID?	One person, for a few seconds	A website or its vendor, and possibly its servers
Is a copy made?	Almost never	Sometimes, depending on the company's retention (how long it keeps your data)
Can it leak?	No record exists to leak	Yes, if stored and then breached
Can you check the rules first?	Not needed	Yes, in the privacy policy, if you look

---

What the Utah age verification law does not settle

Here is where it gets interesting. The Utah age verification law requires "reasonable" age checks. It does not spell out, in a way the research could find, that a site must collect the bare minimum or delete your information afterward. "Reasonable" is a word lawyers love and everyday people cannot use. Previously in this series: Facial Recognition 1 7 Million London Faces 44 Arrests.

There is also a legal wrinkle. A court issued a preliminary injunction (a temporary order) that blocks Utah from enforcing the parts of SB 73 about VPNs, which are tools that hide your location. The state decided it could still enforce the core age check. So the main rule is live, and the side rule is on hold.

The law also adds a 2% excise tax on covered companies, with the money headed to youth mental health programs. Supporters see that as a fair price for protecting kids. And to be fair to them, the concern is real. Major platforms have been criticized for years for letting kids wander into adult content.

The fair counterpoint: some record-keeping may be unavoidable

Look, nobody is saying this is simple. Some experts argue that privacy-friendly methods, like checking your age on your own phone without sending anything out, are not yet proven at large scale. Others argue that if companies are going to be held accountable, some records may have to exist. Both sides have a point. That is exactly why your own check matters.

---

What to check before you upload: a 60-second privacy routine

If you have ever wondered whether a photo or profile is really who it claims to be, that is the exact question facial comparison and identity verification technology exists to answer. Age checks use some of the same ideas. A system might check liveness (whether the camera is looking at a real, live person or just a photo). It might produce a match score (a number for how alike two faces are). These tools can be done carefully or carelessly.

So here is the one thing to do. Open the privacy policy before you share anything, and look for the answer to a single question: what will it keep, and for how long? Then run through this short list.

One more thing. A promise to "delete quickly" is better than nothing, but experts note that privacy risks stay central even when companies claim tokenization (swapping your data for a stand-in code) or fast deletion. Treat those words as a starting point, not a guarantee.

What can you do if a site's age check feels like too much?

You can say no. Nothing about this law forces you to hand your face or ID to a company you do not trust. Leaving the site costs you a few minutes of curiosity. Handing over your ID to a vendor that gets breached could cost you far more. Up next: Utah Age Verification Adult Sites Can Keep Id And Selfies.

---

Here is the question I keep coming back to. The bartender hands your license back, and the website never has to. If the company that checked you is the one deciding how long to keep your face, who is actually in charge of your Utah age verification: you, or the fine print?

Utah age verification: Frequently Asked Questions