Texas’ war on porn

A few clicks provides access to an entire world of pornography — millions of videos and thousands of pages, available to anyone, regardless of age. Last year, Texas aimed to put an end to this with the controversial HB 1181 law, which mandates that entities distributing adult content verify the ages of their users. However, the law does not apply to all platforms: some sites and social networks that allow explicit content, such as X and Reddit, are exempt. Under the law, a digital platform is not considered pornographic if less than a third of its content is “sexual material harmful to minors.” But if that threshold is exceeded, the platform must ensure that only adults over 18 can access the content.

This law has sparked a conflict between those who argue that it infringes on freedom of expression and privacy, and the conservative state government, which has begun imposing million-dollar fines on offending companies.

HB 1181 was passed in May 2023 with 133 votes in favor, two abstentions, 13 absences, and a single vote against. Despite appeals from civil rights groups and major companies affected by the law, it went into effect in September of the same year, following a ruling from the Fifth Circuit Court of Appeals that declared the law did not violate constitutional rights. By February of the following year, the sanctions began to arrive.

In February 2024, Attorney General Ken Paxton’s office filed lawsuits against several tech companies, including Aylo Global Entertainment (owner of PornHub), WebGroup Czech Republic (owner of XVideos, XNXX, Bangbros, and PornTube), Hammy Media (owner of xHamster), and Multi Media LLC (owner of Chaturbate). xHamster, for example, was fined $1.67 million, with an additional $10,000 charged for every day of non-compliance since the lawsuit was filed. Meanwhile, Multi Media LLC agreed to pay $675,000 of an initial $1.78 million fine after agreeing to implement age verification measures.

Some platforms have responded by blocking access to their sites in Texas. “Sites like PornHub are on the run because Texas has a law that aims to prevent them from showing harmful, obscene material to children. In Texas, companies cannot get away with showing porn to children. If they don’t want to comply, good riddance,” said Paxton. The Republican is one of the most conservative attorney generals in the United States. In recent years, he has opposed same-sex marriage, abortion rights, transgender student athletes’ rights, and books on sex in schools.

According to Mike Stabile, public policy director for the Free Speech Coalition — a nonprofit advocating for rights within the adult entertainment industry — Sen. Angela Paxton, the attorney general’s wife, is the lead sponsor of the anti-porn legislation. The Paxtons belong to the Prestonwood Baptist Church in Plano, and along with pastors Mike Buster and Chris McKenna, reportedly played a key role in drafting and promoting the bill. “The groups pushing these laws are largely faith-based organizations that believe no one should have access to this material,” said Stabile.

The only vote against

Of the 150 lawmakers and 31 senators in Texas, the only one who voted against the HB 1181 bill was Democrat María Luisa Flores. She was also the only person to respond to EL PAÍS’ request for an interview among the dozen senators, prosecutors, and lawyers involved in the case, including the Attorney General’s Office.

Flores, a 68-year-old lawyer nicknamed Lulu, explains her decision. “With the bill, we had some health warnings about the potential of the material, so there needed to be some warnings. And I thought that was an overreach by the Senate,” she said. She was concerned that research on porn addiction “was too broad and didn’t present any real substantive evidence.” Indeed, there is no definitive conclusion on this issue. According to a study published in Nature, the only non-substance-related disorder classified alongside substance use disorders is gambling.

However, lawmakers applied the same logic to pornography as they do to alcohol and cigarettes. In Texas, even if you have gray hair, you must show ID when purchasing these products. The difference is that no gas station attendant keeps your information. Even if it were stored or leaked, people generally tend to be more discreet about the type of pornography they consume than the beer they drink.

As with cigarette packaging, the law requires that X-rated websites display warnings from the Department of Health and Human Services in at least 14-point font. One of the messages reads: “Pornography is potentially biologically addictive, proven to harm brain development, desensitizes brain reward circuits, increases conditioned responses and weakens brain function.” And websites also had to include a phone helpline number for people with mental health or substance abuse issues. On October 7, the Fifth Circuit Court ruled that the age verification could stand, but not the health warnings.

Flores’ opposition was also motivated by the subjective nature of the line between what is considered art and what is not. The law states that sexual material “lacks serious literary, artistic, political, or scientific value for minors” — a claim Flores rejects. “Art that some consider pornographic is not pornographic for others,” she explained. “That’s a very legitimate concern. And I tend to lean toward protecting artistic expression. You have to protect people who are being exploited, and I obviously oppose the exploitation of children and the sharing of inappropriate materials. So you have to be able to find a balance between First Amendment rights and privacy rights.”

On the other hand, Flores understands that the age verification process is a barrier to accessing X-rated sites. “It is almost a deterrent,” she said. “The problem is, if I go to a porn site, I get angry at the spam. Your search engine takes you everywhere, and the next thing you know, you’re flooded with messages or blocked.” During the investigation for this report, after registering on several porn sites, we received email alerts about risks, spam messages, sextortion attempts, fake followers on social networks, and at least three weekly Chaturbate promotions.

Resilience and VPN workarounds

At present, nearly all major adult sites are blocked in Texas: PornHub, Brazzers, BangBros, Reality Kings, PornTube, YouPorn, and Digital Playground, among others. Visitors are greeted with the following message: “As you may know, your elected officials in Texas are requiring us to verify your age before allowing you access to our website. The Texas law for age verification is ineffective, haphazard, and dangerous.” The notice further states: “Until the real solution is offered, we have made the difficult decision to completely disable access to our website in Texas.”

