Why age verification laws should require more than an IP address to prove a user’s location
Understanding “the VPN Fallacy”
Some adult websites claim they comply with state-mandated age verification laws by blocking access from states where such laws are in effect. However, this claim is misleading so it is referred to as “the VPN fallacy”. In reality, these websites typically block access based only on the geographic location associated with a user’s IP (Internet Protocol) address. This simplistic method is easily circumvented through the use of VPNs (Virtual Private Networks), proxy servers, and other tools that can disguise or alter a user’s apparent location. An IP address alone is no longer a reliable indicator of a user’s location for compliance purposes.
A VPN allows users to route their internet traffic through servers in other locations, making it appear as if they are browsing from a different state or even a different country. This means that a website may claim it is blocking access, but users within a state requiring age verification can still easily access adult content simply by using a VPN or similar technology.
But equally, those services who argue that the ease with which users can virtually relocate themselves makes its impossible to enforce age-restrictions in particular jurisdictions, build that argument on the false premise that IP addresses are the only indicator of a user’s location. In reality, there are many more technical and behavioural clues that can flag when VPN users are likely to be within an age-restricted state and should be challenged either to prove their location or their age, not simply exempted from all compliance checks.
Why IP-Based Geolocation is Insufficient
IP addresses provide a rough estimate of a user’s location based on the registered location of their internet service provider (ISP). However, ISPs often allocate IP addresses in ways that do not accurately reflect where users are physically located. This is compounded by the fact that many VPNs and proxy services offer easy-to-use apps that allow users to select an IP address from another state with just a few clicks.
To properly enforce state laws requiring age verification, websites must do more than just rely on IP address geolocation. Instead, they should be required to use state-of-the-art geolocation technology similar to what is used in regulated online gambling industries.
Available Technology for Robust Location Verification
Online gambling platforms must ensure that users are physically located in a jurisdiction where betting is legal before allowing them to place bets. These platforms use a combination of technologies to confirm a user’s actual location, including:
- GPS Data: If a user is accessing content on a mobile device, their device’s GPS (Global Positioning System) location can provide precise location data.
- Cell Tower & Wi-Fi Data: Analyzing nearby cell towers and Wi-Fi networks can help verify a user’s physical presence outside a regulated state.
- Device Sensors: Some applications can use barometer readings to detect changes in altitude, helping confirm a user’s physical location.
- Third-Party Verification Services: Companies (such as GeoComply) specialize in location compliance and use a combination of these technologies and other available data points to provide high-confidence geolocation verification.
By integrating such techniques, adult websites could be required to perform a similar level of due diligence before exempting a user from an age verification check based on their claimed location at the time the age check is required.
How This Can Be Implemented Fairly
A key concern when discussing location verification is user privacy. Importantly, requiring robust location verification does not mean tracking users at all times. Instead, location data would only be requested at the specific moment when a user would otherwise be required to complete an age verification check. In effect, the user is seeking an exemption from the age verification process by proving they are in a state where it is not legally required.
Additionally, users would need to provide explicit consent before their location data is used. If a user does not wish to share their location, they would simply be required to complete the standard age verification process instead. This ensures that no one is forced to reveal their location unless they voluntarily choose to do so as an alternative to age verification.
Adult websites can also choose to block traffic coming via knownVPN IP addresses. Lists of these are freely available and more sophisticated prevention is offered by specialist services. Well known sites such as Netflix and the BBC already do this effectively.
The same issue applies to other use-cases
The VPN fallacy is not limited to adult websites. It also applies where social media platforms are required to prevent children below a specified age from accessing or maintaining accounts. A child should not automatically fall outside an age restriction simply because a VPN makes their IP address appear to originate in another jurisdiction.
Social media services can detect traffic associated with known VPNs, proxies and other anonymisation services. Where apparent location is unreliable, they can use additional technical, behavioural and contextual signals to assess whether a user is nevertheless likely to be located within a regulated jurisdiction.
These signals can include device language and timezone, regional and app-store settings, SIM or telephone number information, currency and payment indicators, previous IP addresses and network characteristics. Even characteristics such as latency and the timing or routing of communications can contribute to an assessment of whether the apparent location is credible.
Social media platforms also possess information that can indicate whether an account is likely to belong to a child. Relevant signals can include interests, topics discussed, content viewed or searched for, friendship and follower networks, patterns of interaction, school-related activity, language and images or videos associated with the account.
No single signal necessarily proves either location or age. But a combination of signals can flag an elevated probability that a user is both located in a regulated jurisdiction and underage. That risk can then trigger an appropriate age assurance process.
This provides a proportionate response to VPN circumvention: detect likely circumvention, then assess location and age risk and only then require age assurance where the risk threshold is reached.
As other use-cases are considered for age assurancs, such as AI companion chatbots, generative AI, prediction markets etc. the nature of the behavioural flags may differ but the argument that it is possible to notice VPN traffic that is likely to be coming from a regulated region stands, and the technical signals are the same.
Does this affect enforcement?
No state law requiring age verification includes an exception for children who make use of a VPN. The pornographic sites are still required to prevent them from accessing their content, and remain fully liable for failing to do so. The sites remain liable to both state-led enforcement measures and lawsuits under private right of action. The sites may hope that they can persuade a state judge that IP blocking is sufficient as a defence, while retaining the custom of many users in the state they claim to have blocked, but as this briefing has explained, that is not a technically coherent argument.
Some states are explicitly addressing the issue of VPNs in more recent laws – but that does not imply that, by omission, existing laws accept the arguments that a child with a VPN does not get the same legal protection as one without, Nor is there a legal reason to argue that those earlier laws which are silent on whether an IP block is sufficient to secure a get-out-of-jail-free card for the website, do or do not get interpreted that way, It would be like saying that one statute prohibiting murder no longer applies to axe-murderers because a newer statute expressly includes the use of an axe in its definition of murder.
Conclusion
Lawmakers and regulators should be aware that relying solely on IP address geolocation is ineffective and allows users to bypass age assurance requirements by disguising their apparent location.
Technology already exists to detect VPN and proxy use and to assess a user’s likely location using multiple signals. This extends to other use-cases. For example, social media services have a further advantage: they can combine technical location signals with behavioural and contextual information that may indicate a user is underage. Where the evidence suggests that a user is both within a regulated jurisdiction and below the relevant age threshold, the service can require appropriate age assurance or rigorous geo-location checks to prove the user is in fact outside a regulated region..
Regulated services should therefore not be able to treat an apparently out-of-jurisdiction IP address as sufficient evidence that an age requirement does not apply. The appropriate response is risk-based: detect likely circumvention, assess the available location and age signals and require age assurance where the risk justifies it.