Pennsylvania's Age Verification Bill Is a Privacy Disaster Waiting to Happen

Key Takeaways

• Pennsylvania's Senate Judiciary Committee advanced SB 603 on September 28th with bipartisan support; the bill requires state ID verification before accessing any website where at least one-third of the content consists of adult material.
• The bill doesn't specify how age verification data must be stored, secured, or protected from misuse — only that sites must not retain it, with no enforcement mechanism for that requirement.
• Critics, including the EFF and FIRE, warn the bill will burden adults' First Amendment rights, destroy online anonymity, and create conditions for data theft, profiling, and extortion.
• A private right of action enforcement model — rather than state attorney general enforcement — means any website arguably covered faces lawsuit risk, creating incentives to over-gate content well beyond what the bill requires.
• Two Democratic senators voted against the bill specifically citing its data privacy gaps; a third voted yes while calling for amendments, saying "I suspect this will not be the last word on this."

Pennsylvania's SB 603, sponsored by Sen. Cris Dush (R-Jefferson), would require any website where at least one-third of content consists of adult material to verify the age of users before granting access — using state identification documents or equivalent proof. The bill passed the Senate Judiciary Committee on September 28th with bipartisan support, though not without significant objections about what it would actually do to the people it's supposedly protecting.

The bill follows a 2025 U.S. Supreme Court decision in Free Speech Coalition, Inc. v. Paxton, which allowed a Texas age verification law for adult content to stand while subjecting such laws to heightened scrutiny. Pennsylvania's bill is modeled on that Texas law, but with a significant structural difference: instead of enforcement by a state attorney general, SB 603 creates a private right of action. That means any website arguably covered by the bill faces the threat of a lawsuit from private litigants, not just state officials.

According to Trace Mitchell, an attorney at the Foundation for Individual Rights and Expression, that distinction matters enormously. Discovery — the process of determining whether a website falls within the bill's scope — is almost always the most expensive part of litigation. "Even if you win, you've already paid for most of the lawsuit," he told the Capital-Star. The predictable result is that websites will implement age gates well beyond what the bill technically requires, simply to avoid the legal exposure of finding out whether they needed to.

The Data Problem Nobody Has Solved

The bill's requirement that sites not retain age verification data sounds like a privacy protection. It isn't one, because the bill doesn't specify how data must be handled during the verification process, how it must be secured, or what happens when it's misused. According to Megan Iorio, senior counsel at the Electronic Privacy Information Center, any transmission of sensitive data over the internet carries inherent risk — and the specific risks here are severe.

"If a company collects that information and stores it in an insecure way, then it's subject to, potentially, data theft," she told the Capital-Star. "And if they use that information in other ways, like to profile users or to sell that information, those are other privacy concerns."

Sen. Maria Collett (D-Montgomery), one of two committee members to vote against the bill, named a risk that rarely comes up in legislative debate about age verification: extortion. "Who among us hasn't gotten a scam email from someone that says, 'I've seen what you look at online. I'll tell everyone you know unless you send me $1,000 in cryptocurrency,'" she said. "If you're someone who is lawfully visiting a site where you're looking at adult material, and you're using it in an appropriate manner, we have to be mindful that that data collection can't then be used as a tool to exploit you further."

She's identifying something real. Age verification for adult content doesn't just collect an age. It creates a linkage between an identity document and a record of access to a specific category of site. That linkage is exactly the kind of data that enables targeted blackmail — and it's being created at the behest of a law that hasn't specified how it must be protected.

The First Amendment Problem

Aaron Mackey, deputy legal director at the EFF, framed the constitutional concern directly: "We believe [these laws] burden adults' rights to access lawful speech, that they can destroy people's ability to be anonymous online, and that they are privacy and data security disasters waiting to happen. In the name of protecting children, you are making it such that people have a pretty difficult, if not impossible, time avoiding providing information that directly or indirectly identifies them."

Anonymity in speech has long been recognized by the Supreme Court as a constitutional protection. A law that makes identifying yourself the price of accessing legal content — content adults have a First Amendment right to see — puts those two things in direct conflict. Mitchell put the practical consequence plainly: "Anonymity is incredibly important. It's often what makes speech possible and allows people to engage in free expression without worrying it will be used against them."

The one-third content threshold creates a further problem. There's no way for a website to know in advance whether it falls within scope, and no way to prove it doesn't without going through discovery. That uncertainty, combined with private right of action enforcement, is a design that almost guarantees over-compliance — meaning far more websites will implement ID checks than the law technically requires, and far more adults will be forced to identify themselves to access legal content than the law's stated purpose would justify.

What Lawmakers Did Anyway

Two senators voted against the bill. A third, Sen. Steven Santarsiero (D-Bucks), voted to advance it while explicitly agreeing with the data privacy concerns and calling for future amendments. "I suspect this will not be the last word on this," he said. The message appears to be that sending a signal to adult content sites matters more right now than ensuring the mechanism for sending it doesn't expose the adults it's supposed to protect.

That's a familiar pattern in age verification legislation. The stated goal is child protection. The mechanism is identity collection. The people bearing the cost are adults who use the internet legally, whose data now passes through a system with poorly specified protections, enforced by a private right of action that incentivizes maximum over-compliance.

Pennsylvania joins a growing list of states moving in this direction after the Supreme Court's 2025 ruling opened the door. The federal court that blocked Utah's VPN age verification provisions, finding the mandates likely unconstitutional, offers one counterweight. Whether Pennsylvania's version survives the heightened scrutiny the Supreme Court said applies is a question the courts will answer. The committee voted to send it there.