However, as is often the case, there’s a loophole: you can trick the system with a virtual private network (VPN). With a VPN, you don’t need to leave Texas physically — the internet simply thinks you have, allowing you to bypass restrictions. Indeed, after the restrictions came into force, VPN usage in Texas skyrocketed by over 1,500% within 10 days.

“Any regulation that requires hundreds of thousands of adult sites to collect significant amounts of highly sensitive personal information is putting user safety at risk,” a spokesperson for the adult website Aylo told EL PAÍS. “Furthermore, as experience has shown, unless it is properly enforced, users will either access sites that do not comply with the laws or find other methods to circumvent them.” Of the around 20 sites reviewed, only xHamster and Chaturbate currently comply with HB 1181′s age-verification requirements.

Smile for the camera

To verify your age on xHamster, simply turn on your camera and align your face with the on-screen guide — ears in place and all. “Your scan is private. No images will be stored or shared,” reassures a message from xHamster while the software processes your scan. In less than 10 seconds, assuming your face appears adult, you’re granted access.

Cyprus-based xHamster is one of the most visited sites globally, with more than 2.45 billion hits over the past two years. To sidestep the Texas Attorney General’s lawsuit and continue offering its services in the state, xHamster enlisted a third-party service to handle age verification. This company, Yoti, provides three verification options: facial estimation, ID scanning, or creating a user profile on its website.

The first option is the easiest. The second takes two minutes because you are asked for more information: the country you are in, the type of document you have, scans of both sides of the document, and a face scan to confirm it matches the photo. For the third option, you have to visit Yoti’s website, create a username and password, verify your email via a link, download an app, link the account, scan a QR code, and input a confirmation code. Chaturbate employs a similar process, but age verification in its case is managed by a different provider, Incode.

But who are Yoti and Incode, and what do they do with the information? Yoti is a British company whose stated mission is to become “the world’s most trusted identity platform.” Its clients include Instagram and OnlyFans. Incode, headquartered in California, aims to “power a world of trust.” Founded in 2014, like Yoti, Incode lists Amazon and Rappi among its clients. Yoti and Incode are direct competitors.

Rachael Trotman, Communications Manager at Yoti, explained to EL PAÍS that their verification service neither stores nor shares documents or biometric data with third parties. According to Trotman, the facial age estimation is precise, fast, and user-friendly — it completes its calculation in just one second. “It’s a privacy-preserving solution, as users don’t need to share documents, names, dates of birth, addresses, phone numbers, or credit card information,” she said. If facial estimation fails, for instance, due to factors related to appearance, Trotman recommends creating a user profile instead.

Regarding concerns that these laws infringe on free speech, Fernanda Sottil, Strategy Director at Incode, said: “I don’t think it’s a free speech issue; it’s more of a privacy concern, as my data might end up on third-party platforms.” She explained that the data remains under the user’s control, allowing them to decide who has access and to revoke that access whenever they choose. However, certain platforms like Chaturbate only allow ID scanning for verification.

“It depends a lot on the client’s configuration [Chaturbate, in this case] and the risk policies in each state. Clients configure their verification flows according to different conditions,” said Sottil.

As for facial scanning, she claimed it is 99.5% reliable and that it does not capture iris data. “It checks very subtle things that perhaps you and I would not notice. The distance between the eyes, the proportions between the eyes and the nose, the presence of wrinkles... This algorithm has been trained with millions of users and data that Incode collects to improve its estimation,” said Sottil. “The biometric information and the data are 100% encrypted, it is a mathematical function. If someone hacks Incode’s servers, the only thing they see are lines of code with ones and zeros and certain icons. It is not decipherable by the human eye, it cannot be identified.”

For Stabile, the Free Speech Coalition advocate, all of these systems are cumbersome: “If you’re on your phone and you’re trying to access a website, you’ll likely give up if they ask you to upload an ID and scan your face and send it to a third party. They’re meant to be difficult, to create restrictions that no one will comply with, to punish businesses that are legal.”

Incode’s own privacy policy specifies that “no method of transmitting data over the Internet or storing data is completely secure.” This was made clear by a series of high-profile data breaches in the U.S. Some of the most notorious examples include the 2019 Capital One hack, which exposed the personal information of over 100 million customers, and the 2018 Marriott International breach, which compromised the data of roughly 500 million guests.

Restrictions spreading

Texas isn’t alone in implementing these measures. Similar laws have been enacted in 17 other states, including Alabama, Arkansas, North Carolina, South Carolina, South Dakota, Georgia, Idaho, Indiana, Kansas, Kentucky, Louisiana, Mississippi, Montana, Nebraska, Oklahoma, Utah, and Virginia. Some states have gone even further. Florida, for instance, will implement the HB3 law on January 1, prohibiting children under 14 from managing social media accounts. Teenagers aged 14 and 15 will only be allowed access with parental consent.

Critics argue that determined minors will likely find adult content elsewhere, such as through social media. That is why the Free Speech Coalition and its allies are advocating for greater parental oversight. “Parents, who should be the first line of protective defense of their children, have many tools available to them to protect their children from inappropriate adult content,” reads the coalition’s request for injunctive relief against the Texas Attorney General’s Office. The lawsuit, filed by the Free Speech Coalition, the American Civil Liberties Union (ACLU), and affected adult entertainment companies, is being handled by the law firm Quinn Emanuel. In this battle, the defenders of digital freedoms have already succeeded in getting the Supreme Court to review their case.

Sign up for our weekly newsletter to get more English-language news coverage from EL PAÍS USA Edition