Artifacts (non-redacted) for X-rated Compliance Theater: An Empirical Evaluation of European Age Verification Systems in Adult Websites

This repository accompanies the paper "X-rated Compliance Theater: An Empirical Evaluation of European Age Verification Systems in Adult Websites" and includes an Excel file that aggregates our measurements and evaluation results across four countries: France, Germany, Italy, and the United Kingdom. This is the non-redacted version of the dataset. For access, please contact the authors. Dataset overview The Excel file is organized into multiple sheets, described below.The methodology followed for collecting this data is described in the paper. Sheets 1) Comprehensive list An aggregated list of all observed websites, including the top 100 sites from each of the four countries. For each website, the sheet reports: Pornographic Website flag: whether we classified the website as pornographic and therefore included it in the analysis. Per-country deployment (FR/DE/IT/UK): whether an age verification (AV) measure is present, whether the website claims a double-anonymity option, whether the deployed measure was found vulnerable to at least one of the attacks we identified, the AV provider(s) used (when identifiable), the AV method(s) supported/used. 2) Top 100 countries The top 100 adult websites per country as listed by Semrush as of November 2025. The list as of November 2025 is not available anymore on the website. Below you can find the updated list (accessed 14/5/2026). France: https://www.semrush.com/trending-websites/fr/adult United Kingdom: https://www.semrush.com/trending-websites/gb/adult Germany: https://www.semrush.com/trending-websites/de/adult Italy: https://www.semrush.com/trending-websites/it/adult 3) Top 100 merged A subset derived from Top 100 countries, representing the aggregated top 100 websites on which we executed the per-website tests on bypassing the verification measure. For each website, the sheet reports: Pornographic website flag: whether we classified the website as pornographic and included it in the analysis. Concurrent account access: whether the same account can be used concurrently on two different devices. Cross-country reuse: whether the account remains usable from a country different from where the AV process was completed. Session lifetime: whether the validity of the verification and session cookie exceeds 24h and/or 7d. Concurrent session streaming: whether pornographic data can be streamed concurrently using the same session and AV cookie on two devices. Gating enforcement: whether content is blurred/blocked server-side until AV, or blocked client-side (e.g., DOM-based enforcement that can preserve underlying content). 4) Selfie Age Estimation Results from testing selfie-based age estimation workflows (pentesting-oriented evaluation of bypassability and robustness). 5) Document Age Verification Results from testing ID/document-based age verification workflows (pentesting-oriented evaluation of bypassability and robustness). 6) Email or SMS age estimation Results from testing email- and SMS-based age checks (pentesting-oriented evaluation of bypassability and robustness). 7) Account shareability Results of the analysis focused on account/session properties relevant to sharing and reuse. Responsible disclosure / research-use note To avoid enabling misuse, this repository does not include exploit code or step-by-step bypass instructions beyond what is required to interpret the results in the paper. If you are a researcher and need access, or additional technical detail for verification, reproduction, or follow-up studies, please contact the authors (suggested contact: [e-mail]). We can share additional information for research purposes, subject to responsible disclosure practices. The redacted version of the artifacts is available at 10.5281/zenodo.20183951 with public access.