Louisiana was the first US state to force porn sites to verify every visitor's age, a move that took effect on January 1, 2023, and has since been copied by more than half the country. But nearly four years on, the state's experiment looks less like a model and more like a cautionary tale. Pornhub still operates there, unlike in several neighboring states, and a September 2026 data breach at a Louisiana ID-scanning firm has sharpened concerns about what happens to the identifying information these checks require.
A Law Built on Two Acts
Louisiana's framework comes from legislation written by state Rep. Laurie Schlegel. Act 440, effective January 2023, requires any commercial site where more than a third of the content is harmful to minors to verify age through a digital ID like LA Wallet, a commercial system that checks a government-issued ID, or another method based on transaction data. The same law bars sites from retaining identifying information once access is granted and allows civil suits if a minor gets through. Act 216, which followed in 2023, added state enforcement, letting the attorney general fine noncompliant sites up to $5,000 per day, with an additional $10,000 for knowing violations. Importantly, neither law criminalizes adults for watching pornography; all obligations and penalties fall on the websites.
Why Pornhub Stayed When Others Left
Aylo, Pornhub's parent company, chose to block access entirely in Texas, Arkansas, Mississippi, and North Carolina rather than comply with those states' verification laws. Louisiana was different because LA Wallet lets a site confirm a visitor's age without collecting the ID itself, a distinction Aylo says made compliance workable. Even so, the company reports that most of its Louisiana traffic vanished once the checks began, with users migrating to sites that skip verification altogether. In a 2026 letter to state officials, Pornhub called the law "performative, ineffective and unenforceable" and urged a rethink. Attorney General Liz Murrill rejected that request, saying Louisiana intends to "pursue even more accountability" rather than ease the rules.
What Verification Actually Collects
LA Wallet's design is narrower than most alternatives. A user enters a code shown by the site, approves the request in the app, and the site reportedly receives only a yes-or-no confirmation of age, with no record of which site made the request. Envoc, the Baton Rouge developer behind the app, has made these claims, though no independent audit has verified them. The catch is that LA Wallet only works with a Louisiana license, leaving visitors and newer residents to rely on commercial alternatives like AllPassTrust, which passes checks to third-party verification companies and retains account data, including IP addresses, for three years. The September 2026 breach at IDScan.net, which exposed names and license numbers, illustrates the risk inherent in that retention model: even well-intentioned systems create data that can be stolen.
The Jurisdiction Workaround
Because these laws apply based on a visitor's detected location, a virtual private network offers a straightforward way to avoid the check without breaking any law. A VPN encrypts traffic and substitutes the user's IP address with one from a server in another jurisdiction, such as New York, which has no age-verification statute. There is nothing illegal about this in Louisiana; the law places every compliance burden on websites, not visitors. The approach does, however, highlight a structural weakness in state-by-state verification regimes: they can be sidestepped by a widely available consumer tool, raising questions about how much they actually protect minors versus how much they shift risk and friction onto adults who value their privacy.
What Comes Next
Louisiana's law has become the template for a wave of similar statutes nationwide, yet the state's own experience - persistent access to major platforms, a breach involving collected identity data, and public friction with Pornhub's parent company - suggests the policy's practical effects remain unsettled. Courts are already testing related questions elsewhere, including a federal suspension of Utah's 2026 rule treating VPN users as in-state visitors. How that litigation unfolds will likely shape whether age-verification laws evolve toward stronger privacy safeguards or face broader legal challenges over enforceability and reach.
