Since October 1st, 2024, visitors to Pornhub and several other major adult websites in Alabama have been met not with content but with blank error pages. The cause is a new state law, HB 164, which requires adult platforms to verify every user's age through government-issued identification before granting access. Rather than comply, some of the largest names in the industry chose to withdraw from the state entirely.
What the law actually requires
HB 164 obliges adult websites to confirm that visitors are over eighteen by collecting identifying documents, and to retain that verification data for a minimum of five years. The stated goal is protecting minors from explicit material, and the law also mandates public health warnings on adult sites about pornography's supposed effects on brain development and mental well-being. Critics counter that forcing millions of adults to upload driver's licenses or facial scans to access legal content creates a honeypot of sensitive data, one that is only as secure as the weakest link among verification vendors and state systems. Five years of stored identity documents is a long window for a breach to occur.
Why platforms responded differently
The reaction among adult sites has not been uniform. Pornhub, RedTube, YouPorn, Tube8, and Brazzers blocked Alabama traffic outright rather than build compliance infrastructure, a pattern consistent with their response to similar laws in Texas and Florida. Chaturbate took a different path, offering users a choice between face scanning, ID scanning, or verification through a third-party identity app. Stripchat blurs content for anyone who declines to verify. Meanwhile xVideos and XNXX have so far imposed no restrictions at all, an inconsistency that illustrates how unevenly these laws are being enforced across an industry with no single regulatory body overseeing compliance.
Pornhub's own position is that device-based or anonymous age-assurance methods would achieve the same child-protection goal without requiring anyone to surrender a government ID to a website or its contractors. That argument has not changed the law, but it has shaped the company's strategy of withdrawing service rather than participating in a verification system it considers a privacy liability.
How a VPN addresses the problem
A virtual private network works by routing a device's internet traffic through an encrypted tunnel to a server in another location, masking the user's real IP address and, with it, their apparent state or country. For an Alabama resident, connecting to a server outside the state is generally enough to access adult sites as though HB 164 did not apply, since the websites determine jurisdiction largely through IP geolocation.
- Encryption prevents internet service providers from seeing which sites a user visits
- IP masking removes the location signal that triggers age-verification prompts
- No personal documents are exchanged with the website or any third-party verifier
- The same encryption also protects data on unsecured networks, such as public Wi-Fi
Using a VPN for this purpose is legal. Alabama's statute regulates the websites, not the individuals browsing them, and VPNs remain a widely used, lawful tool for privacy and security well beyond this specific use case. The caveat is choosing the service carefully: free VPNs often monetize usage by logging and selling browsing data, which defeats the purpose entirely. A reputable provider with an independently audited no-logs policy and modern encryption standards is the baseline for anyone actually trying to protect their privacy rather than merely bypass a block.
The broader stakes
Alabama is not an isolated case. A growing number of states have passed or proposed similar age-verification statutes, and the pattern of major platforms blocking access rather than complying suggests this tension between child-safety regulation and adult privacy rights is far from resolved. Each new law adds another repository of identity documents tied to intimate browsing habits, and each repository is a potential target. Until legislators and platforms settle on verification methods that don't require handing over a driver's license to a website, the practical choice for most adults will remain between going without access or routing around the block entirely.