Three years after Louisiana required porn sites to verify every visitor's age, the state has become an unlikely outlier: Pornhub still operates there, even as it has walked away from Texas, Arkansas, Mississippi, and North Carolina. The law that started it all, and the identity-verification system built to enforce it, now face fresh scrutiny after a September 2026 data breach at a Louisiana ID-scanning company exposed names and license numbers collected during such checks.
A Law Built on Two Acts
Louisiana's verification regime rests on legislation authored by state Rep. Laurie Schlegel. Act 440, effective January 1, 2023, requires any commercial site where more than a third of the content is harmful to minors to confirm a visitor's age through a digital ID like LA Wallet, a commercial verification service tied to a government-issued ID, or another method based on transaction data. The statute also bars sites and verification vendors from retaining identifying information once access is granted, and it allows private lawsuits if a minor gets through. Act 216, which took effect in August 2023, added state enforcement: the attorney general must give a noncompliant site 30 days' notice before seeking fines of up to $5,000 per day, an additional $10,000 for knowing violations, and recovery of the state's legal costs. Adults who watch porn face no penalty under either law; the obligations fall entirely on the platforms.
Why Pornhub Stayed When Others Left
Aylo, Pornhub's parent company, chose to block access entirely in Texas, Arkansas, Mississippi, and North Carolina rather than build age checks there. Louisiana was different, largely because of LA Wallet, the state's digital driver's license app, which lets a site confirm someone is over 18 without the site itself handling the underlying ID. Louisiana visitors to Pornhub, YouPorn, RedTube, and Tube8 now encounter a prompt from AllPassTrust, Aylo's own verification service, before any video loads. Aylo maintains that most of its Louisiana traffic vanished once the law took hold, as users migrated to sites with no verification at all. In a 2026 letter to state officials, the company called the approach "performative, ineffective and unenforceable" and asked lawmakers to reconsider. Attorney General Liz Murrill rejected that request and said the state intends to pursue "even more accountability."
What Verification Actually Collects
Not all verification methods are equal in what they retain. LA Wallet's Remote Verify feature, built by the Baton Rouge firm Envoc for the Office of Motor Vehicles, is designed to send sites only a yes-or-no confirmation of age, without revealing which site made the request, according to the company. That claim has not been independently audited. The system also only works for Louisiana license or ID holders, leaving visitors from other states to rely on alternatives. Those alternatives, including AllPassTrust and third-party ID scanners, generally collect more: AllPassTrust keeps account data, including IP addresses, for three years after a user's last login. The September breach at IDScan.net, a Louisiana-based ID-scanning company, demonstrated the risk directly, exposing names and license numbers gathered during age checks.
A Practical Alternative: Changing Location
Because age-verification laws apply based on a visitor's detected location, a virtual private network offers a straightforward workaround. A VPN routes traffic through a server in another state, replacing the user's Louisiana IP address with one from a jurisdiction that has no such law, New York being a common choice. The connection is also encrypted, meaning the sites visited no longer appear in an internet provider's logs. Server choice matters: Texas, Arkansas, and Mississippi have their own restrictions, so nearby servers in those states won't help. Independent testing found that services such as NordVPN, ExpressVPN, and Proton VPN all maintained streaming-quality speeds on New York servers, with latency low enough for smooth HD and 4K playback. Using a VPN for this purpose is legal in Louisiana; the state's statutes place every compliance obligation on the websites, not on the people who visit them. A federal court has separately paused a 2026 Utah rule that would have treated in-state VPN users as Utah residents for enforcement purposes, underscoring how contested these jurisdictional questions remain nationally.
What Comes Next
Louisiana's experiment has become the template more than half the country has since adopted, yet it has also exposed the central tension in age-verification policy: protecting minors without turning every adult visitor into a data point for a verification company. The IDScan.net breach is unlikely to be the last reminder of that trade-off. For now, Louisiana residents who want to avoid submitting identifying information to a third party are left choosing between LA Wallet's narrower, state-specific guarantee of privacy and the broader anonymity a VPN provides.