Cultural Attacks

Over the course of the nearly 30 years, I’ve worked in the adult entertainment industry; I’ve lost count of the number of times I’ve written about and discussed the nature of American obscenity laws. In this new series of articles, “Origins of the War on Porn,” we’ll examine some of the roots of the long-running effort by elements of American society to stamp out pornography, including key pieces of legislation dating back to the late 19^th Century.

One of the most significant of these laws is the Comstock Act of 1873, which criminalized the use of the United States Postal Service to transmit obscene materials. Bear in mind, this was long before the existence of the “Miller Test,” the modern definition of obscenity established by the Supreme Court; as such, much of the material which would constitute a violation of the Comstock Act would strike modern viewers as quite tame.

The Comstock Act was named for Anthony Comstock, a staunch Christian who was born in rural Connecticut, then moved to New York after serving in the Civil War. Comstock was shocked by the city, which seemed to him a place “teeming with prostitutes and pornography,” as PBS put it in profiling Comstock.

Determined to shape the city’s sexual mores to his liking, Comstock began supplying police information on local prostitution operations to assist in their anti-vice efforts. Comstock was also taken aback by ads for contraception devices, so he soon adopted the contraceptive industry as another source of societal ills.

In 1872, Comstock began lobbying in Washington for the passage of an anti-obscenity bill, which would include a ban on contraceptives, which the determined activist had penned himself. He succeeded in his lobbying, and the Comstock Act was attached as a rider to the Post Office Consolidation Act of 1872.

Codified largely at 18 USC §1461 and 1462, the Comstock Act has been amended many times over the decades – as has the legal definitions of terms like “obscene” and “indecent,” which are peppered throughout the statutes. Still, even after these amendments, the core principles of the Act remain in place.

18 USC §1461 still prohibits the use of the U.S. mail to send any “obscene, lewd, lascivious, or filthy book, pamphlet, picture, motion-picture film, paper, letter, writing, print, or other matter of indecent character; or any obscene, lewd, lascivious, or filthy phonograph recording, electrical transcription, or other article or thing capable of producing sound; or any drug, medicine, article, or thing designed, adapted, or intended for producing abortion.” (In 1958, the law was amended to replace “preventing conception” with “producing abortion” in the last line quoted above.)

Comstock himself might be gratified to learn that his namesake law still survives, but he’d likely be aghast at how watered down it has become in its application and definitions. Credit for that reduction in scope and efficacy goes in part to a very different American activist, Margaret Sanger, the founder of Planned Parenthood who successfully challenged the Comstock Act when she opened the first birth control clinic in the country.

Of course, you are familiar with Sanger, you know her legacy as an advocate for women’s rights is complicated by her beliefs on eugenics, which in recent years have been used as a means for social conservatives to attack the organization she founded. Planned Parenthood has disavowed Sanger’s stated beliefs, noting as they did so that “today, anti-reproductive rights activists continue to attack Sanger as a strategy to undermine the crucial services Planned Parenthood currently provides.”

As both Comstock and Sanger demonstrate, the battles that underpin the War on Porn (as well as what many people have termed the “War on Women”) have their roots in debates and disagreements far older than anyone reading this article. Over 150 years after the Comstock Act was established, the issues that animated it are as contentious as they were in Comstock’s time.

Proof of the continuing influence of the Comstock Act and the man for whom it is named can be found in articles like this one from the Kaiser Family Foundation, titled “The Comstock Act: Implications for Abortion Care Nationwide,” published in 2024. Among other things, the article notes the Comstock Act “could be used by a future presidential administration opposed to abortion rights to sharply restrict abortion nationwide.” (President Trump declining to do exactly that angered some of his supporters not long after the KFF article was published).

Echoes of the Comstock Act also can be found in the ongoing effort to restrict access to online porn, or in more extreme cases, ban porn altogether. As these efforts demonstrate, Anthony Comstock might be long gone, but there are many folks happy to walk in his footsteps – and to become the next foot soldiers for their side of the War on Porn.

WASHINGTON — The Internal Revenue Service on Monday issued final regulations implementing the “No Tax on Tips” provision of the “One Big Beautiful Bill Act,” establishing new tax deductions for certain workers who receive tips while excluding income tied to “pornographic activity.”

The regulation, titled “Occupations That Customarily and Regularly Receive Tips; Definition of Qualified Tips,” states: “Amounts received for prostitution services and pornographic activity are not included in the definition of ‘qualified tips.’”

Following the enactment of the legislation last year, the IRS developed rules to carry out the provision allowing taxpayers in occupations that “customarily and regularly” receive tips to deduct up to $25,000 annually in tip income. After a public comment period, the agency finalized both the list of eligible occupations and the criteria governing which tips qualify for the deduction.

