On July 31, 2026, the Electronic Frontier Foundation published an analysis warning that the SCREEN Act (S. 737), which the Senate Commerce Committee is set to consider, would extend mandatory age verification far past adult websites and — for the first time in a federal AV bill — explicitly target virtual private networks. EFF's India McKinney argues the bill "will force millions of adult internet users to give up their anonymity, privacy, and security before they access lawful speech."

Why It Matters

Adult platforms have spent two years building compliance for a patchwork of roughly two dozen state laws. A federal bill with no content-percentage threshold would change the shape of the problem entirely: the compliance perimeter stops being "adult sites" and becomes "any site with a sexual image on it," which pulls mainstream platforms — and their lobbying budgets — into a fight they have so far mostly watched. That cuts both ways for the industry. Broader scope means more powerful opponents in Congress, but it also means adult sites would no longer be uniquely burdened. The VPN clause is the operational headline: if enacted, it would close the escape hatch that has made state AV laws leaky in practice, and it would push the age-verification vendor market — already flush from state mandates — into a much larger addressable base.

The scope problem is structural. Most state age-verification laws, including the Texas statute upheld in Free Speech Coalition v. Paxton, apply only where some threshold share of a site's content is sexual material harmful to minors. Per EFF, the SCREEN Act contains no such threshold: it would require age verification from "nearly any service hosting even a single piece of sexually explicit content." That sweeps in Pornhub and OnlyFans, obviously — but on EFF's reading it also reaches streaming services like Netflix and social platforms like Reddit, Discord, and Bluesky.

The bill also forecloses the cheap compliance path. It states that "requiring a user to confirm that the user is not a minor shall not be sufficient," meaning self-attestation is out and platforms must verify against something tied to real identity. EFF's objection is that the digital bouncer, unlike the physical one, keeps the ID: verification vendors capture personal information and retain it for an unspecified period. The bill's data-protection language — reasonable steps to protect collected data and not retain it longer than necessary — imposes, in EFF's assessment, "no meaningful collection, use, or retention limits."

The VPN provision is the genuinely new escalation. The SCREEN Act would require covered sites to verify age based on IP address unless the service can determine the user is outside the United States, and specifically mandates age verification on traffic arriving from known VPN addresses. VPN use has been the primary workaround for state AV laws — search interest in VPNs spikes in every state the day a law takes effect — and this is the first federal text to name the technique directly. EFF calls it "particularly galling that the SCREEN Act forces users who intentionally take steps to protect their privacy to identify themselves."

This is the same SCREEN Act that rode through the House on June 29, 2026 as Title I of the omnibus KIDS Act, which passed 267–117. The Senate track is separate and, per EFF, moving through Commerce as a standalone.

Sources

Update — 2026-08-01

{Initial entry — story first created.}