The headline seems misleading. "Pornhub blocked in Texas" suggests Texas did the blocking, a better headline would be "Pornhub blocks users with Texas IPs"
Edit: No they do not.
Few things are truly impossible or 100% correct. There's not much value in arguing such extremes.
Not saying you’re wrong (I certainly don’t have any data to the contrary), but this isn’t intuitive to me. Don’t tons of people send their credit card (which is linked to their SSN) to PornHub? From there seems like a small step to also send ID?
Most Pornhub users aren’t paying ones, or even logged in at all. It’s all there publicly, unless you want to leave a comment or whatnot.
The only major form of photo ID is a state/driver's license and passports and I think only 30% of the US has Passorts. It's such a big country that you can reasonably never require it and still travel more than the average EU citizen.
You can also fill out a form with your employer to get a photo form of employee authorization, but you're Sol of you're freelance/gig economy.
It requires a system where the user:
(1) provide digital identification; or (2) comply with a commercial age verification system that verifies age using: (A) government-issued identification; or (B) a commercially reasonable method that relies on public or private transactional data to verify the age of an individual.
Unclear to me what the transactional data means, and if a charging a credit card would suffice, but it does not require 2 forms of photo ID.
DPI? DNS? etc
[0]: https://datatracker.ietf.org/doc/draft-ietf-tls-esni/
[1]: https://www.rfc-editor.org/rfc/rfc9001.html#name-security-of...
Even so, I don't think many ISPs have the capability to do the DPI for observing SNI on a moments notice.
>Pornhub Disables Website in Texas Over Age-Verification Law
So, mission accomplished?
What exactly are those requirements, and how is there "no way" for Pornhub to satisfy what "the legislation demands"?
I ask because I'm tired of seeing (in general, not just PornHub) deceptive rephrasing of "we don't want to" as "it's impossible for us to." Companies too often take the attitude that they're entitled to their business model or being able to push externalities onto others, but that's obnoxious BS propaganda.
Edit: So according to the OP, the law "requires [PornHub] to verify the age of all visitors using a government-issued ID or 'public or private transactional data.'" I'm pretty sure they've already implemented that to verify the identify of performers (https://help.pornhub.com/hc/en-us/articles/19159382668435-Tr...), after much kicking and screaming, in the wake of that Nicholas Kristof article a few years ago. So a pretty straightforward implementation would be to require user accounts to view (at least for Texas), push users through PornHub's existing age verification flow, then give them access.
It's perfectly valid for PH to say "we don't believe the requirements of the law are reasonable so we're choosing to not do business in Texas rather than comply" - but that's a very different conversation than "the requirements the law imposes on us/other adult websites are impossible to satisfy from a technical perspective".
Somebody posted their message to users from Texas.
https://news.ycombinator.com/item?id=39708615
I know you are just talking in general, but in this specific case, it doesn’t appear that they actually say they can’t do it. The idea that they can’t do it just seems to be a misunderstanding from somebody posting on this site.
I agree in general that it is annoying that companies say they “can’t” do something, mixing up “incompatible with my business mode” and “incompatible with reality.” But I don’t see anything like that in their comment.
WRT reusing their implementation for the actors, I’m not sure, is that possible? The actors upload videos of themselves so it ought to be easy to verify the fact that the face on the ID matches the face in the video, right?
In the case of a user, somebody could easily steal their parent’s ID or use a computer that someone else had left logged in, right? I mean, I don’t know how any of that works, but I could see why the site would rather not risk it.
I mean, this is a site full of webdevs, would anyone here want to take a chance at implementing something like this in-house, before best methods have been discovered? I suspect most people would rather wait for a lawsuit-tested turnkey solution. So, “can’t” in this context could mean something like: we aren’t aware of an existing solution that fits inside our legal risk tolerance. That’s still a business objection rather than a laws-of-physics one, but it seems a lot more reasonable.
After that they manually compare the ID and photo.
But I can imagine there is going to be a market for verified accounts if access is given this way, and they can't do this process on every login. Plus it will require logins to access content in general, while I think most PH visitors never log in.
Set up controls, if anyone bypasses them, you have expensive litigation and potentially existential financial penalties.
Or don't and lose the revenue of Texas folks.
Interested parties will go out of their way to bypass any rules PornHub does set up, and PornHub bears the brunt of any successful such attempts.
If you did your honest reasonable best, a suit shouldn't go anywhere. Systems aren't perfect. They aren't really expected to be either.
Given the way the porn industry historically operates by addicting the young and the huge levels of abuse towards women. I'm not holding my breath for good faith efforts.
That's not true.
It's onerous, inconvenient, whatever.
FWIW I've no idea how expensive commercial age verification is. I'm just wondering why none of the commenters seem to consider the aspect of cost, and picked a random commenter to ask.
In this case, gambling sites, which perform age (and residency) verification.
Now I read it as some people treating Pornhub as obviously similar to the gambling sites and others obviously different, basing their different viewpoints on the different foundations, and not stating those foundations because they're obvious.
FWIW I can see how login-required porn sites are similar to gambling sites. I'm open on whether mostly-without-login sites are.
1) IP address from "Restricted Region" connects to website.
2) Server attempts a reverse IP lookup and waits for reply from ISP's DNS.
3) If DNS reply contains "restricted" (on behalf of the subscriber), server has to restrict access, etc.
All they have to do is use AnyCast and geoip to block most users from a specific region.
If you really need Pornhub in Texas, a VPN cloud VM is your courier.