Age verification on the Internet: Obligations for providers in Germany and Europe

Age verification (AV) is a technical process used by online platforms to ensure that only adults have access to content that is harmful to minors. Legislation requires protective measures to keep children and young people away from content containing pornography, excessive violence, gambling or other content approved for 18+. In practice, this usually means verifying the age of majority by uploading ID, credit card details, face scan or similar procedures. The aim is to create a closed user group (“Adults Only”) that is only accessible to verified adults.

At first glance, these requirements sound sensible – children should be protected from unsuitable content. However, critics complain that page-based AV solutions can be easily circumvented and pose enormous data protection risks. Parental control software or an age check on individual websites can often be circumvented by switching to non-controlled sites, proxy servers or VPN connections. In addition, many users are not prepared to disclose sensitive personal data (such as an ID card scan) online just to access free content – the result is sometimes a drastic drop in user numbers on regulated sites. Nevertheless, more and more countries and providers are turning to AV systems in order to comply with legal requirements and better protect minors online. In the following, we take a look at the legal situation in Germany, planned EU regulations and the provider sectors affected.

Legal situation in Germany: Youth Protection Act and JMStV

In Germany, strict youth protection regulations apply both in the Youth Protection Act (JuSchG) and in the Interstate Treaty on the Protection of Minors in the Media (JMStV). Pornography is legal for adults, but prohibited for minors. Accordingly, pornography may only be distributed on the Internet in closed user groups in which it is ensured that children and young people do not have access. § Section 4 JMStV stipulates that “pornographic, indexed content and content that is obviously harmful to minors” may only be accessible online if the provider provides effective age verification. In practice, this means that Websites with 18+ content must use a recognized age verification system (AVS) before users are given access to the actual content.

What content is covered by this AV obligation? In addition to hardcore pornography, these include, for example

• Pornographic content (both images/videos and pornographic literature). These are considered “harmful to minors” by law and may only be made accessible to adults. A simple “Click me, I’m 18” banner is not enough – a technical age check is required.
• Certain indexed content: Media that has been indexed by the BPjM (Federal Review Board) – for example due to gruesome violence, glorification of racism or extremism – may also only be accessible to adults. Here too, an AVS is required if such content is made available online.
• “Obviously harmful to minors” content: This refers to content that is so drastic that its suitability for endangering minors is obvious – e.g. extreme violence videos or particular perversions – even if it is not (yet) indexed. Such content must also lie behind an age barrier.

It is therefore not only pornography that falls under the AV obligation. Other 18+ content – from violent media to gambling – is also subject to youth protection requirements:

• Gambling platforms: Online casinos, sports betting etc. require a license in Germany in accordance with the State Treaty on Gambling. Part of the license requirements is proof of age upon registration. Here, the identity of each user is usually checked (e.g. by uploading an ID card or a credit check) before money can be played for. Age verification is therefore an integral part of legal gambling offers.
• Online stores for alcoholic beverages, tobacco, “18” media: In accordance with the JuSchG, mail order companies selling alcohol and tobacco products must ensure that persons of legal age are checked when ordering and receiving goods. Many stores therefore use age verification modules (e.g. comparison with ID upon delivery or digital ID checks before purchase). The same applies to the online purchase of films/games without a youth rating (“FSK/USK 18”) – these may also only be purchased by adults, which is implemented through technical verification steps and age verification upon delivery.
• Social networks and platforms with user-generated content: There is (still) no explicit statutory AV obligation for all content here. However, according to the NetzDG and the new Youth Protection Act, large platforms must minimize risks for minors. The Commission for the Protection of Minors in the Media (KJM) is already encouraging social media providers to use age verification technologies – for example, to make “areas with content from the age of 18” only accessible to adults. In fact, Instagram tested an AI-based facial age estimator (Yoti) in the USA in 2022 to verify the age of users. Erotic platforms such as OnlyFans already require extensive proof of age (via several identification documents) for content creators and consumers, although there is no legal obligation to do so (yet). This serves to protect minors and the providers’ own risk management.

Recognized AV systems and implementation in Germany

The German media regulator does not prescribe a specific system, but the AV system must meet certain criteria. The KJM has developed a test catalog (“AVS grid”) for this purpose and assesses systems in a positive evaluation procedure. For a long time, the classic solutions were Post-Ident, ID upload or credit card verification, but these are cumbersome for users and sensitive in terms of data protection. There are now more innovative approaches that have been recognized by the KJM:

