The usual way is to use a geolocation database. They link IP to physical location. These are constantly updated, but often not perfectly reliable. I was often geolocated to other cities when I lived in Saskatchewan, so useful for blocking people from Saskatchewan, but not very accurate overall.
I just checked, and here most of the publicly queryable databases show my IP location is within a 3-20 drive of where I actually am. It would work for blocking a large political division like a state or province, though there would most likely be people who aren’t blocked who should be and vice versa.
OK, so one of the channels on Pr0n Hub was called “Mormon Boys” where handsome elders in their 40s or 50s would “initiate” a younger man. It would start out looking like a genuine ritual, but then the clothes would come off and… well… you know.
(Don’t judge me!)
Anyway, sometime in the past year or so the channel was renamed “Missionary Boys” but had the same content.
My guess is that rebranding wasn’t enough so the Utah legislature banned the whole website.
Weiler likened the policy of requiring age verification to access adult sites to requiring cashiers to check IDs before alcohol and tobacco sales, saying, “I don’t think that is too much to ask.”
There’s your problem right there! In that case, the ID is being used as something you have, matching the photo on it with something you are.
Online, the ID is merely something you know, and anyone with a photo of the ID can pass.
There’s also the minor difference that keeping an ID check genuinely ephemeral on the internet is easier said than done, more or less impossible to verify; and can potentially turn out to have not been done properly even years after the fact.
Todd Weiler may not be aware that there’s a material difference between flashing a card at a bored cashier who will probably forget it pretty quickly and has no particularly good means of making a permanent record of you having presented it without you noticing and creating a potentially permanent entry in the definitely-won’t-leak “people who look at porn” database that exists somewhere on the internet managed by some entity with some objectives and some security standards; but that’s because he’s unqualified; not because it’s not a concern.
(edit: just to clarify; in principle there are probably all sorts of architecturally clever ways of proving age(or at least proving a state assertion regarding age) to an untrusted party both without disclosing anything beyond the fact that you possess a proof of age to the untrusted party and without informing the state that pornhub is the untrusted party who is interested in your age today; there may even be existing proposals from competent cryptographers; though I’m not familiar with them myself, non-horrible authentication mechanisms have thankfully gotten over just oversharing shared secrets and calling it good; but they don’t generally try to conceal the identities of idPs or relying parties from one another; but that’s very, very, different from supposing that either what Mindgeek decides to throw together or what Utah Republicans decide to mandate possesses these properties; and that’s not really a ‘benefit of the doubt’ kind of situation’.)
When the idea floats on t’other side of the pond I think they suggest delegating the age verification to visa/mastercard. Yes, it’s as messed up as its sounds - no purchase happens but you give your full bank card details to (possibly a shady) site and visa/mastercard goes “yep, have verified this person is old”.
I think the card processors are the biggest hurdle there - they don’t want this work, and they don’t want to do it for free.
Too bad John Oliver didn’t get wind of this before PornHub blocked Utah. He could have tried to do something similar to what he did in Washington DC to see how many computers associated with the Utah government accessed the site.
