Pornhub Fires Back: Is the Age Verification Warning a Cybersecurity Crisis or a Smokescreen?

So, Pornhub just got a little more official — now making its users jump through hoops like email addresses, credit cards, or yes, even mobile numbers just to prove they’re old enough to view, thanks to the UK’s new Online Safety Act. Sounds like a pretty straightforward plan to keep the minors out, right? Well, not quite. A cybersecurity whiz, Jacob Kalvo, threw a wrench in the gears, warning us that while protecting kids is crucial, these age checks might be opening the door to a creepy new era of mass surveillance and data breaches. Imagine your private info accidentally moonlighting on the dark web – not exactly the kind of exposure anyone signed up for. Pornhub claims they picked the “least invasive” route, but the questions linger: how safe is “safe enough”? And can we safeguard our privacy without turning the internet into Big Brother’s playground? It’s a tangled mess of tech, ethics, and a dash of digital paranoia — and honestly, it makes you wonder if you’ll ever truly get to browse freely again, without a digital ID parade. LEARN MORE

Pornhub has responded after a cybersecurity expert issued a stark warning over the introduction of new age verification laws.

Websites, including Pornhub, that host adult content are now subject to legislation enforcing them to implement age checks to block under 18s from accessing pornographic and otherwise inappropriate content.

But while the Online Safety Act was brought in as a safety measure for minors in the UK, a cybersecurity expert warns we’re setting a ‘dangerous precedent’ for ‘mass surveillance’.

Jacob Kalvo, CEO and co-founder of Live Proxies, says that ‘while the goal of protecting minors is absolutely justified, the technical and ethical implications of these methods are quite serious.’

Since the Online Safety Act came into effect at the start of July, Pornhub users now have to create an account and provide an email address, or share credit or debit card details for age verification purposes. Users also have to option to verify via a mobile number.

Pornhub followed age verification rules recommended by Ofcom (Pornhub)

While some websites are now requiring users to upload ID such as passports or diving licences, as well as going through facial recognition technology, Pornhub chose the ‘least invasive measures offered’ by Ofcom; something which Jacob considers a wise decision when it comes to securing personal data.

“From a cybersecurity standpoint, requiring users to upload highly sensitive documents like a driver’s license or passport introduces a major attack surface. If these platforms don’t use end-to-end encryption, zero-trust architecture, and strong data minimisation practices, they become lucrative targets for hackers,” he told LADbible.

“We’ve already seen how poorly protected data in similar contexts, such as health or location tracking apps, can be breached and leaked on the dark web. If adult sites are hacked and ID details are stolen, the consequences for users would be catastrophic, ranging from blackmail to public shame.”

A cybersecurity expert has raised a number of concerns (Getty Stock Images)

When approached by LADbible, a representative for Pornhub agreed that age verification ‘presents security challenges,’ adding that ‘the best way to mitigate both these risks and safety concerns is to require age verification at the device level’.

“We have implemented age verification solutions that are recommended by Ofcom, and we have chosen the least invasive measures offered,” they said. “If you have questions about the security of the Ofcom-recommended solutions, you should please ask Ofcom.”

When we approached Ofcom to raise our concerns over the data security of their age verification recommendations, we were told to speak to the Information Commissioners Office (ICO).

An expert warned the consequences of a data leak could be catastrophic (Nikolas Kokovlis/NurPhoto via Getty Images)

“Strong age checks can be done effectively, safely, and in a way that protects your privacy. Data protection in the UK is regulated and enforced by the ICO, with whom we have worked closely in developing our approach to highly effective age assurance,” Ofcom said in a statement.

The ICO did not respond for comment.

Meanwhile, Jacob is calling on governments that are introducing legislation to enforce age checks to do so responsibly, urging them to consider ‘privacy-first technologies like zero-knowledge proofs, by which users can demonstrate that they are over 18 without releasing identifiable information.’

He said: “If we don’t change course, we risk creating a digital world in which mass surveillance becomes the new normal for the protection of children. That’s a dangerous precedent.

“The security community must be involved in the design of these systems, or else the negative impact of poor implementation will negate the positive effects.”