• Biometric age verification via AI: In 2022, the KJM positively assessed three systems for the first time that do not require ID documents but instead estimate age, e.g. via facial scanning. Machine learning is used to determine the approximate age from a selfie image. Dr. Marc Jan Eumann (KJM Chairman) emphasized that this is “real progress” because “obviously not everyone likes to hold their ID card up to the camera ” – AI-supported age recognition is a lower-threshold alternative here. Such AI systems (e.g. Yoti Age Scan or Ageware AI) are now available.
• Database and account verification: Some AVS use existing data sources as proof of age – such as verification via bank account/online banking (e.g. GiroIdent youth protection checks the bank account to ensure that the user is of legal age) or mobile phone providers (via Schufa age data for cell phone cards). The use of the new ID card with online function (eID) has also been integrated into systems such as IDnow eID.
• Step-by-step identity verification: Other services offer modular solutions, such as AI age estimation first and, if this is uncertain, optionally requesting ID (combined procedure). The aim is to allow as many adult users as possible to pass through without disclosing data, while younger users are checked separately.

The list of AV systems that have been positively assessed by the KJM is publicly available and is constantly being expanded. Providers can use these recognized solutions as a guide. Important for companies: Home-made solutions without a test seal are risky – in case of doubt, courts only recognize what corresponds to the state of the art and the KJM grid.

Enforcement and current cases in Germany

For a long time, many large porn sites operating from abroad remained accessible without effective AV despite the German legal situation. Since 2020, however, German regulators have been taking consistent action against such infringements. The State Media Authority of North Rhine-Westphalia and the KJM have conducted several proceedings against pornographic platforms based abroad that were freely accessible and without age verification.

The first complaints were issued as early as 2020; when the operators failed to respond, a blocking order followed in 2021: the KJM ordered a large porn site to be blocked from access from Germany. Dr. Tobias Schmid (Medienanstalt NRW) made it clear: “Anyone who wants to earn money with pornography on the German market must comply with German laws”.

In September 2022, the Higher Administrative Court (OVG) of North Rhine-Westphalia finally confirmed that the measures were lawful. The court rejected the complaints of several porn platforms (based in Cyprus) and stated unequivocally that the portals may not be accessible in Germany without an upstream age check. In particular, the operators argued in vain that the German supervisory authority was not responsible for them – however, the OVG emphasized that the strict German youth media protection law also applies to foreign providers if their content can be accessed in Germany. Age verification systems are mandatory and providers must “immediately” implement appropriate protective measures.

This court decision sends a clear signal to the industry: No more excuses for 18+ offers without AVS in Germany. The media regulators have announced that they will be targeting other comparable websites. In case of doubt, access providers or host providers will also be obliged to block illegal content if necessary. For German companies, this means Anyone offering relevant content (or operating platforms on which users can share such content) must ensure the protection of minors through AV technology – otherwise there is a risk of prohibition orders, fines and damage to their image.

EU-wide developments: What are Germany and the EU planning?

As the internet knows no borders, the EU is also faced with the challenge of finding uniform solutions for the protection of minors. To date, the 27 member states have been allowed to set their own AV rules – the picture is correspondingly inconsistent. Germany is one of the pioneers with very strict regulations, while some other countries are only now implementing legal upgrades. The EU Commission is currently working on a harmonized age verification solution to bring together the different approaches.

EU digital strategy: age verification via wallet and DSA

The EU Commission is pursuing an initiative for an EU-wide standardized, data protection-friendly and interoperable AV solution. The core idea is that citizens will be able to prove their age of majority anonymously in future without having to upload personal data everywhere. Integration into the upcoming EU digital identity (eID wallet) is planned, which should be available by the end of 2026. A pilot project was launched in 2023/2024 as an interim solution: The Commission has commissioned T-Systems/Scytáles to provide a temporary AV app by summer 2025. This “white label” app will be able to be used by member states and services and will later work seamlessly with the eID wallet. In short, in a few years’ time, it could be enough for a user to have a central age confirmation stored on their smartphone, which they can then show with a click on every website – instead of uploading ID cards on each individual page.

At the same time, the EU legislator is indirectly creating pressure: the Digital Services Act (DSA), which has been in full force since 2024, obliges online platforms to take “measures to protect minors”. Very large platforms (VLOPs) in particular must minimize risks for minors. In May 2025, the EU Commission initiated official proceedings against several large porn sites (Pornhub, Xvideos, Stripchat, etc.) for suspected DSA violations – specifically because they make pornographic content accessible to minors. As VLOPs, these providers are required by the DSA to use “filters and age verification tools” to protect minors. Brussels is thus using competition and platform law to enforce the protection of minors, even though the DSA itself is not a classic law for the protection of minors. The porn platforms concerned were first classified as VLOPs in spring 2025 and have been under special supervision ever since.

It is interesting to note that the EU Commission is urging member states to take a uniform approach: the Commissioner responsible, Thierry Breton, has warned France not to push ahead with national AV systems on its own, but to wait for the EU solution. At the same time, however, action is already being taken against porn sites at EU level before the EU’s own wallet solution is ready. This has led to criticism that political pressure is being exerted on unwelcome platforms in order to pave the way for future EU services (such as the eID wallet).

