Age verification obligations for providers | IT-Medienrecht

Erfahren Sie, welche Pflichten Anbieter zur Age verification im Internet haben. Schützen Sie sich vor Risiken durch Jugendschutzgesetze in DE & EU.

Age Verification on the Internet: Obligations for Providers in Germany and Europe

Age verification (AV) is a technical process. It is used by online platforms to ensure that only adults have access to content deemed harmful to minors. Legislation often mandates protective measures to shield children and young people from content like pornography, excessive violence, gambling, or other material approved for 18+.

In practice, this usually involves verifying the age of majority. This can be done by uploading an ID, providing credit card details, using a face scan, or similar procedures. The goal is to create a closed user group, often labeled "Adults Only," accessible solely to verified adults.

At first glance, these requirements appear sensible. Children should indeed be protected from unsuitable content. However, critics argue that page-based AV solutions can be easily circumvented and pose significant data protection risks. Parental control software or age checks on individual websites can often be bypassed by switching to uncontrolled sites, proxy servers, or VPN connections.

Furthermore, many users are unwilling to disclose sensitive personal data, such as an ID card scan, online just to access free content. This often results in a drastic drop in user numbers on regulated sites. Nevertheless, an increasing number of countries and providers are adopting AV systems to comply with legal requirements and enhance the protection of minors online. In the following, we examine the legal situation in Germany, planned EU regulations, and the affected provider sectors.

In Germany, stringent youth protection regulations are enshrined in both the Youth Protection Act (JuSchG) and the Interstate Treaty on the Protection of Minors in the Media (JMStV). While pornography is legal for adults, it is prohibited for minors. Consequently, pornography may only be distributed online within closed user groups where access by children and young people is effectively prevented.

Section 4 JMStV stipulates that "pornographic, indexed content and content that is obviously harmful to minors" may only be accessible online if the provider implements effective age verification. Practically, this means websites with 18+ content must utilize a recognized age verification system (AVS) before users can access the actual content.

What Content is Covered by This Age Verification Obligation?

Beyond hardcore pornography, this obligation extends to various types of content:

Beyond Pornography: Other 18+ Content Subject to Age Verification

The age verification obligation is not limited to pornography. Other content classified as 18+, ranging from violent media to gambling, is also subject to youth protection requirements:

Recognized Age Verification Systems and Implementation in Germany

The German media regulator does not prescribe a particular system. However, any AV system must meet specific criteria. The KJM has developed a test catalog, known as the "AVS grid," to assess systems through a positive evaluation procedure.

For a long time, traditional solutions like Post-Ident, ID upload, or credit card verification were common. These methods were often cumbersome for users and presented data protection concerns. Today, more innovative and KJM-recognized approaches are available:

The KJM maintains a publicly available list of positively assessed AV systems, which is continuously updated. Providers can refer to these recognized solutions for guidance. It is crucial for companies to understand that self-developed solutions without a test seal are risky. In case of doubt, courts will only recognize systems that align with the current state of the art and the KJM grid.

Enforcement and Current Cases in Germany

For a considerable period, many large porn sites operating from abroad remained accessible in Germany without effective age verification, despite German legal requirements. However, since 2020, German regulators have consistently pursued such infringements. The State Media Authority of North Rhine-Westphalia and the KJM have initiated multiple proceedings against pornographic platforms based abroad that were freely accessible and lacked age verification.

The initial complaints were issued in 2020. When the operators failed to respond, a blocking order followed in 2021: the KJM mandated the blocking of a major porn site's access from Germany. Dr. Tobias Schmid (Medienanstalt NRW) unequivocally stated, "Anyone who wants to earn money with pornography on the German market must comply with German laws."

In September 2022, the Higher Administrative Court (OVG) of North Rhine-Westphalia affirmed the lawfulness of these measures. The court rejected the complaints from several porn platforms (based in Cyprus), stating clearly that these portals may not be accessible in Germany without prior age verification. The operators' argument that the German supervisory authority lacked jurisdiction over them was dismissed. The OVG emphasized that strict German youth media protection law applies to foreign providers if their content is accessible in Germany. Age verification systems are mandatory, and providers must "immediately" implement appropriate protective measures.

This court decision sends a clear message to the industry: there are no more excuses for 18+ offerings without an AVS in Germany. Media regulators have announced their intention to target other comparable websites. If necessary, access providers or host providers may also be obligated to block illegal content. For German companies, this means that any entity offering relevant content or operating platforms where users can share such content must ensure the protection of minors through AV technology. Failure to do so risks prohibition orders, fines, and reputational damage. This also highlights the liability of platform operators for illegal user content.

