Age verification is perhaps the hottest battleground for online speech, and the Supreme Court just settled a pivotal question: does using it to gate adult content violate the First Amendment in the US? For roughly the past 20 years the answer has been “yes” — now, as of Friday, it’s an unambiguous “no.”

Justice Clarence Thomas’ opinion in Free Speech Coalition v. Paxton is relatively straightforward as Supreme Court rulings go. To summarize, its conclusion is that:

Even the best age verification usually requires collecting information that links people (directly or indirectly) to some of their most sensitive web history, creating an almost inherent risk of leaks. The only silver lining is that current systems seem to at least largely make good-faith attempts to avoid intentional snooping, and legislation includes attempts to discourage unnecessary data retention.

The problem is, proponents of these systems had the strongest incentives to make privacy-preserving efforts while age verification was still a contested legal issue. Any breaches could have undercut the claim that age-gating is harmless. Unfortunately, the incentives are now almost perfectly flipped. Companies benefit from collecting and exploiting as much data as they can. (Remember when Twitter secretly used two-factor authentication addresses for ad targeting?) Most state and federal privacy frameworks were weak even before federal regulatory agencies started getting gutted, and services may not expect any serious punishment for siphoning data or cutting security corners. Meanwhile, law enforcement agencies could quietly demand security backdoors for any number of reasons, including catching people viewing illegal material. Once you create those gaps, they leave everyone vulnerable.

Will we see deliberate privacy invasions? Not necessarily! And many people will probably evade age verification altogether by using VPNs or finding sites that skirt the rules. But in an increasingly surveillance-happy world, it’s a reasonable concern.

Over the past couple of years Pornhub has prominently blocked access to a number of states, including Texas, in protest of local laws requiring age verification. Denying service has been one of the adult industry’s big points of leverage, demonstrating one potential outcome of age verification laws, but even with VPN workarounds this tactic ultimately limits the site’s reach and hurts its bottom line. The Supreme Court ruling cites 21 other states with rules similar to the Texas one, and now that this approach has been deemed constitutional, it’s plausible more will follow suit. At a certain point Pornhub’s parent company Aylo will need to weigh the costs and benefits, particularly if a fight against age verification looks futile — and the Supreme Court decision is a step in that direction.

In the UK, Pornhub ceded territory on that very front a couple of days ago, agreeing (according to British regulator Ofcom) to implement “robust” age verification by July 25th. The company declined comment to The Verge on the impact of FSC v. Paxton, but backing down wouldn’t be a surprising move here.

I don’t ask this question with respect to the law itself — you can read the legal definitions within the text of the Texas law right here. I’m wondering, rather, how far Texas and other states think they can push those limits.

If states stick to policing content that most people would classify as intentional porn or erotica, age-gating on Pornhub and its many sister companies is a given, along with other, smaller sites. Non-video but still sex-focused sites like fiction portal Literotica seem probably covered. More hypothetically, there are general-focus sites that happen to allow visual, text, and audio porn and have a lot of it, like 4chan — though a full one-third of the service being adult content is a high bar to clear.

Beyond that, we’re pretty much left speculating about how malicious state attorneys general might be. It’s easy to imagine LGBTQ resources or sex education sites becoming targets despite having the exact kind of social value the law is supposed to exempt. (I’m not even getting into a federal attempt to redefine obscenity in general.) At this point, of course, it’s debatable how much justification is required before a government can mount an attack on a website. Remember when Texas investigated Media Matters for fraud because it posted unflattering X screenshots? That was roughly the legal equivalent of Mad Libs, but the attorney general was mad enough to give it a shot. Age verification laws are, rather, tailor-made methods to take aim at any given site.

The question “What is porn?” is going to have a tremendous impact on the internet — not just because of what courts believe is obscene for minors, but because of what website operators believe the courts believe is obscene. This is a subtle distinction, but an important one.

We know legislation limiting adult content has chilling effects, even when the laws are rarely used. While age verification rules were in flux, sites could reasonably delay making a call on how to handle them. But that grace period is over — seemingly for good. Many websites are going to start making fairly drastic decisions about what they host, where they operate, and what kind of user information they collect, based not just on hard legal decisions but on preemptive phantom versions of them. In the US, during an escalating push for government censorship, the balance of power has just tipped dramatically. We don’t know how far it has left to go.