An age verification law that nobody has ever used is now the centrepiece of an argument to repeal it. On 30 July 2026 Aylo, the company behind Pornhub, wrote to Virginia governor Abigail Spanberger and to lawmakers in 29 other states, asking them to replace age verification statutes with policies that produce measurable improvements in child safety rather than legislation that grabs headlines. Its central evidence is that Virginia's 2023 law has produced zero lawsuits by parents.
What the letter claims
Virginia's statute works through private enforcement: it gives parents the right to sue sites that fail to verify age. Aylo says a scrape of state court records shows that mechanism has never been triggered since the law took effect. Alongside that, the company presents its own audit of the market it operates in:
- Of 57 adult sites checked via a popular ranking site, only 4 asked for age verification.
- 65 percent of the sites checked were, in the company's description, wide open.
- In Texas, 9 of the top 10 results for "free porn" had no age check at all.
Spanberger's office declined to comment on the letter.
The structural problem the numbers point at
Strip away who is making the argument and a real design flaw remains. These laws bind the operators who are identifiable, reachable and lawyered, which in practice means the large platforms. The sites that ignore them are, by definition, the ones least likely to respond to a state statute in the first place. Compliance therefore concentrates exactly where enforcement was already least needed, and the rest of the market carries on.
Aylo's own response to that asymmetry has been to withdraw rather than comply, blocking access in a growing list of states instead of building ID checks. The result is that in those states the largest operator with the most to lose is gone, and the traffic redistributes to sites with no compliance obligations they feel bound by.
Where the traffic actually goes
The second half of the redistribution is the one this site has tracked for years. Virginia saw a spike in VPN searches before its law took effect, and the same spike has appeared in every jurisdiction that has tried this. It happened when the UK introduced checks on adult sites, where traffic moved to VPNs almost immediately, and it happened again when Missouri brought in age verification and demand for VPNs jumped.
This is the part legislators consistently underestimate. An age check applied at the border of a jurisdiction is a check on the location your connection appears to originate from, and that is the single easiest attribute for an ordinary user to change. The law does not fail because people are technically sophisticated; it fails because the workaround is a two-minute app install.
The clause that changes the fight
Some states have noticed. Utah passed a provision that treats a user connecting from Utah through a VPN as being in Utah regardless, which would oblige an operator to account for concealed local users rather than simply geoblocking the state. Aylo has sued, arguing the requirement is impossible to satisfy without verifying the age of every user everywhere, and that a state rule with that reach is a de facto global mandate.
Whatever happens to that specific case, the direction is set: once regulators accept that geographic rules are trivially bypassed, the next move is to write rules that reach through the bypass. That is why Utah's VPN clause matters well beyond adult sites, and why the UK has already consulted on pulling VPNs into its own age assurance regime. The tools people reach for when access is restricted become the next thing to be regulated.
For users the practical consequence is narrow but real. Age verification is spreading, and the same infrastructure that routes around it is increasingly named in the statutes themselves. If your access depends on where your traffic appears to come from, the reliability of tools that keep working under filtering stops being a convenience question and becomes the whole question.
