404 Media

2026-05-28 13:53:25

Headway Therapy Patients Forced to Scan Their Faces to Keep Getting Care

Headway, a popular online therapy platform, says it will require clients and providers to undergo biometric scanning, and there’s no way to opt out other than leaving the platform.

On April 3, Headway sent an email to clients informing them of the upcoming requirement: “To make sure Headway stays a safe and reliable place to get care, you'll soon be asked to verify your identity by taking a picture of a valid government-issued photo ID in your portal,” the email said, which a user shared with 404 Media. “As part of this process, you'll also be asked to take a clear photo of your face to confirm your identity. The facial image is never used for anything but identity verification.” The facial scan involves using your devices’ camera and moving your head from side to side.

The email said that the platform was asking clients to verify their identity “proactively” so that they’d have “plenty of time to complete this,” but didn’t specify when identity verification would be required. “We're not asking you to verify because of any specific behaviors or concerns,” Headway said in the email. “It's a requirement for anyone seeking medication management on Headway.”

💡
Do you know anything else about biometric scanning in healthcare or therapy? I would love to hear from you. Using a non-work device, you can message me securely on Signal at sam.404. Otherwise, send me an email at sam@404media.co.

Headway says identity verification for patients “is rolling out in waves over the coming weeks, starting with patients of prescribers,” but eventually all providers will be required to undergo facial scanning. Providers and clients I spoke to told me they haven’t yet needed to do this step, and the uncertainty of when they’ll be required to hand over their biometric data—and if they don’t, lose access to the platform and their clients or care—is adding to their concern about the process.

Many mental health providers or the practices they work for use Headway to help them get credentialed with insurance companies and process billing and other administrative tasks. Through Headway, providers can be in-network with a much wider variety of insurance plans.

Headway is telling clients in customer support chats and emails that it will use the third-party vendor Persona to verify identities, according to emails viewed by 404 Media. Persona is part of the portfolio of Founder's Fund, Peter Thiel’s investment firm, according to Founder’s Fund’s website. Earlier this year, Discord ended its extremely short-lived contract with Persona, but many other platforms use it, including Doordash, Uber, and Roblox.

In its biometric data policy, Headway states that when processing biometric data, it will “Inform each User in writing of the manner in which the User may opt out of the collection, processing, storage or usage of their Biometric Data.” But last month, 404 Media asked Headway if users can opt out. “No, identity verification is currently a required safety step for patients seeing prescribers as part of our commitment to safe, verified care,” a Headway spokesperson said. “We’ve let patients know they can contact Headway support for a manual review in extenuating circumstances.”

Users and providers haven’t been able to get a straight answer about when this requirement is starting or how opting out works other than not using Headway at all. A customer support person at Headway told one client that they can choose not to undergo identity verification, but if they do, they won’t be able to meet with a prescriber on Headway, according to copies of the chat viewed by 404 Media.

"Do I give up my privacy or do I burn all my progress and then just go to a different company and try and find somebody else, and start over?"

Headway said in an email to providers that sessions “may be auto-cancelled if verification is incomplete,” and “providers in your group will be unable to confirm sessions without completing their own identity verification.”

One client who’s used Headway for several years and sees providers for both medication management and talk therapy told me that “opting out” as Headway defines it isn’t as simple as switching platforms. “It's not just a consumer choice thing,” they said. “Healthcare is a totally different thing. I've talked to my providers, and they're not on any alternative [platforms]. It's possible that your provider is also on some alternative, but that's not the case for me.” Switching providers would mean starting over, finding new providers that could be a good fit and take their insurance, and hoping there’s no lapse in treatment in the meantime.

“It's just not a good situation,” they said. “It’s a rock and a hard place. Do I give up my privacy or do I burn all my progress and then just go to a different company and try and find somebody else, and start over?”

