Age Verification Laws by Country: The 2026 Global Map

In 2022 you could count the jurisdictions requiring proof of age to open a website on one hand. In August 2026 the list spans four continents and grows every few weeks. Brazil requires a check on every access. The UK made it a licensing condition. Australia banned under-16s from social media outright. Twenty-seven US states each wrote their own version. Hungary told internet providers to filter the traffic before it reaches the household.

Two things happened this year that were not true twelve months ago. The EU’s highest court ruled that a member state may impose its own age checks on a site established elsewhere in the bloc, removing the defence most European operators relied on. And the European Commission opened proceedings against the four largest pornography platforms for doing nothing more than asking users to click a button. This page is the map that resulted: every jurisdiction with a live requirement, a passed law waiting to commence, or a bill in progress, what each demands, whether a VPN resolves it, and a link to our guide where we have one.

The map, jurisdiction by jurisdiction

Scope matters as much as status. A law aimed at pornography and one aimed at social media accounts are enforced in completely different places, and only one of them tends to respond to a change of IP address. Read those two columns together.

Seven more countries have an active policy process but no statute in force. They get a section of their own below, because two have already decided not to do what everyone assumed they would.

What changed in 2026: three cross-cutting facts

For most of the past decade a European site facing a national age-verification demand could answer with three words: country of origin. Article 3(2) of the e-Commerce Directive bars a member state from restricting a service established in another member state, and the principle held well enough that operators registered in Cyprus or the Czech Republic largely ignored French and German orders. Three developments this year undid that from three directions.

⚖️ The Court of Justice, 16 June 2026. The Grand Chamber ruled in joined cases C-188/24 and C-190/24. The applicants were WebGroup Czech Republic a.s. and NKL Associates s.r.o., the Czech operators of XVideos and XNXX; the respondent was the French government. The Court held that the French measures fall inside the coordinated field of the e-Commerce Directive and do restrict the freedom to provide services under Article 3(2) — but that France may derogate from country of origin under Article 3(4)(a), provided the measures are necessary, individualised and proportionate.

The reasoning is what travels. Pornographic sites count as video-sharing platforms, and the Audiovisual Media Services Directive expressly names age verification as an appropriate measure for pornography. Where a provider has adopted no appropriate measure of its own — and these operators relied on nothing but a button reading “I am 18” — a national requirement is proportionate. That reaches well past France: it bears on Italy’s administrative suspension for EU-established sites, on the German annulments handed down before this judgment existed, on the Polish bill and the Austrian plan. Country of origin is still a rule; it is no longer a shield.

📜 The Commission’s preliminary findings, 26 March 2026. Three months before the judgment, the Commission reached preliminary findings that Pornhub, Stripchat, XNXX and XVideos had failed to protect minors, because none applied any check beyond a self-declaration click. Be precise about what that is: a procedural step in a DSA proceeding, not a decision and not a penalty. The companies have the right of defence, and only if the findings are confirmed does a fine become possible, capped at 6% of global annual turnover. The sequencing is the interesting part — administrative pressure arrived three months before judicial clarity, not after it.

The designation history is often garbled, so for the record: Pornhub, Stripchat and XVideos became very large online platforms in December 2023; XNXX followed on 10 July 2024 after itself reporting that it had crossed the 45 million monthly user threshold; and Stripchat’s designation was terminated on 27 May 2025 once it had stayed below the threshold for a year. Designation is a function of size, not a sanction, and it can be reversed.

📱 The EU’s own app, and the 31 December 2026 date. The third strand is infrastructure rather than enforcement. On 15 April 2026 the Commission published a feature-ready version of its age-verification blueprint app, and on 29 April adopted a Recommendation asking member states to make a reliable solution available by 31 December 2026. Denmark, France, Greece, Italy and Spain are the pilot member states customising it, either inside a national wallet or as a standalone app; later reporting adds Cyprus and Ireland, which we could not confirm from the Commission’s own factpage. Identity is checked once at issuance, the proof carries only the fact that the holder is over 18, and proofs are issued in batches for single use so transactions cannot be linked.

For a VPN user this is the model that matters most, because it moves the check off the network entirely. If your country ships a wallet and a platform accepts the token, changing your exit IP does not help — you simply will not have a token.