EU-Wide Developments in Age Verification

As the internet transcends national borders, the EU faces the challenge of establishing uniform solutions for the protection of minors. To date, the 27 member states have been permitted to set their own AV rules, leading to an inconsistent landscape. Germany stands as a pioneer with highly strict regulations, while some other countries are only now implementing legislative updates. The EU Commission is actively working on a harmonized age verification solution to consolidate these diverse approaches.

EU Digital Strategy: Age Verification via Wallet and DSA

The EU Commission is pursuing an initiative for an EU-wide, standardized, data-protection-friendly, and interoperable AV solution. The core idea is that citizens will, in the future, be able to anonymously prove their age of majority without needing to upload personal data repeatedly. Integration into the upcoming EU digital identity (eID wallet), anticipated by the end of 2026, is planned. As an interim measure, a pilot project launched in 2023/2024. The Commission tasked T-Systems/Scytáles with providing a temporary AV app by summer 2025.

This "white label" app will be usable by member states and services and later integrate seamlessly with the eID wallet. In essence, within a few years, a user might only need a central age confirmation stored on their smartphone. This could then be presented with a single click on any website, eliminating the need to upload IDs on each individual site.

Concurrently, the EU legislator is applying indirect pressure. The Digital Services Act (DSA), fully in force since 2024, obliges online platforms to "take measures to protect minors." Very large online platforms (VLOPs), in particular, must minimize risks for minors. In May 2025, the EU Commission initiated official proceedings against several major porn sites (Pornhub, Xvideos, Stripchat, etc.) due to suspected DSA violations, specifically regarding their accessibility of pornographic content to minors. As VLOPs, these providers are mandated by the DSA to use "filters and age verification tools" to protect minors. Brussels is thus employing competition and platform law to enforce minor protection, even though the DSA itself is not a classic minor protection law. The affected porn platforms were first classified as VLOPs in spring 2025 and have since been under special supervision.

It is noteworthy that the EU Commission urges member states to adopt a uniform approach. Commissioner Thierry Breton warned France against proceeding with national AV systems independently, encouraging them to await the EU solution. Simultaneously, action is already being taken against porn sites at the EU level before the EU's own wallet solution is ready. This has drawn criticism, suggesting political pressure is being exerted on certain platforms to pave the way for future EU services, such as the eID wallet.

National Age Verification Initiatives in Europe

While the comprehensive EU solution is still under development, several EU states have issued or announced their own AV regulations. These developments also impact German providers operating internationally:

France

Until recently, a simple "Click, I'm 18" button served as an age check in France, which was clearly inadequate. Since 2023, the French regulatory authority ARCOM has been advocating for stronger age verification. In October 2024, ARCOM published new guidelines. These provisions include AI-supported facial age estimation and improved compatibility with parental control software. Websites that previously accepted only credit card data as proof of age must adopt these new guidelines by April 2025. France is also taking action against foreign porn sites. Several large portals were blocked by French courts in 2023/24 for failing to implement sufficient age controls. While there was a temporary conflict with EU requirements, leading an administrative court to suspend a blocking order due to uncertainties regarding EU law, the overall direction is clear: France also demands genuine AV systems and will impose blocks for non-compliance if necessary.

Spain

Spain is currently testing a digital proof of age app called Cartera Digital. This app works with citizens' national ID data. In the future, users will be able to confirm their 18+ age to access porn sites. Initially, this will apply only to websites operated within Spain, but the aim is to include foreign platforms with 18+ content in the future.

Italy

With the "Caivano Decree," Italy will introduce an obligation from 2025 for users to prove their age via SPID, the Italian digital identity system. This will apply when visiting pornographic and gambling-related websites. Italy is thus linking minor protection to its existing eID system and making its use mandatory for adults to identify themselves.

Ireland

A draft bill, the Protection of Children (Online Age Verification) Bill 2024, is currently being discussed in the Irish parliament. This legislation would require websites with "content unsuitable for children" to request proof of age from users, with the exact documents to be specified by law. Therefore, an AV obligation for adult content is also anticipated here.

Similar trends are observable outside the EU. In the USA, over a dozen states, including Louisiana, Texas, and Utah, have passed laws mandating porn sites to verify age via ID. The US Supreme Court recently upheld such a law in Texas as constitutional. As a consequence, some large providers, like Pornhub, are completely blocking access in these states rather than collecting user ID data. Pornhub has voluntarily ceased operations in 17 US states and reported an 80% drop in usage figures in others, such as Louisiana, because the ID hurdle deters many users.