The client I spoke to said they were especially concerned in light of Health Secretary Robert F. Kennedy Jr.’s intentions to link databases of autism patients using federal health insurance programs including Medicare and Medicaid. Kennedy has also said the Center for Disease Control is “finally confronting the long-taboo question of whether SSRIs and other psychoactive drugs contribute to mass violence,” and has recently targeted antidepressants, which psychiatrists say is a dangerous oversimplification of millions of Americans’ experiences with mental health and medications.

Headway is also informing providers—whether they prescribe medication or not—that facial scanning and identity verification is coming soon, and is coaching them on how to talk to clients who are wary of handing over their biometric data, to convince them to go through with it.

The platform is also telling providers who haven’t gone through identity verification themselves that their payments might be restricted. “We’re reaching out because our payment processor let us know that your account is missing information that will soon impact and restrict your payouts from Headway,” an email Headway sent to one provider said. It directed them to use a link to update their payment information to become verified, but the link in the email didn’t go to a verification process, the provider who received it told me. The platform hasn’t informed providers or patients about when identity verification or facial scans will start being required.

Headway did not respond to my questions about when specific groups would be required to undergo identity verification or if verification status will affect provider’s payments.

A spokesperson for Headway told 404 Media: “Confirming that Headway has recently started to enforce identity verification to our network. To clarify—today, we require identity verification for patients receiving prescriptions through Headway, as prescribers have a heightened obligation to confirm they are treating a verified patient before writing a prescription, and this process helps them meet that standard. It also protects patients by ensuring that prescriptions, medical records, and billing are tied to the right person.”

“Identity verification is currently a required safety step for patients seeing prescribers as part of our commitment to safe, verified care. We’ve let patients know they can contact Headway support for a manual review in extenuating circumstances,” the spokesperson added.

The Headway spokesperson said identity verification “is run through a HIPAA-compliant, SOC 2-certified platform,” and identity data “is stored in a centralized, encrypted, access-controlled record with detailed audit logs.”

Headway’s site says the new requirements are “similar to showing your ID at the front desk of a doctor's office.” But facial scanning and biometric data isn’t the same as presenting identification at the doctor or at a store. Privacy experts agree that online identity verification systems like those now required to access adult content and age-restricted material in many places around the world pose new and different risks, including the possibility of breaches, third-party sellers, and invasive tracking. Headway says it won’t use this data for marketing, and that it will protect it from hacks. Users are forced to take the platform’s word for it.

The Headway spokesperson claimed that the response from users to the new requirements has been “mostly positive.” But providers I spoke to said they’re concerned and considering leaving the platform because of it. One provider I spoke to, who is a psychotherapist and doesn’t prescribe medication but received emails from Headway informing them of the impending changes anyway, told me they feel “frankly afraid” because there’s no option to opt-out other than severing care, especially for patients. “When I initially got the email indicating that they would be rolling out biometric scanning, my stomach dropped,” they said. “The email indicated that they would start with prescribers and their clients and then move onto everyone else. My mind started racing, what are the ethics around this? Where is this data going? The only time I've had to do a biometric scan is to do something for the IRS. This is not common practice in my field.”

They said they’re not sure yet if they’ll stay on Headway. “It feels values-inconsistent to continue to work them for a variety of reasons, but this perhaps is the nail in the coffin for me,” they said. “In some ways I don't have a choice because I am not independently credentialed with all of the plans that I am credentialed with through Headway. Meaning, I cannot see those clients outside of Headway. I do not (and will not) want to abandon those clients.”

Another provider I spoke to said that although there’s a lot of conversation happening among providers about leaving the platform, it’s easier said than done. “So many of us need this for our income, so it's a real sacrifice” to stop using Headway at this point, they said. “That's kind of the dilemma people are in.”

Joseph Cox contributed reporting.

Age Verification Laws Drag Us Back to the Dark Ages of the Internet

Invasive and ineffective age verification laws that require users show government-issued ID, like a driver's license or passport, are passing like wildfire across the U.S.

