When Mississippi’s age-verification law came back into force in August 2025, Bluesky did something that, on paper, looks like the cheapest possible compliance strategy: it blocked the entire state. Not minors. Not unverified accounts. Everyone. The company’s own explanation was unusually candid — it “cannot justify building the expensive required infrastructure,” and warned that age-verification mandates impose “substantial infrastructure and developer time investments, complex privacy protections, and ongoing compliance monitoring — costs that can easily overwhelm smaller providers,” a dynamic that “entrenches existing big tech platforms while stifling the innovation and competition that benefits users.”
Bluesky is not an outlier. Aylo pulled Pornhub out of Texas, Louisiana, Utah, Montana, Arkansas, Virginia, North Carolina, Mississippi, and more. The blogging platform Dreamwidth withdrew from Mississippi on the same logic. For a growing list of operators, the answer to “how do we comply with this state’s age-assurance law” has become “we don’t — we leave.” This post is about whether that math is actually right. Because geoblocking is presented as the zero-cost option, and it is the one thing it is not.
Why Geoblocking Looks Free
The appeal is obvious. An age-verification mandate looks like a build project: a verification flow, a vendor integration, a privacy review, an audit trail, ongoing monitoring. A geoblock looks like a config change — one entry in a CDN rule, an IP range, a 403 for everyone in the jurisdiction. One is a quarter of engineering work; the other is an afternoon. When the perceived cost of compliance is high and the perceived cost of exit is “some users we probably weren’t monetizing well anyway,” the spreadsheet writes itself.
That framing held when age-verification laws were a handful of red-state adult-content statutes that a mainstream platform could ignore. It does not hold in 2026. The US compliance patchwork now spans a large and growing share of states, the Supreme Court declined to block Mississippi’s HB 1126 while NetChoice v. Fitch continues, and the laws have jumped from pornography to general-purpose social media, account creation, and algorithmic feeds. The EU is pressing member states to ship its age-verification app by the end of 2026, the UK’s Online Safety Act is in active enforcement, and on June 10, 2026 Canada introduced Bill C-34 to bar under-16s from social accounts. “Just block the jurisdiction” stops being a config change and becomes a strategy of progressive retreat from your own addressable market. Each new law is another territory you wall off, until the geoblock map is your product map.
The Costs the Config Change Hides
Treat exit as the default and you absorb four costs that never show up in the “geoblock is free” estimate.
The first is revenue you simply forfeit. Every blocked user is a user who cannot sign up, subscribe, transact, or see an ad — not a deferred conversion, a deleted one. For a consumer platform, a single mid-sized state is a meaningful slice of TAM; the cumulative patchwork is not a rounding error. Bluesky can frame Mississippi as a principled stand because Mississippi is a small fraction of its base. Run the same policy across fifteen states and a national product becomes a regional one.
The second is the network-effect tax. Social and marketplace products compound in value with users. When you geoblock a state, you do not just lose those users — you degrade the product for everyone connected to them. The creator in Texas loses their Louisiana audience. The marketplace seller loses cross-border buyers. Two-sided platforms feel this acutely: thinning one side of the market quietly thins the other.
The third is the competitive gift. The moment you exit a jurisdiction, your compliant competitor owns it. This is the precise mechanism Bluesky warned about, except the beneficiary is not abstract “big tech” — it is whichever rival decided verification was a solvable engineering problem rather than an existential one. Exit is not neutral. It is a transfer of market share to anyone who stayed.
The fourth is the false-safety problem, and it is the one that should bother a compliance officer most. Geoblocking does not actually keep minors out; it keeps honest, in-region adults out. The UK proved this at scale — VPN downloads surged more than 1,000% within days of the Online Safety Act’s age checks taking effect, with some providers reporting spikes well over 1,400%. A geoblock is trivially defeated by the same VPN a thirteen-year-old installs in ninety seconds. So you end up with the worst of both outcomes: you lose your compliant adult users, and the minors the law was written to protect route around the block anyway. You have paid the cost of exit without buying the safety the regulator wanted, which is exactly the posture that invites the next, stricter law — and the VPN-circumvention liability questions that some states are already starting to attach to it.
Bluesky’s Premise Was Right in 2023 and Wrong in 2026
The honest core of Bluesky’s argument deserves engagement rather than dismissal: age verification has historically been expensive, privacy-hostile, and a moat that favors incumbents. Building a compliant verification stack in-house genuinely is a large project — document capture, biometric matching, liveness, fraud handling, data-protection controls, retention policy, an auditable evidence trail, and the ongoing monitoring to keep all of it effective. No small team should build that from scratch, and if those were the only two options — build the whole apparatus or leave — exit would often be the rational call.
