Age Verification LawsHow it works
Is age verification safe?
It depends on who runs the check and what they keep. Many laws bar the site and its verifier from keeping your identifying information after the check.1, 2, 3 Copies can still end up elsewhere, as in 2025, when ID photos sent to a support vendor for age appeals were exposed.4
Checked 29 October 2026 against the sources.
What the laws say about your data
These are legal duties on the company. They tell you what a company may keep, not how a given verifier actually stores data.
| Law | What it says |
|---|---|
| Texas HB 1181 | The site, or a third party checking ages for it, may not retain any identifying information. The Attorney General can sue for $10,000 per instance.1 |
| Arizona, Laws 2025 ch. 193 | No retaining identifying information, and no passing it to any federal, state or local government. The person whose information was kept or passed on can sue.2 |
| Nebraska, statute 87-1003 | No retaining identifying information after access has been granted.3 |
| Montana, SB 544 (2023) | No retaining identifying information after access has been granted. A site that knowingly keeps it is liable to the person for damages.5 |
| Ohio, Revised Code 1349.10 | Delete age check information immediately after the check. For accounts, billing and login data may stay, but must be deleted on request and after two years unless the account is renewed.6 |
| New York, SAFE for Kids rules | Offer at least one method other than a government ID. Use age data only for that purpose, and delete or de-identify it right after use. The Attorney General can seek up to $5,000 per violation.7 |
| Alabama, app store law | Collect only what is needed for the age check, consent and compliance records, and send it encrypted. The Attorney General can seek up to $7,500 per violation.8 |
| California AB 1043 | The operating system sends apps only an age range, the minimum needed, and may not share it for other purposes. The Attorney General can seek up to $2,500 per affected child, or $7,500 if intentional.9 |
| France, Arcom standard | Porn sites must offer at least one "double anonymity" option, which limits what the site and the age provider each learn. Arcom can issue a formal notice, then a fine.10, 11 |
| United Kingdom, data protection law | Collect only what is necessary, keep it no longer than needed, and have a policy that sets retention periods. The ICO enforces it.12 |
Where copies can still end up
Outside the check itself
In October 2025 Discord said about 70,000 users may have had government ID photos exposed. The photos were held by a third-party customer service vendor, which used them to review age-related appeals. Discord said its own systems were not breached.4
The retention bans above cover the check the law requires. An appeal sent through a support ticket can be a separate copy.
Checks no age law requires
Some checks come from a service's own minimum age rather than an age check law. In the UK, the ICO says companies that limit their service to people over a minimum age need effective checks, and in May 2026 it said none of six large platforms it wrote to had yet introduced new, privacy friendly ones.13
Before you upload an ID
Three questions to answer from the service's own pages.
- Who runs the check?
The site itself, or a named verifier. The verifier's privacy notice is the one that says what is kept and for how long. Under UK data protection law, a company should have a set retention period.12
- Is there an option without ID?
New York will require one, and France requires a double anonymity option for porn sites.7, 10
- How do appeals work?
If a failed check means sending an ID to a support ticket, that copy may be kept under different rules.4
Questions people ask
Does age verification store your face or photo?
Is age verification safe in the UK?
UK data protection law applies to every check: companies must collect only what they need and keep it no longer than necessary. The ICO says its opinion on age assurance is under review after the Data (Use and Access) Act.12
Sources 13
- HB 1181, 88th Legislature, enrolled text, Texas Legislature Online. Read 29 October 2026.
- Laws 2025, Chapter 193 (HB 2112), Arizona Legislature. Read 29 October 2026.
- Nebraska Revised Statutes 87-1003 (Laws 2024, LB1092), Nebraska Legislature. Read 29 October 2026 from the Internet Archive copy of 15 June 2026.
- Update on a security incident involving third-party customer service, 3 October 2025, updated 9 October 2025, Discord. Read 29 October 2026.
- SB 544 (2023), Session Laws chapter 700, Montana Legislature. Read 29 October 2026 from the Internet Archive copy of 21 December 2024.
- Ohio Revised Code section 1349.10 (effective 30 September 2025), Ohio Legislative Service Commission. Read 29 October 2026 from the Internet Archive copy of 13 July 2026.
- Attorney General James and Governor Hochul release final SAFE for Kids Act rules, 28 July 2026, New York Attorney General. Read 29 October 2026.
- HB 161, enrolled, 2026 Regular Session, Alabama Legislature. Read 29 October 2026.
- AB 1043, Digital Age Assurance Act, Chapter 675, Statutes of 2025, California Legislative Information. Read 29 October 2026 from the Internet Archive copy of 5 October 2026.
- Référentiel technique sur la vérification de l'âge pour la protection des mineurs contre la pornographie en ligne (PDF), Arcom. Read 29 October 2026.
- Référentiel technique sur la vérification de l'âge, presentation page, 11 October 2024, Arcom. Read 29 October 2026.
- Age assurance for the Children's code, part 6: expectations for age assurance and data protection compliance, Information Commissioner's Office. Read 29 October 2026.
- ICO statement on age assurance, 21 May 2026, Information Commissioner's Office. Read 29 October 2026.
Every fact here comes from the law, the regulator or the company, checked again and dated. How we check