^{Emanuel Maiberg (404 Media)}

404 Media

2026-05-05 14:11:49

UK iPhone and iPad Users Can Watch Porn Again

Aylo, the parent company of Pornhub and other major porn sites, announced today that in the UK, iPhone and iPad users will be able to access its sites again, ending an over three month ban that Aylo initially enacted because of the region’s age verification law.

As of Tuesday, following the iOS 26.4 rollout in the UK, users on the new operating system can visit Pornhub and Aylo’s other sites from their iPhones.

On April 29, Apple announced that it would start requiring mobile users to confirm ages on their devices to check if they’re 18 or older: “You can confirm your age with a credit card that belongs to you, or by scanning your passport, driving licence, or one of the following PASS-accredited Proof of Age cards: CitizenCard, My ID Card, TOTUM ID card or Young Scot National Entitlement Card. Debit cards and gift cards aren't supported,” according to Apple. Web content filters and communication safety tools are turned on automatically for children, as well as adults who haven’t confirmed their age, Apple wrote.

Many UK Users Soon Won’t Be Able to Access Pornhub
Starting February 2, many people connecting from the UK will not be able to access the porn site and many others.
404 MediaSamantha Cole

In January, Aylo announced that starting February 2 it would restrict people visiting the site from the UK. Leadership at Aylo and Ethical Capital Partners (ECP), which acquired Aylo in 2023, said at the time that the UK’s Online Safety Act was a failure. Before January, UK-based visitors to Aylo sites—which include RedTube, YouPorn, Brazzers, and many more—had to verify their ages by entering a credit card or uploading a government ID or other identification to an age estimation system called All Pass Trust. After February, anyone in the UK not already verified was locked out of those sites.

Age Verification Laws Drag Us Back to the Dark Ages of the Internet
Invasive and ineffective age verification laws that require users show government-issued ID, like a driver’s license or passport, are passing like wildfire across the U.S.
404 MediaEmanuel Maiberg

Experts say site-based age verification is both ineffective at stopping minors from viewing harmful content as it drives them from lawful sites to harmful, unregulated ones, and also chills adults’ abilities to work online as adult performers and consume legal adult entertainment online. The adult industry has been lobbying for device-based verification and parental controls, which often already exists as an optional feature on most devices children might have access to, as an alternative. Device-level age verification remains controversial among free speech and internet access groups.

In the UK, the Online Safety Act, which went into effect in 2025, requires sites to implement age verification or face millions of dollars in fines and jail—or up to 10 percent of global revenues, whichever is higher. In the US, more than half of states have strict age verification laws in place, and in many of those states, Aylo blocks access and directs users to contact their representatives.

This is the first time Aylo has come back to a market after restricting access to its sites in response to age verification laws.

“As of about 30 minutes ago, we're now live again in the UK, accessible to Apple users who have updated to the most recent version of the iOS,” Alex Kekesi, VP Brand and Community at Aylo, said in a 9:30 a.m. EST call on Tuesday.

Visitors to the sites who are using a Windows PC, Android device, or other non-iPhone or other mobile Apple devices such as iPads that use iOS in the UK will still not have access.

“We have been reaching out to the operating system providers to emphasize the need for a highly effective device based solution, that includes Google, that includes Microsoft and Apple,” Solomon Friedman, partner and vice president of compliance at ECP, said on the call. “And on behalf of ownership, we're obviously delighted to see that Apple has instituted UK wide, effective device based age assurance.”

In November 2025, Pornhub’s parent company Aylo sent letters to Apple, Google, and Microsoft urging them to support device-based age verification in their app stores and operating systems.

Pornhub Is Urging Tech Giants to Enact Device-Based Age Verification

The company sent letters to Apple, Google, and Microsoft pushing for an alternative way to keep minors from viewing porn, as US and UK laws have caused its traffic to plummet.