National initiatives in Europe

While the overall EU solution is still in the works, several EU states have issued or announced their own AV regulations – which also affects German providers abroad:

• France: Until recently, a simple “Click, I’m 18” button was sufficient as an age check, which is obviously insufficient. Since 2023, the French regulatory authority ARCOM has been pushing for stronger age checks. In October 2024, ARCOM published new guidelines that provide for AI-supported facial age estimation and improved compatibility with parental control software. Websites that previously only allowed credit card data as proof of age must switch to the new guidelines by April 2025. France is also taking action against foreign porn sites: Several large portals were blocked by the courts in France in 2023/24 because they had not implemented sufficient age controls. (In the meantime, there was a conflict with EU requirements – an administrative court temporarily suspended a blocking order due to uncertainties regarding EU law. Nevertheless, the direction of travel is clear: France also requires genuine AV systems and will use blocks against non-compliance if necessary).
• Spain: Spain is currently testing a digital proof of age app (Cartera Digital) that works with citizens’ national ID data. In future, users will be able to confirm their 18+ age in order to gain access to porn sites. Initially, this will only apply to websites operated in Spain, but the aim is to include foreign platforms with 18+ content in the future.
• Italy: With the so-called “Caivano Decree”, Italy will introduce an obligation from 2025 for users to prove their age via SPID (the Italian digital identity system) when visiting pornographic and gambling-related websites. Italy is therefore linking the protection of minors to the existing eID system and making it mandatory for adults to use it to identify themselves.
• Ireland: A draft bill(Protection of Children (Online Age Verification) Bill 2024) is being discussed in the Irish parliament. This would require websites with “content unsuitable for children” to request proof of age from users (the exact documents would be specified by law). An AV obligation for adult content is therefore also on the cards here.

Similar trends can be seen outside the EU. In the USA, over a dozen states (e.g. Louisiana, Texas, Utah) have now passed laws requiring porn sites to verify age by means of an ID. This was recently approved by the US Supreme Court, which ruled that such a law in Texas was constitutional. As a result, some large providers such as Pornhub are completely blocking access in these states instead of collecting ID data from users. Pornhub has voluntarily shut down in 17 US states and recorded an 80% drop in usage figures in others (such as Louisiana) because the ID hurdle deters many users. The United Kingdom is also following suit: The new Online Safety Act will require “robust” age checks on porn sites from summer 2025, and the major portals have already pledged to implement this.

For German providers with an international reach, this means that you have to keep an eye on the respective national regulations. For example, if you operate a German adult website that can also be accessed in France or Texas, you have the choice of either complying with the age verification rules there or blocking access from these regions. The puzzle is not (yet) uniform – but the general direction worldwide is clear: regulation and age control on the internet are on the rise.

Challenges and criticism of age verification systems

The increasing legal obligations mean considerable technical and organizational effort for providers. In addition, there are fundamental concerns associated with the concept of age verification:

• Effectiveness: Many experts doubt that individual website age checks will actually solve the problem. Empirical data from the USA shows that users in AV-regulated regions simply switch to websites without age checks or use technical loopholes. As long as not all sites worldwide follow suit, pornography for minors will continue to be “available everywhere” online, just in less reputable ways. Large porn portals argue that the policy is celebrating a false sense of security: AV gates would only push children away from the well-known, moderated sites and instead lure them onto unregulated pirate sites, file-sharing services or the darknet. This could even increase the dangers.
• Distortion of competition: The obligation often only affects a few large providers, while thousands of smaller websites remain unscathed. In Germany, for example, it was primarily the best-known tube sites that were warned – the rest of the web remains difficult to control. Large portals complain that they are being turned into “scapegoats”, while vast amounts of similar content continue to circulate freely on social media or abroad. This distorts competition and endangers established, legally operating companies, which are now losing users while “clones” and illegal offerings benefit.
• Data protection and IT security: Age verification almost always means data collection – be it an ID document, facial recognition or linking to an identity database. Users have to disclose highly sensitive personal data just to watch a video, for example. Operators, in turn, are faced with the responsibility of storing this data securely. Hacker attacks on such verification databases would be devastating. Industry representatives warn that it is “only a matter of time before user data is hacked and leaked”. Leaks are already a regular occurrence on major platforms – a centralized AV solution could become an attractive target for data misuse. These privacy risks are seen by critics as disproportionate to the goal.
• User acceptance: Experience to date has shown that 90% or more of users drop out if an ID upload or similar is suddenly required. Many adults find it an imposition or a “small humiliation” to have to identify themselves before consuming legal content. This leads to losses for providers (less traffic, less revenue) and generally generates resentment about “paternalism” online. The debate is reminiscent of earlier moral panics – such as violent videos or killer games – where it became clear in retrospect that bans and hurdles were often excessive. Different values clash here (protection of young people versus the freedom of adults and data protection).

