For years "are you 18?" was a button nobody meant. That era is ending. A growing list of markets now require real age verification to serve adult content, with meaningful penalties for getting it wrong, and the trend is only moving one way. You do not have to like it, but if you operate commercially you have to plan for it. This is an operator's overview, not legal advice - get that from a lawyer who knows your markets.

What's actually changing

The shift is from self-declaration to verification: proving a visitor is an adult, not just asking them to claim it. The details vary by jurisdiction - some mandate specific methods, some set standards and leave the method to you, some target platforms above a size threshold - but the common thread is that a plain age gate no longer satisfies the law where these rules apply. Enforcement is landing on the businesses that can be reached, which in practice means operators with payments, a company, or traffic concentrated in a regulated market.

The main approaches

Most compliant setups fall into a few buckets. Third-party verification vendors check a document, a credit signal, or a biometric estimate and return a pass or fail without handing you the underlying data - the appeal is that you avoid storing sensitive identity documents yourself. Device or account-level signals push the check up the stack, to an app store or operating system, so the site sees an already-verified user. Re-using an existing verified identity, where a trusted provider vouches for the user across sites, is the model a lot of the industry is betting on because it spreads the friction. Each trades off cost, conversion and privacy differently, and the right mix depends on where your traffic is.

How to prepare

Treat it as an architecture decision, not a patch. Know where your traffic actually comes from, because your obligations follow your audience's location, not yours. Pick verification you can turn on per-region rather than globally, so a rule in one market does not tank conversion everywhere else. Minimise what you store - the safest identity data is the data you never hold. And budget for the conversion hit honestly; verification adds friction, and the operators who survive it are the ones who measured it instead of hoping.

The community is the fastest place to learn which vendors actually integrate cleanly and how a given market is enforcing in practice - the people already doing it will save you a month of reading statutes.