Artifacts (non-redacted) for X-rated Compliance Theater: An Empirical Evaluation of European Age Verification Systems in Adult Websites

This repository accompanies the paper "X-rated Compliance Theater: An Empirical Evaluation of European Age Verification Systems in Adult Websites" and includes an Excel file that aggregates our measurements and evaluation results across four countries: France, Germany, Italy, and the United Kingdom. This is the non-redacted version of the dataset. For access, please contact the authors. Dataset overview The Excel file is organized into multiple sheets, described below.The methodology followed for collecting this data is described in the paper. Sheets 1) Comprehensive list An aggregated list of all observed websites, including the top 100 sites from each of the four countries. For each website, the sheet reports: Pornographic Website flag: whether we classified the website as pornographic and therefore included it in the analysis. Per-country deployment (FR/DE/IT/UK): whether an age verification (AV) measure is present, whether the website claims a double-anonymity option, whether the deployed measure was found vulnerable to at least one of the attacks we identified, the AV provider(s) used (when identifiable), the AV method(s) supported/used. 2) Top 100 countries The top 100 adult websites per country as listed by Semrush as of November 2025. The list as of November 2025 is not available anymore on the website. Below you can find the updated list (accessed 14/5/2026). France: https://www.semrush.com/trending-websites/fr/adult United Kingdom: https://www.semrush.com/trending-websites/gb/adult Germany: https://www.semrush.com/trending-websites/de/adult Italy: https://www.semrush.com/trending-websites/it/adult 3) Top 100 merged A subset derived from Top 100 countries, representing the aggregated top 100 websites on which we executed the per-website tests on bypassing the verification measure. For each website, the sheet reports: Pornographic website flag: whether we classified the website as pornographic and included it in the analysis. Concurrent account access: whether the same account can be used concurrently on two different devices. Cross-country reuse: whether the account remains usable from a country different from where the AV process was completed. Session lifetime: whether the validity of the verification and session cookie exceeds 24h and/or 7d. Concurrent session streaming: whether pornographic data can be streamed concurrently using the same session and AV cookie on two devices. Gating enforcement: whether content is blurred/blocked server-side until AV, or blocked client-side (e.g., DOM-based enforcement that can preserve underlying content). 4) Selfie Age Estimation Results from testing selfie-based age estimation workflows (pentesting-oriented evaluation of bypassability and robustness). 5) Document Age Verification Results from testing ID/document-based age verification workflows (pentesting-oriented evaluation of bypassability and robustness). 6) Email or SMS age estimation Results from testing email- and SMS-based age checks (pentesting-oriented evaluation of bypassability and robustness). 7) Account shareability Results of the analysis focused on account/session properties relevant to sharing and reuse. Responsible disclosure / research-use note To avoid enabling misuse, this repository does not include exploit code or step-by-step bypass instructions beyond what is required to interpret the results in the paper. If you are a researcher and need access, or additional technical detail for verification, reproduction, or follow-up studies, please contact the authors (suggested contact: [e-mail]). We can share additional information for research purposes, subject to responsible disclosure practices. The redacted version of the artifacts is available at 10.5281/zenodo.20183951 with public access.本仓库配套于论文"《成人内容合规秀：欧洲成人网站年龄验证系统实证评估》"，包含一份汇总了法国、德国、意大利、英国四国的测量与评估结果的Excel文件。本数据集为未编辑删减版本，如需获取请联系论文作者。 数据集概述 该Excel文件包含多个工作表，详情如下。本数据集的采集方法详见配套论文。 工作表 1) 全量列表 汇总所有观测到的成人网站，包含四国各前100名的网站。该工作表针对每个网站记录以下信息： 成人网站标记：是否将本网站归类为成人色情网站并纳入本次分析。 各国部署情况（FR/DE/IT/UK）： - 是否部署了年龄验证（Age Verification, AV）措施 - 是否提供双重匿名选项 - 所部署的验证措施是否存在至少一处我们检测到的安全漏洞 - 所使用的年龄验证服务提供商（可识别时） - 所支持/使用的年龄验证方法。 2) 各国前100网站 该工作表包含Semrush于2025年11月统计的各国前100成人网站。原2025年11月的列表现已无法在官网获取，以下为2026年5月14日更新后的替代列表： 法国：https://www.semrush.com/trending-websites/fr/adult 英国：https://www.semrush.com/trending-websites/gb/adult 德国：https://www.semrush.com/trending-websites/de/adult 意大利：https://www.semrush.com/trending-websites/it/adult 3) 合并前100网站 该工作表源自「各国前100网站」子集，为汇总后的前100网站，我们针对这些网站开展了绕过年龄验证措施的专项测试。该工作表针对每个网站记录以下信息： 成人网站标记：是否将本网站归类为成人色情网站并纳入本次分析。 账号并发访问权限：同一账号是否可在两台不同设备上同时使用。 跨区域复用性：账号是否可在完成年龄验证的国家之外的其他地区正常使用。 会话有效期：验证及会话Cookie的有效期是否超过24小时和/或7天。 并发会话流媒体播放：同一会话及年龄验证Cookie是否可在两台设备上同时播放成人色情内容。 验证门槛执行方式：内容是否在完成年龄验证前在服务器端被模糊或屏蔽，或是在客户端被拦截（例如基于文档对象模型（Document Object Model，DOM）的拦截方式，可保留原始内容）。 4) 自拍年龄估算 针对基于自拍的年龄验证流程的测试结果（面向渗透测试的绕过能力与鲁棒性评估）。 5) 证件类年龄验证 针对身份证件类年龄验证流程的测试结果（面向渗透测试的绕过能力与鲁棒性评估）。 6) 邮件与短信年龄验证 针对邮件及短信形式年龄验证流程的测试结果（面向渗透测试的绕过能力与鲁棒性评估）。 7) 账号可共享性 针对账号/会话共享与复用相关属性的分析结果。 负责任披露/研究使用说明 为避免被恶意滥用，本仓库未包含漏洞利用代码或详细的绕过步骤说明，仅保留解读论文结果所需的必要信息。 若您为研究人员，需要获取更多数据或用于验证、复现或后续研究的额外技术细节，请联系论文作者（推荐联系方式：[e-mail]）。遵循负责任披露准则，我们可出于研究目的共享额外信息。 本数据集的编辑删减版本可通过公开链接10.5281/zenodo.20183951获取。