Watching leaves logs, not your name; the file begins when an account does. The age check is a second company with its own retention, and “no longer accessible” is not a promise that it is gone.
Identity linked to the most sensitive viewing data. Keep the record.
Age-check and account data can be kept indefinitely, and "deleted" is a claim you cannot verify.
Age laws increasingly force a face scan or government ID to enter.
Industry profile reviewed 23 August 2026. Also machine-readable via the free API.
What leaks is what you watched, tied to a card and increasingly to an ID check. Leaks in this corner have been followed by extortion mail, and accounts people had paid to delete were still in them.
Watching leaves logs, not your name
A visit with no account leaves your IP address, your device and the pages you opened, and most sites pass that trail to outside ad firms. Private mode stops none of it. Sites commonly say they cannot tie those logs to a person, and a request for your data hands them the name they never had.
The account is where the file begins
Sign up or pay and a named file exists: what you watched, searched and paid for, under your email and card, and policies call it data about your sex life. How long it stays after that is their claim: most policies give no number, the rest run from months for logs to years for payment records.
The age check is a second company
Where the law demands proof of age, a separate company runs the check and takes the proof: your face, ID, card or email. The site keeps the result, and its policy commonly says it does not cover the firm holding the proof. Some services shut off whole countries rather than run the checks.
Worked out from the industry, not from any one company. What you actually handed over is yours to record.
The list understates it here: what you watched and paid for is itself a record of your sex life, and their own policies class it that way.
Built only from what this kind of service actually collects. A dimension that the data does not support is not listed.
Viewing history directly reveals orientation and interests.
Age checks capture your face and ID.
Two kinds of hold. LAW SETS IT: a statute makes them keep it. THEY SET IT: a ground the company grants itself.
To prove they checked your age or identity and to block known fraud, sometimes held by a separate verification company.
A legal duty to preserve child-safety reports, which overrides an erasure request for that data.
Money-laundering rules require ID and transaction records after an account closes.
Tax and company law makes them keep billing and payment records.
They can keep records to defend a live or possible legal claim.
The trail has two markets. Ad and tracking firms sit on most free pages, and what you watch feeds the ad targeting inside the sector's own networks. The breach record shows the stakes: leaks here have exposed hundreds of millions of accounts, chats and payment logs, including accounts users had paid to delete, and extortion mail followed.
Viewing and identity data is uniquely sensitive and has been traded.
Behaviour trains recommendation models; the identity link is the danger.
Anonymised is their word, and the stakes are the highest: an age check links your real identity and face to your viewing, and fifteen ordinary attributes already re-identify 99.98% of people (Rocher et al., Nature Communications, 2019).
Fifteen demographic attributes re-identify 99.98% of Americans in a released dataset (Rocher, Hendrickx and de Montjoye, Nature Communications, 2019); date of birth, postcode, and sex alone did it for most people in the first study of the problem (Sweeney, 2000).
Four card transactions identify 90% of people in payment data (de Montjoye et al., Science, 2015).
Language models infer where a person lives, their income, and their sex from their writing alone, at near-human accuracy and at scale (Staab et al., ICLR 2024).
A face, voice, or fingerprint template identifies a person directly; there is nothing left to anonymise, and it cannot be reissued like a password.
Browser and device fingerprints were unique for 84% of visitors in the first large study (Eckersley, 2010), and sparse histories of what people viewed re-identified them against public reviews (Narayanan and Shmatikov, 2008).
THE STUDIES Estimating the success of re-identifications in incomplete datasets using generative models (Nature Communications 10, 3069, 2019)·Simple Demographics Often Identify People Uniquely (Carnegie Mellon University, Data Privacy Working Paper 3, 2000)·Unique in the shopping mall: On the reidentifiability of credit card metadata (Science 347 (6221), 2015)·Beyond Memorization: Violating Privacy via Inference with Large Language Models (ICLR 2024, 2024)·How Unique Is Your Web Browser? (Privacy Enhancing Technologies Symposium (PETS 2010), 2010)·Robust De-anonymization of Large Sparse Datasets (IEEE Symposium on Security and Privacy, 2008)
Think hard before writing to a site you only browsed. Their own policies say a visit with no account cannot be tied to a person, which means the request is the thing that ties it: it hands them a name and an email address for a trail that had neither.
Clauses that recur across this industry, and what each one actually permits.
“to provide and improve our services”
The catch-all purpose. Analytics, profiling, personalisation, and increasingly AI training can all ride under it. When they want to do something new with your data, this sentence usually already covers it.
THE MOVE An objection draws the line: use your data to run the service, not to improve, target, or train on it.
“we do not sell your personal information”
Often technically true, and still misleading. It usually means no cash changes hands. Data can still flow to ad networks, analytics firms, and partners: on their definition, sharing is not selling.
THE MOVE Flip the do-not-sell switch where one exists. The written objection on top of it goes on your record.
“service providers, partners, and affiliates”
How data leaves the building with no name attached. Recipients are listed by what they do, never who they are. You cannot send a request to a company you cannot name, which is the point.
THE MOVE An access request can ask for the recipients by name, not just the categories. UK and EU law put that choice with you. The reply, or the silence, goes on your record.
“aggregated or de-identified information”
Stripping the name does not strip the pattern, and the pattern often still points at you. Policies grant themselves free, indefinite use of this data because in their telling it is no longer about you.
THE MOVE If a deletion comes back as 'anonymised', keep the reply. It is their claim, not a fact you can check.
“retained as long as necessary, or as required by law”
They can keep it for: legal duties, tax rules, fraud prevention, possible lawsuits, their own business reasons. None of them carries a firm end date. Deletion becomes a negotiation, not an event.
THE MOVE Which reasons apply to you, and how long each runs, is a request of its own. Their reply goes on your record.
“you grant us a licence to use your content”
A contract term, not a data setting, so a privacy request cannot undo it. The careful version ends with your account. The broad version can be passed on, never expires, and survives deletion.
THE MOVE Whether the licence ends with the account is written in their terms, not yours. Closing the account goes on your record.
“unless you have created an account, we may not have sufficient information to identify you or respond to your request”
True and convenient at once. The visit logs exist, but nothing ties them to a person, so a request from a viewer with no account goes nowhere.
THE MOVE A request works only where an account exists to point at. From a browse-only visit, it becomes the first record they can put a name to.
“age verification is performed by trusted third-party providers, whose practices this policy does not cover”
The site demands the check and disowns the data in the same breath. Your face, ID or card sits with a company you never chose, kept under that company's own rules, and the site's promises stop at the pass result it receives.
THE MOVE A request to see your data can ask which company got your proof, by name. The reply turns the disclaimer into an address, and the same requests work there.
“if you delete your account, your data and all account related information will no longer be accessible”
No longer accessible to you is not gone. The wording promises the file leaves your view, not their systems, and the exceptions beside it keep email, visit logs, payment and ban records for as long as they judge needed.
THE MOVE A written deletion request asks them to destroy the file, not hide it from you. Their reply, what stayed and why, goes on your record.
Their own policy is the one that binds them. Pin it down with a request, and keep the reply. Start your record →