^{Jason Parham (WIRED)}

404 Media

2026-04-06 15:30:47

Wisconsinites Can Keep Watching Porn After Governor Vetoes Age Verification Bill

Across most of the U.S., if you want to watch porn online, you have to hand over a government ID or submit to a biometric scan to determine you’re over 18 years of age. But people in Wisconsin can keep freely accessing porn sites—and any other website that hosts more than one third adult content—after Governor Tony Evers vetoed the state’s age verification bill on Friday.

A copycat of the dozens of bills that have passed in the U.S. since 2022, Wisconsin’s Assembly Bill 105 would have forced sites with more than one third “material harmful to minors,” defined as “depictions of actual or simulated sexual acts or body parts including pubic areas, genitals, buttocks, and female nipples,” to verify visitors’ ages by “using any commercially reasonable method that uses public or private transactional data gathered about the individual.” This means uploading an ID, showing their face for a biometric scan, uploading their credit card information, or combinations of these.

“I am vetoing this bill in its entirety because I object to this bill's intrusion into the personal privacy of Wisconsin residents,” Evers wrote in a letter to the members of the assembly, dated April 3. “While I agree that we should protect children from harmful material, this bill imposes an intrusive burden on adults who are trying to access constitutionally protected materials.”

Evers wrote that the bill doesn’t prevent platforms from giving collected personal data to third parties, such as the government or data brokers. “This is a violation of personal privacy,” he wrote.

“Additionally, I am concerned about data security and the potential for misuse of personally identifiable information. Identifiable information could be intercepted by or transmitted to a third party and used as the basis for blackmail or identity theft. Further, although the bill includes penalties for a business entity who violates the prohibition on retention of personal information, those penalties cannot undo the harm that may occur to an individual who is the victim of actions like blackmail or identity theft as a result of a bad actor obtaining their identity.”

Last year, after the UK’s Online Safety Act started requiring websites and platforms to verify users’ ages, Discord users’ age verification data—including selfies and identity documents—was exposed in a security breach. The hack was just one instance where users’ personal data has been required by a platform and then exposed to the whole internet: also last year, similar data was exposed by the Tea app, which made users provide selfies and identity documents to prove they’re women.

An earlier version of the bill attempted to ban Wisconsinites from accessing sites using virtual private networks (VPNs); lawmakers are increasingly pushing to restrict VPNs, but so far have faced pushback from citizens and civil liberties groups. Wisconsin state Sen. Van Wanggaard moved to delete that provision in the legislation, and the state assembly agreed to remove the VPN ban in February.

The adult advocacy group Free Speech Coalition wrote following the veto that Director of Public Policy Mike Stabile flew to Madison “to meet with legislators to discuss the legal and technological issues with the bill, including a ban on VPN traffic, and to advocate for device-based verification solutions.”

“Put simply, AB-105 raises significant concerns around privacy, surveillance, and the First Amendment,” the ACLU of Wisconsin wrote in testimony submitted in March. “While the ACLU of Wisconsin is sympathetic to the overarching goal of this legislation, we do not believe an appropriate trade-off is compromising the civil liberties of all Wisconsinites.”

Wisconsin is now one of only a handful of states left that allows access to porn without requiring users jump through invasive age verification hoops. “We can and should work to prevent minors from accessing adult content, but there are better solutions than the one offered by this bill,” Evers wrote in his veto letter. “For example, we can work with tech companies to implement device-based age verification that takes place on a user's phone or computer, which can be a more secure and effective method. Other states have been moving toward device-based solutions, and major tech companies are adopting these options as well.”

Wisconsin Governor Vetoes Age-Verification Bill — Free Speech Coalition

Wisconsin Governor Tony Evers has vetoed AB 105 , the state age-verification bill that passed the Wisconsin legislature in early March, despite strong opposition from Free Speech Coalition and other civil liberties groups.

^{Free Speech Coalition}

404 Media

2025-03-25 14:27:34

Texans Might Soon Have to Show Photo ID to Buy a Dildo Online

A newly introduced bill in Texas would require online sellers to show a photo ID before buying a dildo.