The finalized “List of Occupations That Receive Tips” includes “digital content creators,” and the regulation offers additional clarification for that category. However, the rule specifies that tips connected to “pornographic activity” are not eligible for the deduction, without defining the term.

The IRS acknowledged that several commenters raised concerns about the exclusion and the lack of a clear definition.

“In addition to noting that certain pornography is legal, some commenters stated that pornography is protected First Amendment speech, that these businesses pay taxes, and that in fairness these businesses and their employees should have access to the deduction for qualified tips,” the regulation states. “One commenter suggested the prohibition be limited to activity that is unlawful under State or Federal law. Several commenters requested that the regulations define pornographic activity.”

A submission from the Free Speech Coalition argued that the exclusion of “pornographic activity” is the only categorical restriction in the rule not tied to unlawful conduct and noted that pornography is not formally defined as a category of speech under the law.

“This makes it impossible to determine whether a performance or work that generates tips is eligible for tax exemption,” the group wrote. “If content creators provide material or performances for which they can be tipped, how is it determined whether the content is ‘pornographic?’ If the material depicts genital stimulation, is it ‘pornography?’ If the material depicts no nudity, but the speaker is speaking about sex, is it ‘pornography?’ If the speaker is wearing translucent, or even transparent clothing, but speaks of investments and not sex, is it ‘pornography?’”

The group added that, without a precise definition, the rule creates “unconstitutional discretion” in determining which income qualifies for the deduction.

“Under the proposed rule, the regulations will create an environment where enforcement will inevitably be arbitrary; disputes regarding the categorization of income as having been generated by ‘pornographic activity’ will be constant; and litigation will be chronic,” the comment states. “Every taxpayer whose tip exclusion is rejected under this regulatory category will have a valid constitutional challenge to the rejection.”

The regulation notes that the Treasury Department and the IRS “will consider whether to provide additional guidance regarding these exclusions.” In the meantime, the agency stated that it “intends to interpret the occupations on the list in a fair and impartial manner consistent with their commonly understood meaning.”

The IRS said the exclusion for pornographic activity is “intended to address the potential for greater noncompliance and abuse with respect to these activities and services.”

The provision has drawn comparisons to broader federal policy discussions regarding access to financial services for certain industries. A 2025 executive order directed financial institutions not to restrict services based on lawful business activities, and subsequent reports and agency actions have addressed the use of “reputation risk” in regulatory oversight.

Federal agencies, including the Office of the Comptroller of the Currency and the Federal Deposit Insurance Corporation, have taken steps to eliminate “reputation risk” as a supervisory factor, while the Federal Trade Commission has cautioned payment processors against denying services based on lawful but higher-risk classifications.

It remains unclear how those policy positions may affect adult-oriented businesses and content creators under the new tax framework. Several agencies and financial institutions have not publicly addressed how the rule will be applied in practice.

The Free Speech Coalition also published an analysis of the regulation by Katherine Studley, a consultant who works with industry professionals on tax and business matters. The analysis attributes the exclusion to advocacy efforts by conservative and religious organizations.

“No acknowledgement that these are legal businesses operated by legal workers who have been paying their taxes,” Studley wrote. “The same businesses who are good enough to tax are apparently not entitled to the same tax relief as everyone else.”

Studley noted that the rule does not exclude individuals based on occupation alone and that eligibility may depend on the nature of the content associated with the tips.

“Adult creators are not banned as a category of person and the tip is tied to the content,” she wrote. “This is advantageous for creators operating across multiple platforms and producing mixed content.”

The “No Tax on Tips” provision is scheduled to remain in effect for four years and is set to expire on Dec. 31, 2028. Lawmakers may revisit or revise the measure before that date.

LOS ANGELES — A routine trip to an awards show turned into a life-altering moment for GayVN Award-winner Milo Miles, who was detained by U.S. Customs and Border Protection at a Canadian airport earlier this year and is now barred from entering the United States for at least a decade.

Miles, who ultimately won at the 2026 GayVN Awards, had been traveling to attend and present at the ceremony when he was stopped in January. Despite the win, he cannot return to the United States unless government authorities grant special permission.

The Toronto-based performer, originally from Medellín, Colombia, has built a strong presence in the industry, earning multiple nominations at the 2026 GayVNs and taking home Best Oral Scene as part of an ensemble cast in the Carnal+ Original production Deeper Deep Throat. He moved to Canada with his family as a child, leaving behind a country affected by cartel violence and political instability.

“I was detained in Toronto at preclearance,” Miles said in a phone interview. He had been scheduled to depart from Toronto Pearson International Airport, one of several Canadian hubs where U.S. agents screen travelers before departure.