The UK: the deepest coverage we have

The Online Safety Act made the UK the first large market where age assurance became a licensing condition rather than a niche rule for adult sites. Ofcom can fine up to £18 million or 10% of global turnover, and business disruption measures let it ask a court to order UK internet providers to block a non-compliant service outright. More than ninety investigations are open. Its guidance treats open banking, photo ID matching, facial age estimation, mobile operator checks, credit card checks and digital identity services as capable of being highly effective; self-declaration is explicitly ruled out.

📋 The enforcement file so far. Three cases show the range.

• 4chan was fined £520,000 in total: £450,000 on the age assurance side, £50,000 over its risk assessment and £20,000 over its terms of service. It has refused to pay, argues the First Amendment protects it, replied to Ofcom through its lawyer with a photograph of a hamster, and has been accruing daily penalties since 2 April 2026.
• Kick Online Entertainment S.A. was fined £800,000 plus a further £30,000, covering 34 adult sites including motherless.com with more than nine million monthly UK visitors. This is not kick.com, the streaming platform — different company, similar name, routinely confused in coverage.
• Fenix International, which operates OnlyFans, was fined £1.05 million on 27 March 2025 after telling Ofcom its facial estimation challenge age was 23 when it had in fact been set to 20.

📊 What the first year produced. In July 2026 the government rejected calls to restrict VPNs, which is the outcome most coverage assumed would go the other way. Ofcom’s six-month review counted more than 69 million age checks across 32 services, a twenty-three-fold increase, and found VPN use among children lower than the headlines implied, with privacy the most commonly cited reason. A petition to repeal the Act gathered more than 450,000 signatures and was rejected. On traffic, Pornhub and XVideos each lost roughly 47% of their UK visitors and xHamster about 39%.

Start with what the Online Safety Act actually says, then the general UK bypass guide covering 37 sites. If the question is whether the government is going after the tools themselves, we cover that in is the UK banning VPNs?

💬 Social and mainstream platforms

X · Reddit · Discord · Bluesky · Instagram · Threads · Twitch · Kick · 4chan · Spotify · Tinder · Hinge · Bumble · Feeld · Grindr

🔞 Adult platforms

Pornhub · OnlyFans · xHamster · XNXX · XVideos · YouPorn · RedTube · Tube8 · ePorner · Erome · Fansly · Fanvue

📹 Live cam platforms

Chaturbate · Stripchat · BongaCams · LiveJasmin · CamSoda · Cam4 · Streamate · Jerkmate · FrolicMe · MyDirtyHobby

Europe’s quieter half: the countries with no law

The Nordics are usually reported as a bloc moving in step towards a social media age limit. They are not, and two of the three have moved away from it.

🇩🇰 Denmark has no statute. A November 2025 political agreement set 15 with parental consent from 13, and the incoming government hardened it in summer 2026 to a flat 15 with no exemption — but the Folketing has passed neither version. The plumbing is ahead of the law: MitID has handled age checks on age-restricted product sales since 1 October 2024, and AltID launched on 3 June 2026 with an aldersbevis function. The Digital Services Coordinator is the Danish Agency for Digital Government, and Denmark is one of the five EU app pilot countries.

🇳🇴 Norway has no law either, and its bill was cut back rather than strengthened. The 2025 draft proposed a 15-year limit, platform obligations and penalties. After criticism on EEA grounds, the notification filed on 7 May 2026 struck out the age-control requirement, dropped the sanctions, moved the obligation off service providers, narrowed the scope to social media considered harmful, and left the supervisory authority able to do little more than publish guidance. The age is 16, applied by an unusual rule: it bites from 1 January of the year the child turns 16. Entry into force is 2027 at the earliest. Two footnotes matter. The DSA is not yet in force in Norway, because incorporation into the EEA agreement has been delayed. And on 19 May 2026 the Storting rejected a verifiable 18 limit for pornography, in Innst. 321 S — one stated reason being that technical barriers can be circumvented with a VPN.