The United Kingdom is also following suit. The new Online Safety Act will require "robust" age checks on porn sites starting in summer 2025, and major portals have already committed to implementing this. For German providers with an international reach, this means keeping a close watch on national regulations. For example, if you operate a German adult website accessible in France or Texas, you must either comply with the local age verification rules or implement geoblocking for those regions. The regulatory landscape is not yet uniform, but the global trend towards increased regulation and age control on the internet is clear.

Challenges and Criticism of Age Verification Systems

The growing legal obligations translate into significant technical and organizational efforts for providers. Moreover, there are fundamental concerns associated with the concept of age verification itself:

Effectiveness

Many experts doubt that individual website age checks will genuinely resolve the issue. Empirical data from the USA indicates that users in AV-regulated regions simply shift to websites without age checks or exploit technical loopholes. As long as not all sites globally comply, pornography for minors will continue to be "available everywhere" online, albeit through less reputable channels. Large porn portals argue that this policy creates a false sense of security. They contend that AV gates only push children away from known, moderated sites and towards unregulated pirate sites, file-sharing services, or the darknet, potentially increasing dangers.

Distortion of Competition

The obligation often impacts only a few major providers, while thousands of smaller websites remain unaffected. In Germany, for instance, primarily the most well-known tube sites were warned, leaving the rest of the web difficult to regulate. Large portals complain they are being made "scapegoats" while vast amounts of similar content circulate freely on social media or from abroad. This distorts competition and endangers established, legally operating companies that lose users, while "clones" and illegal offerings benefit.

Data Protection and IT Security

Age verification almost invariably involves data collection, be it an ID document, facial recognition, or linking to an identity database. Users must disclose highly sensitive personal data simply to consume legal content. Operators, in turn, bear the responsibility of securely storing this data. Hacker attacks on such verification databases would be devastating. Industry representatives caution that it is "only a matter of time before user data is hacked and leaked." Data leaks are already common on major platforms; a centralized AV solution could become an attractive target for data misuse. Critics view these privacy risks as disproportionate to the intended goal.

User Acceptance

Past experience demonstrates that 90% or more of users abandon a site if an ID upload or similar is suddenly required. Many adults perceive it as an imposition or a "small humiliation" to have to identify themselves before consuming legal content. This leads to losses for providers, including less traffic and reduced revenue, and generally fosters resentment about "paternalism" online. This debate echoes previous moral panics, such as those surrounding violent videos or "killer games," where it retrospectively became clear that bans and hurdles were often excessive. Different values clash here: protection of young people versus the freedom of adults and data protection.

Alternative Approaches to Age Verification

Given these challenges, some experts and companies advocate for alternative approaches. One suggestion is to embed minor protection more firmly at the device or network level, rather than on each individual website. For instance, parents could be obligated or instructed to install parental control apps or filters on their children's devices. Modern operating systems already offer family filters that function centrally for all apps and browsers; they simply need to be used more consistently.

Tech companies like Meta (Instagram) and Pornhub's parent company Aylo propose shifting age verification to devices or app stores. For example, a smartphone could verify the user's age during setup through a one-off ID check. Subsequently, it could automatically inform websites that the user is of legal age, eliminating the need for each site to collect data independently. Such systemic solutions would be more convenient for users and would genuinely cover all sites, rather than singling out individual "scapegoats."

However, this requires cooperation from major tech companies like Apple and Google and also carries its own data protection implications. To date, device manufacturers have been hesitant to assume such a role. Nevertheless, the EU debate regarding a standardized wallet suggests that progress is being made.

Conclusion: Recommendations for Providers

For German online providers in the media and entertainment sector, the topic of age verification on the internet is more relevant than ever in 2025. The legal requirements are clear: pornographic and other content harmful to minors may only be made available online to adults. Any operator of such content must immediately integrate recognized AV systems.

German supervisory authorities are now vigorously pursuing violations, even issuing court orders to block content. Ignoring these mandates is no longer an option; proactive compliance can prevent significant issues.

Practically, companies should consider the following:

Outlook: The regulation of adult content on the internet continues to evolve. Germany has already set high standards, which are gradually being adopted by other countries through national laws or the EU Digital Services Act. Concurrently, the EU age verification wallet is emerging as a potentially more user-friendly, data-protection-compliant solution. Companies should closely monitor these developments.

In the long term, a standardized European AV infrastructure could simplify implementation and provide clarity. Until then, investing in systems that comply with current youth protection laws is advisable to avoid future regulatory challenges. A robust age verification concept is not only mandatory but can also serve as a quality hallmark, signaling responsibility. Despite some justified criticism of mandatory ID checks and similar measures, the trend towards "adults only" access on the internet is likely to persist, and providers in Germany are well-advised to adapt to this reality.