Alternative proposals: In view of these problems, some experts and companies are advocating other approaches. One suggestion is to anchor the protection of minors more firmly at device or network level instead of on each individual website. For example, parents could be obliged or instructed to install parental control apps or filters on their children’s devices. Modern operating systems already offer family filters that work centrally for all apps and browsers – they just need to be used more consistently. Tech companies such as Meta (Instagram) and Pornhub’s parent company Aylo suggest moving age verification to the devices or app stores. For example, a smartphone could verify the user’s age when it is set up (through a one-off ID check) and then automatically inform websites that the user is of legal age – without each site having to collect data itself. Such systemic solutions would be more convenient for the user and would really cover all sites instead of singling out individual “scapegoats”. However, this requires cooperation from the big tech companies (Apple, Google, etc.) and also has data protection implications. Until now, device manufacturers have been reluctant to take on such a role. However, the EU debate about a standardized wallet shows that things are moving forward.

Conclusion: What should providers do now?

For German online providers in the media and entertainment sector, the topic of age verification is more relevant than ever in 2025. The legal requirements are clear: pornographic and other content harmful to minors may only be made available online to adults. Anyone operating such content must immediately integrate recognized AV systems. The German supervisory authorities are now pursuing violations with vigor, even issuing court orders to block content. Ignoring it is therefore not an option – on the contrary, proactive compliance can prevent major trouble.

Practically, companies should:

• Check whether their content or services are subject to AV (keyword: pornography, 18+ offers, indexed media, etc.). If necessary, involve youth protection officers and lawyers to ensure a proper classification.
• If so, implement a suitable age verification system. It is worth taking a look at the KJM database of positively rated systems – from AI age scans to eID solutions, there are a variety of approaches that can be combined depending on the user clientele. It is important that the system corresponds to the current state of the art and reliably only allows adults to pass through.
• Uphold data protection and data minimization in the AV process. User trust is crucial – solutions that work anonymously or without permanent data storage are ideal (e.g. age confirmation via eID, where no personal data is transferred to the content provider). If ID data is collected, it must be stored securely and protected against unauthorized access.
• User communication: It is advisable to explain transparently why an age check is carried out (“protection of minors in accordance with the law”) and what data is used in the process. A good UI/UX can reduce the abandonment rate – e.g. by offering several options (passport or driving license or credit card, etc.) and ensuring that no further data is collected.
• Monitor country access: German providers with international reach should monitor in which countries new AV laws apply in order to react in good time. It may be necessary to set up geoblocking for certain regions or integrate local solutions (e.g. check French users via the FranceConnect ID, British users via Ofcom’s AV program, etc.). A transitional phase with a patchwork of rules is looming here until EU standardization.

Outlook: The regulation of adult content on the internet remains in flux. Germany has already established high standards, which are now gradually finding their way into other countries – whether through national laws or the EU Digital Services Act. At the same time, the EU age verification wallet is a potentially more user-friendly, data protection-compliant solution in the starting blocks. Companies should follow these developments closely. In the long term, a standardized European AV infrastructure could facilitate implementation and create clarity. Until then, it is better to invest in systems that comply with youth protection laws now than to be caught out by the authorities later. A solid age verification concept is not only mandatory, but can also serve as a quality feature that signals a sense of responsibility. Despite some justified criticism of compulsory ID cards and the like, the trend towards “adults only” access on the Internet is likely to continue – providers in Germany are well advised to adapt to this.

Author: Marian Härtel

Marian Härtel ist Rechtsanwalt und Fachanwalt für IT-Recht mit einer über 25-jährigen Erfahrung als Unternehmer und Berater in den Bereichen Games, E-Sport, Blockchain, SaaS und Künstliche Intelligenz. Seine Beratungsschwerpunkte umfassen neben dem IT-Recht insbesondere das Urheberrecht, Medienrecht sowie Wettbewerbsrecht. Er betreut schwerpunktmäßig Start-ups, Agenturen und Influencer, die er in strategischen Fragen, komplexen Vertragsangelegenheiten sowie bei Investitionsprojekten begleitet. Dabei zeichnet sich seine Beratung durch einen interdisziplinären Ansatz aus, der juristische Expertise und langjährige unternehmerische Erfahrung miteinander verbindet. Ziel seiner Tätigkeit ist stets, Mandanten praxisorientierte Lösungen anzubieten und rechtlich fundierte Unterstützung bei der Umsetzung innovativer Geschäftsmodelle zu gewährleisten.