But that is a false binary, and it is the part of the reasoning that has gone stale. The “expensive required infrastructure” Bluesky cited is precisely the thing that has been commoditized into a drop-in layer. The choice in 2026 is not build-versus-exit. It is build-versus-integrate-versus-exit, and the middle option has gotten dramatically cheaper than the premise assumes. A modern age layer is an SDK you integrate in an afternoon, not a programme you staff for two quarters. When the integration cost collapses toward the geoblock cost, the entire calculus that justified exit inverts — because now you can keep the revenue, keep the network effects, deny the competitive gift, and actually satisfy the regulator, for roughly the engineering budget you were about to spend walling the state off.
Run the Real Comparison
Decisions like this get made badly because the two options are scored on different axes — exit on engineering effort, compliance on risk — and never on the same ledger. Put them side by side honestly.
Geoblocking costs you forfeited revenue in every blocked jurisdiction, compounding network damage, market share handed to compliant rivals, brand damage from “Service unavailable in your state,” and — because VPNs defeat it — no real reduction in minor access, which means continued regulatory exposure. Its only genuine advantage is low upfront engineering.
A drop-in verification layer costs you an integration (now measured in hours), a per-check fee, and a privacy review. In return you keep every market, preserve the network, capture the share your retreating competitors abandon, and hold an evidence trail that answers a regulator instead of provoking one. The upfront cost is no longer the wide gap it was; the recurring cost is a usage line item, not a standing team.
The reason exit keeps winning these debates is not that it is cheaper. It is that its costs are invisible on the day of the decision — forfeited signups never appear in a dashboard — while the verification cost is a concrete invoice. Good engineering managers know to distrust exactly that asymmetry.
The Friction Objection — and Why It’s Solvable
The fair rebuttal is that verification is not actually free even when integration is cheap: every check is a chance for a user to abandon. A clunky “upload your driver’s license to continue” wall does cost conversions, and for many products that drop-off is the real reason exit looked attractive. That objection is legitimate, and it is also an argument about implementation quality, not about verification versus exit.
The drop-off is a design problem with known solutions. Scale the method to the risk: clear the large majority of users with privacy-preserving on-device facial age estimation that returns an age band in seconds and never sends a face to your servers, and escalate to document or chip checks only for the minority near the threshold. Done well, verification drop-off is a number you actively manage down, not a fixed tax — and it is unambiguously lower than the 100% “drop-off” of blocking the state outright. A geoblock is a verification flow with a conversion rate of zero.
How Xident Fits
Xident exists to make the middle option the obvious one — to turn “build the expensive infrastructure or leave” into “integrate a layer and stay.” We are a privacy-first age and identity layer you add with an SDK rather than a programme you staff. Most users clear a threshold through on-device facial age estimation that returns a band (+12, +15, +18, +21, +25) without a document and without the face image ever reaching your servers; only users near the line escalate to stronger evidence. Because the sensitive computation happens at the edge, you are not building the data-protection and breach exposure that made in-house verification feel radioactive in the first place — you keep an auditable record of the decision, not a cache of biometrics. And because every check produces an exportable, session-level evidence trail, you can answer a Mississippi inquiry or an Ofcom information notice with proof instead of a 403. If you want the standard-by-standard view, our platform implementation guide and vendor security checklist lay out what to demand from any provider, including us.
The Honest Limits
Two caveats keep this from being a sales pitch. First, exit is sometimes genuinely correct — for a tiny hobby project, a service whose entire value proposition is anonymity, or a market where the legal demands truly exceed any plausible revenue, walling off a jurisdiction can be the right call, and no integration cost changes that. The argument here is not “never geoblock”; it is “stop treating geoblock as free, and run the comparison you have been skipping.” Second, integrating a vendor is not literally costless: there is a real per-check fee, a privacy review you still owe your users, and a dependency you should diligence like any other. The claim is narrower and more defensible — that those costs are now small enough that the build-versus-exit framing, and the market consolidation Bluesky warned about, rest on a premise that no longer holds.
The platforms blocking entire states are making a 2023 decision with 2026 tools available. Geoblocking was never free; it was a bill paid in forfeited revenue, ceded markets, and minors who VPN’d around it anyway — a bill that simply did not show up on the day of the config change. The question worth asking before you wall off the next state is not “can we afford to verify?” It is “can we afford to keep handing this market to whoever didn’t leave?”
If you are weighing exit against compliance and want to see what the integrate option actually costs, start here.
