Iowa Wants Your Driver's License. Nobody Will Say Where It Goes.

Starting July first, an adult website in Iowa is supposed to check your ID before letting you in. But the law that requires it never says where your driver's license goes after that. Not who holds it. Not how long they keep it. Not whether they ever delete it.

If you've ever uploaded a photo of your ID to get

If you've ever uploaded a photo of your ID to get into a website or open an account, this story is about you. Iowa's Governor Kim Reynolds signed a bill called House File 864. It orders adult sites to confirm visitors are at least eighteen. Sites can do that with a digital ID, with transaction data, or with other methods the state attorney general signs off on. Iowa's now one of at least twenty-five states with a law like this. So the real question isn't whether kids should be blocked. It's this — once you hand over your ID, who's keeping it, and why?

Let's start with the money, because the money explains the behavior. Under Iowa's law, a website that slips up can be fined up to ten thousand dollars a day. And every single time a minor gets in counts as its own separate violation. Picture that math. A company facing that kind of liability has one obvious defense — proof. Proof they checked. Proof they tried. And proof means keeping records. So the law accidentally rewards companies for collecting more of your data and holding onto it longer. For you, that means your ID doesn't just get checked. It gets stored — as evidence in someone else's legal defense. Previously in this series: Age Verification Laws Privacy Tradeoff Who Holds Your Id.

Now look at what happens when storing becomes the norm. In Louisiana, a similar law lets companies keep verification records for up to seven years. Seven years of scanned driver's licenses, sitting on a server. Privacy researchers have a name for that. They call it a honeypot. A big, sweet pile of personal data that attracts hackers. And these breaches aren't hypothetical. The Electronic Frontier Foundation has tracked age-verification vendors getting breached before. When that happens, it's not just a leaked password. It's your actual government ID in a stranger's hands.

There's a better way to do this, and it's worth knowing the name. The Center for Democracy and Technology points to something called attribute-based verification. In plain terms — the system confirms one fact. You're over eighteen. It says yes, and nothing else. Not your name. Not your address. Not a copy of your license. Carnegie Mellon researchers point out that if a breach hits, a stolen "yes, this person is an adult" is almost useless to a thief. A stolen ID document is a goldmine. But here's the gap. Iowa's law only asks for "reasonable" age verification. It never says use the private method. And vague rules push companies toward whatever's cheapest and easiest — which is usually the version that grabs everything. Up next: Your Face Cant Be Reset The Hidden Cost Of Proving Youre Ove.