Most Adult Sites Skip US Age Checks, Study Finds; Yoti Disputes Data-Sharing Claims

Most adult websites covered by US age-verification laws do not check visitors' ages at all, according to a study by researchers at Georgia Tech and the University of California, Irvine, presented at the IEEE Symposium on Security and Privacy in San Francisco on May 20, 2026.

The paper, "Papers, Please: A First Look at Age Verification on the Web," is by Shreyas Minocha, Isaac Sheridan, Harry Oppenheimer, Paul Pearce and Michael A. Specter. Since 2022, 25 US states covering more than 40% of Americans have passed laws requiring sites with content deemed harmful to minors to verify users' ages.

The team crawled the top one million websites as seen from Texas, Georgia and New York in August 2025, looking for 30 known third-party age-verification services. They found those services on more than 1,500 sites in each of Georgia and Texas. Among sites that label themselves as adult, only 13.7% in Georgia and 14.8% in Texas used age verification. The authors call their figures a lower bound, because checks hidden behind logins are invisible to a crawler.

More than 500 sites used age checks when visited from New York, which has no such law. Most appeared to be covered by laws in other states.

The most widely used service was Yoti, a London-based company whose clients include Meta, OnlyFans, Sony PlayStation and TikTok. It appeared on more than 60% of covered sites, ahead of VerifyMyAge and Incode.

The researchers reverse-engineered Yoti's web checks. Depending on the method, a check may send a user's IP address and operating system and browser details, which the authors say can be enough to identify and track a device. Some of that data may go to credit card companies and IP geolocation services, and ID information may go to a data broker or another verification service. They also found that Yoti's card-based check told the payment processor Stripe which website the user was visiting. Yoti told the researchers it had fixed that issue; the authors say they have not confirmed the change.

Georgia Tech's May 19 article about the study said Yoti shared facial photos with third parties. Yoti's chief executive, Robin Tombs, called that "wholly false" in an open letter on May 22. He said facial images are processed only inside Yoti's systems to estimate age and deleted immediately afterwards, and invited an independent expert chosen by the universities to examine its platform.

On June 19, the universities removed the claim. Georgia Tech's article now carries a note saying an earlier version "posted in error" included statements "that were not part of the researchers' findings or intent." The other findings above are those in the updated article and the researchers' own summary.

The authors want regulators to set privacy standards for age-verification companies, require them to publish every company that receives users' data, and keep data collection to a minimum. They point to digital driver's licences that can prove age without revealing other details as a more private option.

This article was updated on Oct. 15, 2026. The earlier version said Yoti shares users' facial images with third parties, a claim the universities withdrew in June, and used an unrelated image. It now reports the study's published findings and Yoti's response, and lists its sources.