Why age verification laws should require more than an IP address to prove a user’s location
Understanding “the VPN Fallacy”
Some adult websites claim they comply with state-mandated age verification laws by blocking access from states where such laws are in effect. However, this claim is misleading so it is referred to as “the VPN fallacy”. In reality, these websites typically block access based only on the geographic location associated with a user’s IP (Internet Protocol) address. This method is easily circumvented through the use of VPNs (Virtual Private Networks), proxy servers, and other tools that can disguise or alter a user’s apparent location.
A VPN allows users to route their internet traffic through servers in other locations, making it appear as if they are browsing from a different state or even a different country. This means that despite a website’s claim of blocking access, users within a state requiring age verification can still easily access adult content simply by using a VPN or similar technology.
Why IP-Based Geolocation is Insufficient
IP addresses provide a rough estimate of a user’s location based on the registered location of their internet service provider (ISP). However, ISPs often allocate IP addresses in ways that do not accurately reflect where users are physically located. This is compounded by the fact that many VPNs and proxy services offer easy-to-use apps that allow users to select an IP address from another state with just a few clicks.
To properly enforce state laws requiring age verification, websites must do more than just rely on IP address geolocation. Instead, they should be required to use state-of-the-art geolocation technology similar to what is used in regulated online gambling industries.
Available Technology for Robust Location Verification
Online gambling platforms must ensure that users are physically located in a jurisdiction where betting is legal before allowing them to place bets. These platforms use a combination of technologies to confirm a user’s actual location, including:
- GPS Data: If a user is accessing content on a mobile device, their device’s GPS (Global Positioning System) location can provide precise location data.
- Cell Tower & Wi-Fi Data: Analyzing nearby cell towers and Wi-Fi networks can help verify a user’s physical presence outside a regulated state.
- Device Sensors: Some applications can use barometer readings to detect changes in altitude, helping confirm a user’s physical location.
- Third-Party Verification Services: Companies (such as GeoComply) specialize in location compliance and use a combination of these technologies and other available data points to provide high-confidence geolocation verification.
By integrating such techniques, adult websites could be required to perform a similar level of due diligence before exempting a user from an age verification check based on their claimed location at the time the age check is required.
How This Can Be Implemented Fairly
A key concern when discussing location verification is user privacy. Importantly, requiring robust location verification does not mean tracking users at all times. Instead, location data would only be requested at the specific moment when a user would otherwise be required to complete an age verification check. In effect, the user is seeking an exemption from the age verification process by proving they are in a state where it is not legally required.
Additionally, users would need to provide explicit consent before their location data is used. If a user does not wish to share their location, they would simply be required to complete the standard age verification process instead. This ensures that no one is forced to reveal their location unless they voluntarily choose to do so as an alternative to age verification.
Adult websites can also choose to block traffic coming via know VPN IP addresses. Lists of these are freely available and more sophisticated prevention is offered by specialist services. Well known sites such as Netflix and the BBC already do this effectively.
Does this affect enforcement?
No state law requiring age verification includes an exception for children who make use of a VPN. The pornographic sites are still required to prevent them from accessing their content, and remain fully liable for failing to do so. The sites remain liable to both state-led enforcement measures and lawsuits under private right of action. The sites may hope that they can persuade a state judge that IP blocking is sufficient as a defence, while retaining the custom of many users in the state they claim to have blocked, but as this briefing has explained, that is not a technically coherent argument.
Conclusion
Lawmakers should be aware that relying solely on IP address geolocation is ineffective and allows users to easily bypass age verification requirements. The technology already exists to perform reliable location verification. By mandating that adult websites use robust location verification methods similar to those in online gambling, lawmakers can close this loophole and better enforce age verification laws in their states.
