Every January, the new year marks the point when new laws kick in all over the country. In Louisiana, one of those laws is HB 142, which requires users in that state to prove they’re 18 or older before accessing sites that contain pornographic material.

If a website’s content is a least one third porn, you have to show an ID. And the reason that’s legally possible is because Louisiana is one of the few states in the U.S. that allows residents to store government-issued ID digitally on their smartphone. And that’s the ID the state wants people to use if they want to view adult content online.

This new law has many privacy advocates worried, and some researchers are warning about unplanned ripple effects of its implementation. Marketplace’s Kimberly Adams spoke with Jordan Taylor, an internet and social media researcher and PhD student at the Human-Computer Interactive Institute at Carnegie Mellon University.

The following is an edited transcript of their conversation:

Jordan Taylor: This law says that if a website has a substantial portion of its content deemed harmful to minors, then they need to install these age verification processes. And it is impacting these pornography sites like Pornhub. But there’s a lot of other websites out there that may also be meeting this threshold. For instance, social media sites like Reddit, Twitter, Tumblr have significant amounts of adult content.

Kimberly Adams: What’s the enforcement mechanism for this law?

Taylor: Minors’ parents are able to sue for damages associated with the access of these sites in civil court.

Adams: So how are these websites responding in terms of either what they’re saying or what they’re doing in terms of verification?

Taylor: The only website that has actually implemented these age verification programs has been Pornhub. And various other porn sites haven’t taken these steps. But this kind of brings up this fuzzier issue — it’s not really clear what sites are going to be covered under this law. So for instance, it is pretty obvious that more than a third of the content on Pornhub, with porn in the name, is going to have material harmful to children. But it’s not as clear-cut with these other sites like social media sites, and also dating apps; for instance, like Grindr.

Adams: Can you walk me through the process, at least that Pornhub has implemented, that Louisiana residents have to go through to comply with this law?

Taylor: Sure. So when you visit the website, you’re met with a screen that says that you have to verify your age in order to access Pornhub. You click “check my age,” and it takes you to a third-party site. So it’s not Pornhub that you’re uploading your ID to, it’s this other website. And you’re basically giving your ID to that other website. The other website then kind of talks to Pornhub and says either “yes, this person is of age or no, this person is not of age.”

Adams: Because this is a third-party system that has the resident’s digital ID to upload to these sites, what does that tell us about how this sensitive data is being collected and retained, and by whom?

Taylor: Yeah, so according to the law, these either websites that are collecting this data, or these third-party verification sites that are being used to validate people’s ages, are not allowed to retain any of that data. But as we know, there’s a difference between something a company is allowed to do and what actually happens in practice. So anytime you’re collecting data on the internet, there is some risk of something going wrong, someone mishandling it, and data being shared. But I think what’s really important to think about here is not simply what’s taking place within kind of the actual verification system, but kind of what else might be taking place. So for instance, if I was a scammer, I imagine there’s going to be an increase in phishing scams in the state of Louisiana, where people are going to create kind of these fake “hey, you need to upload your driver’s license information, if you want to log into our porn site.” And they’re just going to use that to steal people’s identities.

Adams: To have an ID, especially one of these digital IDs, requires paying for it. What are the implications for Louisiana residents who don’t have one of these IDs, who might just want to access, a website like Twitter or Reddit, or something like that, that has a lot of adult material?

Taylor: Yeah, so as of right now, it’s really up to these websites to determine for themselves if they think they might be held liable according to this law. So it’s not the state of Louisiana saying “you, Twitter, have to do this.” It’s a proactive measure whether or not they decide to implement age verification to avoid legal liability. And to answer your question, I think it’s also important to realize that people in the state of Louisiana are still going to try to access these sites, even if they either don’t have a government ID or don’t want to use the government ID, through the use of technologies like virtual private networks, or VPNs. It’s quite concerning to see people having to take these sort of steps to protect themselves in the United States.

Adams: Supporters of this law and ones like it say that it’s a reasonable standard to require these sites to verify a user’s age. How effective is this law at actually doing that, though?

Taylor: I think that what’s quite concerning here is the massive unintended impact of introducing barriers to adults trying to access this information. There’s adults who are not going to have an ID. There’s adults who aren’t going to want to give their ID. But there’s also going to be some adults who are not going to know how to give their ID. And also, it’s going to potentially shape people’s behaviors. If you think that there’s a chance that your pornography consumption may be leaked because you had to give your government ID to log in, that may change what kind of media you consume.

Adams: What are you going to be watching for as the year moves on now that this law is in place in Louisiana?

Taylor: I’m going to be watching for one: the impact that it has on sites beyond pornography. I think this law is very effective, because it seems like it makes sense, especially in the context of this kind of offline metaphor of you’re going into a video store and if I want to go into Blockbuster and rent a DVD, I had to show my ID back in the day, or if you want to go to a bar, you have to show your ID. But I’m also looking to see how this law may proliferate to other states. For instance, as we’ve seen with the recent wave of anti-LGBT legislation, going from state to state.

Related links: More insight from Kimberly Adams

Jordan has a Twitter thread, shown above, where he went into more detail about this law. In the thread, he links to an ACLU article that points out that some 21 million Americans lack access to a government-issued ID.

Also, a recent article from Vice’s Motherboard highlights how other pornographic sites, like XVideos and XHamster, are still running as normal, while OnlyFans seems to not load for a while in Louisiana.

We reached out to Twitter, Grindr, OnlyFans and Reddit, all of which might potentially be subject this new law’s requirements, but we didn’t get any responses back by the time of this show’s taping.