Laws requiring age verification to keep teens off adult sites don’t really work, the Phoenix Center said in a new analysis released Thursday, which says such mandates do little to discourage minors while exacting significant costs on adults’ lawful access to content.
According to the think tank’s cost-benefit analysis, these measures are unlikely to pass constitutional muster in the absence of demonstrable real-world effects. The findings reflect a working paper by researchers at New York University and other institutions, which also concluded that in the online realm, too, there are limits to age-gating.
Key Findings Of The Phoenix Center Analysis
Directed by Chief Economist Dr. George S. Ford, the study analyzed search habits before and after states implemented age checks or when significant adult platforms restricted access to these states.
Trawling through Google Trends, Tweets, and the fleshpots of all-night adult sites, it identified a 47% hike in searches for “VPN” across the week that a major adult site withdrew service, with interest remaining high for around 20 weeks. There was a 30 percent increase in searches for “free porn,” with no meaningful snapback.
Because Google’s data does not reveal user ages, the study triangulates with earlier work that has found teenagers easily learn how to use VPNs and other circumvention tools. The lesson: barriers designed to ward off minors are more likely to drive them instead to less regulated corners of the internet rather than truly reduce exposure.
At the same time, adults obeying the rules confront new friction—going through government IDs, selfies, or biometric scans—to access legitimate content. That imbalance, the study suggests, undermines the policy rationale for the mandates.
Constitutional Hurdle and the Intermediate Scrutiny Test
The legal backdrop matters. Within this subject of scrutiny, courts have included age-verification requirements for adult content, recognizing that the government has a compelling interest in protecting children. Yet even under that baseline, the regulation must serve to significantly further its purpose without overly restricting protected expression.
That is, Ford’s analysis claims that the laws would have to discourage a substantially higher proportion of minors than adults from seeking in order to satisfy this test. If kids can evade common checks with easily available tools and grown-ups shoulder the price of mined data sharing and access, the benefit-to-burden ratio does not work well. Civil liberties organizations including the American Civil Liberties Union and the Electronic Frontier Foundation have made what appear to be similar arguments in other active challenges.
Workarounds: Security and Privacy Risks
One of the study’s more pointed warnings was about unintended consequences: as users pivot to free VPNs and sketchy mirror sites, they incur new risks. The report points to exposure to ransomware, leaks of IP addresses, aggressive third-party tracking, and data brokers building user profiles based on traffic routed through “no-cost” services.
Those risks are not theoretical. Cybersecurity companies have consistently found VPN apps with malware, poor or broken implementations of encryption standards, and ad-injection scams that undermine privacy. The net result: an internet that might be less safe, especially for the very people those rules are meant to protect.
Policy Momentum Collides With Mix of Results
Despite clear signs of circumvention, governments both in the United States and abroad continue to charge ahead. Some states mandate that adult sites confirm the ages of users with ID checks or via third-party “age-verification” services. In some cases, big companies have blocked access in some countries rather than take personal data from millions of users, though mainstream sites such as video platforms have introduced more sweeping age checks to meet local laws.
Overseas, regulators with wide-ranging online safety laws have indicated that age assurance will be a key enforcement lever. This global push is likely to expand ID checks from explicit material into general-purpose forums, raising broader questions about privacy, data retention, and cross-border compliance.
What Experts Say Might Work Better to Protect Youth
Researchers and child-safety advocates are increasingly promoting layered strategies that don’t rely on mass ID collection. Options include privacy-preserving age estimation (e.g., cryptographic checks which can prove someone is over a certain age without needing to know their specific birthday), and device- and account-level settings, as well as default-on safe search settings for those under 18 or expanded digital literacy education.
Independent audits of third-party verifiers and strict data minimization rules—retention followed by purging after verification—could also narrow the privacy risk if verification is deployed. Importantly, experts say whether policies remain on the books should be guided by measuring outcomes—actual changes in youth exposure, and not just a compliance checkbox.
The bottom line from the Phoenix Center: If age verification is easily evaded, then maybe we should determine whether there are constitutional and cybersecurity costs outweighing its—dubious—benefits. Until lawmakers can prove actual decreases in youth access, the study implies, these stopgap measures are more symbolic than effective—and could be driving users, young and old, to less safe corners of the internet.