🇸🇪 Sweden is still at inquiry stage. Terms of reference dir. 2025:91 were issued on 9 October 2025 with Lisa Englund Krafft as inquiry chair, and the interim report of 12 June 2026, SOU 2026:35, proposes 15. It carries a carve-out that undercuts most of the effect: content reachable without logging in falls outside scope, so YouTube and TikTok watched without an account stay open. Final report 14 November 2026. Pornography age verification is not in the remit at all.

🇫🇮 Finland began preparatory work on 6 February 2026, coordinated by the Ministry of Social Affairs and Health, with 15 under discussion; Traficom is the Digital Services Coordinator. 🇨🇭 Switzerland has the JSFVG partly in force since 1 January 2025, expects its e-ID at the end of 2026, and does not bring effective age-check provisions in until 2028.

🇳🇱 The Netherlands is the most useful outlier here. The coalition agreement named 15, but on 5 June 2026 the cabinet came out against a national age limit. The same cabinet has also stated its opposition to an EU-level VPN ban — a rare thing to be able to quote, a sitting European government defending the tool rather than treating it as a loophole. 🇪🇪 Estonia goes further and opposes age-based bans on principle.

Four models, not one

Calling all of this “age verification” hides how differently the laws work, and the difference decides whether a VPN is any use. With a year of enforcement data the categories have sharpened.

• 🔒 Licence condition. The UK and Ireland. Age assurance is a condition of operating and the regulator issues the penalty. Enforcement follows the connection, so a VPN resolves it.
• 📡 Network-level blocking. Hungary in practice, Poland in draft, Germany in part. The state hands internet providers a list and cuts the route to the user rather than acting against the site. Hungary is the only new network-level regime in Europe actually running: mobile operators since 1 January 2026, fixed-line providers above 10,000 subscriptions since 1 May 2026, smaller ones from 1 January 2027. A VPN resolves this too, because the block sits on the local path.
• 🎒 Real identity. Malaysia and Brazil. Verification runs against a government credential — MyKad or MyDigital ID in Malaysia, the CPF-linked stack in Brazil — the exact opposite of Europe’s privacy-preserving token approach. A VPN gets you to the signup screen and no further, because the gate is a document, not an address.
• 👤 Account age limit. Australia, Denmark, Norway, Sweden, Greece and Turkiye. The target is social media rather than pornography, and the question is who may hold an account rather than who may load a page. A VPN helps at signup and does nothing for an account that already exists.

A fifth thing is not a model but keeps happening, and it is the most underreported part of the story. France’s under-15 ban cleared the National Assembly on 21 July 2026 and was annulled by the Conseil constitutionnel on 14 August, on the ground that Article 1 was an interference with freedom of expression that was neither suitable, nor necessary, nor proportionate. The Council accepted that the objectives could justify some restriction, and the President has asked for a legally robust revised bill targeted at spring 2027. Norway’s regime was hollowed out before it ever reached a vote. Passage and effect are not the same event.

Where it goes next

Turkiye’s Law No. 7578, amending Law 5651, was published in the Official Gazette on 1 May 2026, and the provisions setting 15 as the floor for social media and games commence around 1 November 2026. The enforcement ladder there is unlike anything else on this map: the BTK can first ban advertising, and then throttle a non-compliant platform’s bandwidth by 50%. Not a fine, not a block — a deliberate degradation of the service until it complies.

After that the Commission’s Recommendation asks member states for a working solution by 31 December 2026. Greece’s Kids Wallet takes full effect on 1 January 2027, Austria’s Social-Media-Gesetz commences in January 2027 with a transition to 1 April and KommAustria supervising, and Hungary’s smallest internet providers come into scope on 1 January 2027. Sweden’s inquiry reports on 14 November 2026, and New Zealand’s bill, introduced on 24 August 2026, begins committee stage.

One correction to carry away: what was struck down in France on 14 August 2026 was the social media ban for under-15s. French age verification for pornographic sites is a separate regime, built on the SREN law, decret n° 2021-1306 and Article 227-24 of the Penal Code, supervised by Arcom — and it is not only in force but has now been upheld in Luxembourg. Aylo withdrew Pornhub, RedTube and YouPorn from France entirely in June 2025 rather than comply, and those sites remain dark there. Anyone reading that France’s law was annulled and concluding France is now open is reading about the wrong law.

