Age policy

The requirement

Some of the portraits on this site are explicit. To see them you must be 18 or older, or older than that if the age of majority where you are is higher.

Every person depicted anywhere on this site is fictional, computer-generated, and generated as an adult. Nothing here depicts a minor, and anything that reads as ambiguous is deleted rather than published. That rule is absolute and it is written out in the content policy.

How the gate works

The first time a page would show you something explicit, a dialog asks whether you are 18 or older. It has two buttons: confirm, or ask for the safe-for-work portfolio instead.

Confirming writes two cookies. One of them, av, is HttpOnly — your browser cannot read it and neither can any script on the page. It is the only thing the image server checks before it hands out an explicit file. The other, avc, is readable and does nothing but tell the interface which of the two things to draw.

That distinction is the whole point. Before you confirm, an explicit picture is not blurred or hidden with CSS — it is not in the page at all. The markup contains a tiny colour placeholder and a badge, no image address, and nothing is requested from the server. Editing the readable cookie in your browser reveals nothing, because the request for the pixels still comes back empty.

The assertion is a self-declaration. I am not asking anyone to upload identity documents, and I do not use an age-verification vendor. Where a self-declaration is not sufficient under local law, I do not serve explicit content at all — see below.

Countries that require verified age

The United Kingdom, France, Germany and Italy require pornographic services to use age assurance that a checkbox does not satisfy. Rather than run identity checks I have chosen not to serve explicit content into those countries at all.

For a request that arrives from one of them, explicit images are excluded from every listing before the page is built, the image server refuses the files even with a valid age cookie, and the age dialog and the safe-for-work toggle are not drawn — there is nothing to unlock, so there is no control that would imply there is. The site simply is the safe-for-work site there.

The country is worked out in memory from the IP address your request arrives on, against a local copy of MaxMind's country database. The address is not stored and neither is the result. If the address is not in the database, no restriction is applied — a lookup that fails should not turn the site off for everyone it cannot place.

Choosing the safe-for-work portfolio

The second button in the dialog, and the "Explicit" control in the footer, set a preference cookie called sfwo. With it set, explicit rows are left out of every query the site runs, so a safe-for-work page has nothing in it to filter client-side. It is reversible from the footer at any time.

Labelling

Pages that actually contain explicit work carry the RTA label, which is what parental-control and filtering software looks for:

RTA-5042-1996-1400-1577-RTA

It is applied per render rather than site-wide. The same address fetched from a country where explicit work is not served, or by someone who chose the safe-for-work portfolio, contains no explicit row — and labelling that page would be a false statement. Explicit image files are additionally served with a noindex header of their own.

Written record of the age-assurance approach

A short summary of what is done and why, kept here so it is a record rather than a recollection.

• What the service is: a one-person portfolio of AI-generated portraits. There are no user uploads, no comments, no messaging between visitors, no live streaming and no user-generated content of any kind. Everything published is published by me.
• What the risk is: that someone under 18 sees explicit images, and that a visitor encounters content depicting a minor. The second risk is addressed by not producing or publishing such content at all — see the content policy — and by reviewing every image by hand before it is published.
• What is done about the first risk: explicit images are withheld until an age assertion is made, and the withholding is enforced at the server rather than in the interface. In countries whose law requires highly effective age assurance, explicit content is not served at all, so the question of whether a self-declaration is effective enough does not arise.
• What is not done: no identity documents, no facial age estimation, no third-party verification provider, and no attempt to profile visitors. Adding one would mean collecting far more about people than this site currently knows, and the alternative — not serving the content — is available.
• Everything explicit is fully synthetic. No real person is depicted, so no real person can be harmed by its distribution, which is a different position from that of a site hosting photographs of people.
• When this is revisited: whenever the law changes, whenever the site gains a feature that changes the risk picture (accounts with uploads, comments, anything user-to-user), and otherwise at least once a year.

Related

Content policyAI disclosurePrivacy