The preclearance system allows U.S. officers to conduct inspections on foreign soil before passengers board flights bound for the United States, effectively shifting the border to the departure airport.

Miles said that process often involves armed officers and determines whether travelers are allowed entry before they ever leave Canada. Those cleared typically arrive in the United States as domestic passengers, bypassing customs lines. He added, “Being Latino, an adult content creator, I had heard that people had been banned in the past.

“So, I hired immigration lawyers,” he continued. “It was two or three years ago. … They all said the same thing: there’s not really a way” to legally work in the United States doing porn, “unless you marry someone and get a green card.

“It was explained to me like this: ’If a border agent found out that I did porn, that would fall under the category of sex work. And to them, sex work equals prostitution. After Trump got elected, the concern kind of started growing even more about this, I was told.”

Aware of those risks, Miles said he took steps he believed would reduce scrutiny, including enrolling in the NEXUS trusted traveler program, which is designed to speed up border crossings between Canada and the United States.

“I’ve had this for many years now,” Miles said. “It’s supposed to streamline the process of crossing the border because we have to pre-check with Canada, at least at the airport here in Toronto at Pearson. However, especially in the last year, I’ve noticed that whenever I cross, there seem to be more questions than usual being asked, even though it’s normally supposed to be a straightforward process because of the facial recognition software.”

Miles, who holds dual citizenship in Canada and Colombia, lives in Toronto and has frequently traveled to the United States for work, including film shoots and collaborations. He said he spent eight hours over two days at the preclearance station before being told he would be denied entry under allegations tied to unlawful activity.

According to documents issued by the U.S. Department of Homeland Security and Customs and Border Protection, Miles was found inadmissible based on claims that he had engaged in prostitution, a conclusion he disputes in the context of his work in adult film production.

The documents include a transcript of questioning in which an officer pressed him on whether his work constituted prostitution, despite distinctions commonly drawn between adult film production and escorting.

Miles acknowledged during questioning that he had previously worked as an escort, describing it as consensual arrangements between adults in which he was compensated for his time.

U.S. law grants border officials broad discretion to deny entry, regardless of a traveler’s history or intended duration of stay.

“You appear inadmissible to the United States … in that you are an alien who is coming to the United States to engage in prostitution or has engaged in prostitution within ten years of the date of application for a visa, admission, or adjustment of status,” the official notice states. “You are currently engaging in prostitution or were coming to the United States to engage in prostitution.”

Miles said his purpose for traveling was to attend the GayVN Awards, but the determination resulted in a ban that will remain in effect until 2036.

“The one thing that I think kept me grounded throughout the whole experience, even though I knew where things were headed, was knowing that I was very thankful that this was happening in Toronto,” he said. “Regardless of what happens at this airport, I’ll still be able to go home and sleep in my own bed and to know that I’ll still have that fundamental freedom that God gave to Canada.

“It’s a very unfortunate thing,” Miles said, referencing his partner, a U.S. citizen, and the disruption to his plans to build a career in the United States. Reflecting on the experience, he added, “It’s more of, like, a psychotic attack. Even though I was clearly dealing with agents who didn’t seem to care about equity, diversity or inclusion, and who came across as homophobic, it wasn’t just about those individuals.

“This appears to be a systemic bias and a broader issue within the department, though not necessarily across the entire federal government,” he concluded.

WASHINGTON — Federal banking regulators on Tuesday finalized a rule removing “reputation risk” as a factor in supervising financial institutions.

Under the new rule, the Office of the Comptroller of the Currency and the Federal Deposit Insurance Corporation are barred from “criticizing or taking adverse action against an institution on the basis of reputation risk.” The rule also bars the agencies from “requiring, instructing, or encouraging an institution to close an account, to refrain from providing an account, product, or service, or to modify or terminate any product or service” based on a customer’s political, social, cultural or religious views, constitutionally protected speech, or lawful business activity viewed as presenting reputation risk.

The action follows an Aug. 7, 2025, executive order directing financial institutions not to deny or limit services to customers engaged in lawful activities on political grounds.

After that order, the OCC released a report on debanking that identified several sectors facing account closures or service restrictions, including the adult entertainment industry, citing concerns among banks about alignment with internal standards.

In March, Federal Trade Commission Chairman Andrew Ferguson issued warnings to payment processors such as PayPal, Stripe, Visa and Mastercard regarding practices that restrict access to services based on lawful but higher-risk activities.

The impact of the rule on industries that have reported difficulties accessing banking services remains uncertain. Although the OCC report identified adult entertainment as one of the affected sectors, regulators have not provided additional detail on how the new rule will be applied in practice.