If you travel between these jurisdictions

The rules follow the network, not the passport. A British account holder in Lisbon sees no UK gate, because Ofcom’s requirements attach to UK connections; a Portuguese resident visiting London hits every one of them. Two consequences follow. A service that has worked for years can start demanding ID the day you land, with no warning. And if you verified an account while sitting in a regulated jurisdiction, that record follows you out, because the flag lives on the account rather than the connection.

The part people get wrong is the exit country. Turning a VPN on is no longer the whole answer, because so much of Europe now has something in force. A UK, French, German, Italian or Hungarian server carries you from one age gate straight into another, and in Hungary’s case into a network-level filter as well. The jurisdictions here that currently apply no restriction, and therefore make sensible defaults, are the Netherlands, Switzerland, Belgium and Poland. Poland comes with a caveat: a government bill was adopted by the Council of Ministers on 2 June 2026 and had its first reading in the Sejm in July. It has not passed yet, but that position may not hold.

For frequent travellers the sensible setup is the boring one. Install and configure a VPN before departure, since downloading one from an already-filtered network is the hard version of the problem. Pick a home location with no mandate and leave it as your default. Clear cookies and site cache after switching, because a stored age-gate cookie will keep showing you the wall no matter what your IP says. And be deliberate about which connection you are on when you create an account. One caveat before you buy: NordVPN and Proton VPN have both been unreachable from Turkish networks since December 2023, and Turkiye is about to join this map.

Best VPNs for age verification, wherever you are

The requirement is the same everywhere: a clean IP in a jurisdiction without a mandate, no DNS leaks, and enough locations that you are not stuck when one gets blocklisted. All four run audited no-logs policies, which matters more than usual given what you are otherwise being asked to disclose.

🥇 Surfshark — best overall. 4,500+ RAM-only servers across 100 countries and unlimited simultaneous connections, which is the deciding feature when a household hits the same gate on five devices. Around US$2.49 per month on the 24-month Starter plan. Surfshark is the default recommendation on every guide linked from this page.

🥈 NordVPN — the widest network. 8,900+ servers in 149 countries, NordLynx, and obfuscated servers for networks that inspect traffic. NordVPN runs about US$3.49 per month on the two-year plan. One caveat: it does not work in Turkiye.

🥉 ExpressVPN — the stable choice. Servers in 105 countries and the Lightway protocol, which reconnects fast enough that switching networks does not drop you back onto a gated IP. ExpressVPN Basic covers 10 devices from roughly US$2.49 per month on a two-year term.

🆕 Proton VPN — free and Swiss. A free tier with no data cap, which is rare, plus a paid network of 20,533 servers across 148 countries. Proton VPN is the option if you only hit a gate occasionally.

Frequently asked questions

Final thoughts

2026 was the year the arguments started catching up with the mechanism. A constitutional court struck one law down, a European court upheld another, a parliament in Oslo voted a third down partly because VPNs exist, a Swedish inquiry wrote a carve-out large enough to drive two of the biggest platforms through, and the Dutch cabinet declined to legislate at all. Meanwhile the evidence from the jurisdictions that did act is consistent: compliant platforms lose traffic to non-compliant ones, and a growing pile of identity documents accumulates at verification vendors that nobody audits.

Bookmark this page. The map changes monthly, and we update it as jurisdictions are added, commence, or fall over in court. If you want the one-line version: install Surfshark, connect somewhere without a mandate, and clear your cookies.

Sources

• CJEU — Judgment in joined cases C-188/24 and C-190/24, 16 June 2026
• European Commission — Preliminary findings on Pornhub, Stripchat, XNXX and XVideos, 26 March 2026
• European Commission — Blueprint for an age verification solution
• European Commission — Second version of the blueprint, and the pilot Member States
• Ofcom — Age checks to protect children online

Last updated: 29 August 2026

Burak Kara

I’m on the road about half the year, watching what people actually turn a VPN on for — opening a banking app from back home, finding an online course cheaper abroad, catching a match free on a public broadcaster but paywalled at home, sometimes just the news without a filter. The guides here come from those notes — translated whenever the topic matters elsewhere.