This is not a porn site.

Three business models dominate, and they work very differently from one another.

Tube sites aggregate free content and earn from advertising. Volume is the product. Much of what appears there was uploaded by someone other than the person who made it.

Subscription and fan platforms sell direct access, with the platform taking a percentage of what a creator earns. The creator is not an employee and carries the business risk.

Cam sites sell live performance, usually through tokens or credits bought at one rate and cashed out at another. The spread between those two rates is the platform’s margin, and it is often larger than the headline percentage suggests.

Ownership is more concentrated than it looks. A handful of parent companies operate many of the largest sites across all three models.

For most of the internet’s history, age verification meant clicking a button that said you were 18. That era is over.

More than 25 US states had age verification laws in force by mid-2026, most modelled on Texas House Bill 1181. There is still no federal law, so the picture is a patchwork rather than a standard. The turning point was 2025, when the US Supreme Court upheld states’ authority to enforce these requirements, applying intermediate scrutiny rather than the stricter First Amendment review platforms had relied on to block enforcement.

The United Kingdom’s Online Safety Act took effect for adult content on July 25, 2025, requiring “highly effective age assurance” enforced by Ofcom, with penalties up to £18 million or 10 percent of worldwide revenue. Ofcom has issued fines. France, Germany, Italy and Australia have moved similarly, and the EU is building toward a Digital Identity Wallet.

Self-declaration is no longer sufficient anywhere it matters.

Verification has to happen somehow, and every method carries a trade-off worth understanding.

The most invasive common approach pairs a government ID photo with a live selfie match. Even where a law forbids retention, a user has no way to confirm their data was actually deleted. The risk is not theoretical: in June 2024 the identity verification vendor AU10TIX left login credentials exposed online for over a year, including names, dates of birth, nationalities, ID numbers and ID images.

The Electronic Frontier Foundation argues these systems are fundamentally incompatible with the anonymity that domestic abuse survivors, journalists and activists rely on, that facial age estimation misjudges age by skin tone, gender and disability, and that determined minors bypass them anyway while every compliant adult carries the privacy cost.

Regulators have heard this. The direction of travel is toward privacy-preserving methods: facial age estimation, digital wallets, and zero-knowledge proofs that confirm someone is over 18 without revealing a birth date.

The most consequential rule-makers in this industry are not regulators. They are payment processors.

Visa and Mastercard set acceptable-use conditions for merchants. When those conditions change, platforms comply immediately, because losing card processing ends the business overnight. Content categories have disappeared from major sites within days of processor pressure, with no legislation, no hearing and no appeal.

This is why crypto keeps appearing in this sector. It is not ideology. It is an attempt to route around a chokepoint that has removed livelihoods without notice.

Whether that chokepoint is a safeguard or an unaccountable private censor depends on who you ask, and both readings have evidence behind them.

Almost everyone working in this industry is an independent contractor. Not an employee. That distinction determines nearly everything downstream.

No minimum wage, no sick pay, no unemployment insurance, no employer contribution to healthcare or pension. Income is irregular by nature and the performer absorbs every business cost.

Payment reaches them through a chain: viewer to platform, platform to processor, processor to performer. A chargeback anywhere in that chain is typically deducted from the performer, not the platform, sometimes months after the work was done.

Banking is a recurring problem. Performers are routinely denied accounts, mortgages and payment services because of their occupation, in jurisdictions where the work itself is legal.

The stated revenue split is rarely the whole story. Processing fees, payout minimums, currency conversion and token spread all sit between the headline percentage and what arrives.

Removing something from the internet is far harder than putting it there, and the gap between those two facts is where most of the harm in this industry now sits.

Major platforms have introduced consent documentation and verified-uploader requirements, generally after public pressure rather than ahead of it. Those systems apply going forward. They do very little about material already distributed.

A takedown request removes a file from one host. It does not reach copies already downloaded, mirrored, or re-uploaded elsewhere, and re-uploading is trivial. Someone seeking removal is often left doing the searching themselves, indefinitely, for material they never consented to in the first place.

In the United States, the TAKE IT DOWN Act created federal obligations around non-consensual intimate imagery, including AI-generated material. Enforcement is new and the practical effect is not yet clear.

If you need help with non-consensual imagery: the Cyber Civil Rights Initiative operates a crisis helpline at 844-878-2274. StopNCII.org can hash images to block them across participating platforms without you uploading the image itself.

Adult sites carry third-party trackers at rates comparable to or higher than the rest of the commercial web. Analytics, advertising and content delivery scripts all observe visits.

Age verification adds a second layer, because a verified session ties a real identity to browsing that was previously pseudonymous. Two systems that were separate now touch.

Private browsing modes stop a browser storing history locally. They do not prevent a site, a network operator, or an embedded tracker from observing the visit.

The security question that follows from all of this is simple: any system holding both identity documents and browsing behaviour is a high-value target, and the AU10TIX exposure showed what that looks like in practice.

If you are worried about compulsive use, the same principle applies as with gambling. Signs worth taking seriously include use escalating beyond what you intend, interfering with work or relationships, or continuing despite wanting to stop. A doctor or licensed therapist is the right place to start.