Age verification: Pornhub returns, but only for Apple users

A major adult website just came back to Australia. But only for people who own an Apple device. Everyone else is still locked out.

Maybe you've never visited that site

Maybe you've never visited that site. Maybe you never will. But this story is about something that touches almost everyone online. It's about what happens when a website asks you to prove who you are. And where that proof goes afterward.

Here's what happened. In March, the site's parent company blocked Australian users. Australia's new age verification rules threatened fines of nearly fifty million Australian dollars. The company said collecting personal information from users carried serious privacy risks. Now the site is back. The difference is that Apple handles the age check on the device itself. So the question is simple. Does that actually protect your data, or just move it somewhere else?

Start with how the old model works. You visit a website. It asks for proof you're an adult. You hand over a credit card, a passport scan, or a government ID. Now picture that happening across dozens of different sites. Each one becomes another place holding a piece of your identity.

Researchers at the Electronic Frontier Foundation

Researchers at the Electronic Frontier Foundation have warned about exactly this. They say age checks can tie your name, your face, your birthday, and your home address to what you do online. They call that data sensitive and immutable. Immutable means you can't change it. You can replace a stolen password. You can't replace your face.

And these systems have been breached before. Age verification services have leaked users' most sensitive information. For an everyday person, that's the nightmare. You proved you were an adult, and now a stranger holds your passport scan.

Apple's approach changes the shape of that risk. The check happens at the level of the phone's operating system. The website doesn't collect your documents. Experts describe this as one of the strongest and hardest-to-dodge protections available. The industry has pushed for this model for years. Their argument makes sense. One trusted checkpoint beats dozens of scattered ones.

Look at who gets left out

But look at who gets left out. Android users still can't get in. Neither can people without a smartphone. So you end up with two tiers. One group has its data checked in one place. Everyone else faces the old system, where each site collects its own pile of personal records. Your risk now depends on which phone is in your pocket.

There's another problem. Many age checks use A.I. to estimate your age from your face. Those tools can guess within two or three years. But researchers at Syracuse University point to a weakness. These systems can be fooled by presentation attacks. That means something as simple as a printed photo or a mask. So a company might store your face scan, and the scan might not even prove anything. Why keep it at all?

For investigators, there's a practical side. If a case ever involves an online platform, records of who verified what could matter. Those records can only be subpoenaed if a company kept them and documented how it handled them. That's a tension. Privacy advocates want less data kept. Investigators sometimes need more. For the rest of us, it's a reminder that someone decides how long your ID sits in a database.