SB 3003, introduced by Senator Angela Paxton (wife of Texas Attorney General Ken Paxton), would criminally charge online retailers for selling “an obscene device” without verifying the buyers’ age. Sellers would have to require customers to submit their government-issued photographic identification, or use “third-party age verification services that use public records or other reliable sources to verify the purchaser's identity and age,” the bill says. Owning a credit card, which already requires the holder to be over 18 years of age, would not be enough.

Like the regressive and ineffective adult site age verification laws passing all across the country in the last few years, this law would drag Texans back to a not-so-distant time when sex toy sellers had to pretend vibrators were for “massage.”

Hallie Lieberman, journalist and author of Buzz: A Stimulating History of the Sex Toy, sold sex toys in Texas in the early 2000s under the state’s “six dildo” law, which criminalizes the possession of six or more “obscene devices,” defined as "a device including a dildo or artificial vagina, designed or marketed as useful primarily for the stimulation of human genital organs." That law is still on the books but is now considered unenforceable and unconstitutional. Lieberman told me sellers got around the law by claiming the toys were for “medical purposes.” This bill could send retailers back to that time.

“I can see something like that happening again, with people saying on their sex toy store websites that vibrators are for back massage and butt plugs are for rectal strengthening,” Lieberman said. “It's similar to how sex toys were marketed in the early 20th century to get around obscenity laws and the Comstock Act (which unfortunately still exists and may be used to prevent access to contraceptives and sex toys nationwide.) Butt plugs were sold as cures for asthma and vibrators for sciatica. We are literally going back in time with this law.”

Age Verification Laws Drag Us Back to the Dark Ages of the Internet
Invasive and ineffective age verification laws that require users show government-issued ID, like a driver’s license or passport, are passing like wildfire across the U.S.
404 MediaEmanuel Maiberg

Lieberman told me she had to call the clitoris “the man in the boat” at the time to avoid breaking the law. “When we can't speak openly about our bodies and sexual pleasure, when we're forced to use euphemisms, we not only are under informed about our bodies, but we also feel shame in seeking out pleasure,” she said.

Like age verification laws for websites, the bill would make buying sex toys online harder for everyone, not just minors, and would send consumers to less-safe retailers with lower-quality, possibly dangerous toys. And also like those laws, people who do upload their government ID or undergo other age verification measures could risk having their purchases exposed to a hostile government.

“The government should not have a record of what sex toys we buy. This isn't just a frivolous concern,” Lieberman said. “In a nation where the president has declared that there are only two genders and that transgender people don't exist, where trans people are erased from government websites and kicked out of the military, it would be dangerous for the government to have a record that you purchased sex toys designed for trans people. Imagine you're a school teacher at a public school in Texas and there's a record you purchased a sex toy designed for queer people in a state where a parental bill of rights bill was just passed prohibiting discussion of sexual orientation in schools.”

"We are literally going back in time with this law."

Texas legislators have been trying to limit access to sex toys for their constituents for years. In late 2024, Hillary Hickland, a freshman member of Texas’ Republican House, introduced a bill that would ban retailers in the state from selling sex toys unless they file paperwork to become sexually oriented businesses—effectively forcing stores like Walmart, CVS and Target, which sell vibrators and other sex toys, to take those products off their shelves and forcing brick-and-mortar boutiques to verify the ages of all customers. The bill was referred to Texas’ Trade, Workforce & Economic Development committee earlier this month.

Paxton’s bill would charge online retailers with a Class A Misdemeanor if they don’t verify ages, and would open them up to fines up to $5,000 for each violation.

Paxton did not respond to a request for comment.

Age Verification Laws Drag Us Back to the Dark Ages of the Internet

Invasive and ineffective age verification laws that require users show government-issued ID, like a driver's license or passport, are passing like wildfire across the U.S.

^{Emanuel Maiberg (404 Media)}