While the rule prevents the OCC and FDIC from penalizing institutions for serving customers engaged in “politically disfavored but lawful business activities perceived to present reputation risk,” it does not limit banks’ ability to make decisions based on other supervisory considerations, including “safety and soundness.” Institutions may continue to restrict services under those criteria.

The Free Speech Coalition submitted comments in support of the proposed rule and recommended expanding its scope to apply more directly to banks. Those proposals were not adopted in the final version.

“The rule removes a key driver of banking discrimination against the adult industry,” said Free Speech Coalition Executive Director Alison Boden. “Federal examiners can no longer pressure banks to close accounts or deny services to lawful businesses based on reputation risk. It’s not going to solve all of our problems, but it’s a necessary piece of securing fair banking access for our industry.”

WASHINGTON — Federal Trade Commission Chairman Andrew Ferguson sent letters Thursday to the chief executives of PayPal, Stripe, Visa and Mastercard, warning against debanking practices, including denying access to financial services based on a customer’s lawful business activities.

“It is inconsistent with American values to deny law-abiding individuals the ability to run their legitimate businesses and feed their families because they attracted the ire of rogue American officials, overzealous activists, or, more worryingly, foreign governments seeking to control public discourse,” the letters state. “That is why President Trump’s August 7, 2025, Executive Order on debanking makes clear that it is unacceptable to debank law-abiding citizens due to ‘political affiliations, religious beliefs, or lawful business activities.’”

The executive order prohibits banks, savings associations, credit unions and other financial service providers from restricting access to accounts, loans or other services based on a customer’s lawful business activities that the institution may disagree with or view unfavorably for political reasons.

Following the order, the Office of the Comptroller of the Currency issued a report on debanking that identified several sectors, including adult entertainment, as facing potential discrimination due to activities considered inconsistent with certain financial institutions’ values.

Ferguson’s letters state that companies engaging in deplatforming or denying services to such customers could face Federal Trade Commission investigations and possible enforcement action.

Possible Pressure on Banks via Card Brands

The letters to Visa and Mastercard also reference the role of payment networks and providers, noting concerns about financial institutions that restrict access to services for these reasons. Ferguson wrote that it is “critical” for card networks not to allow unlawful debanking by member institutions, including banks that process transactions on their systems.

“Consumers cannot reasonably avoid this harm, particularly where, as is almost always the case, the First Amendment-protected activity that triggered the adverse action against them had no logical connection to, or material bearing on, their commercial relationship with the payment provider or network,” Ferguson wrote.

The letters suggest that payment networks may play a role in addressing practices by financial institutions that deny services under these circumstances.

The potential for additional oversight comes as questions remain about the extent of regulatory action from banking agencies, including the Federal Deposit Insurance Corporation and the National Credit Union Administration.

Proposed rules would restrict those agencies from taking action against institutions for providing services to individuals or businesses engaged in lawful activities that may be viewed as presenting reputational risk. However, those rules would still allow banks to make decisions regarding customers based on considerations tied to safety and soundness.

It remains unclear how enforcement priorities will be applied across different industries, including those identified in prior regulatory reports.

When champion skier Lindsey Vonn experienced a terrible crash on what turned out to be her final run in the women’s downhill skiing event at the Winter Olympics in Milan earlier this month, maybe there were a few people out there thinking she shouldn’t have been permitted to take the risk of running the race, given that she already had a torn ACL injury in her left knee. But if a significant number of people felt that way, they seem to have kept it to themselves, for the most part.

Instead, the dominant reaction to Vonn’s knowing acceptance of added risk rightfully has been to praise her bravery, determination and champion spirit. As Madison Chapman wrote for Newsweek, “Winner or not, Vonn is the ideal Olympic champion. Her grit and resilience helped me shed my own fear of risk and learn to see myself as a champion over adversity after my cancer treatment and subsequent knee injury. She may not have clinched gold, but Lindsay Vonn reminded us all how to live.”

I’ve always been fascinated by the way people view the act of taking a physical risk, be it in the context of competitive skiing, climbing a mountain or something as fundamental managing one’s personal health. I’ve long believed that the question of whether something is safe to do is a different question than whether ought to be allowed to do it. As I see it, it’s not complicated; adults should be allowed to take informed risks – including a litany of risks I would never take, myself.

Doubtlessly, one reason Vonn found so much support for her decision is the competitive context. She was attempting to win a gold medal, an achievement for which there’s a very limited window of opportunity, one that only comes around every four years – and only for so many cycles in an athlete’s career.

Make no mistake, though; the reason Vonn’s decision, the Olympic Games themselves and Vonn’s injuries are global news is because sports are popular entertainment – and big business.

In other words, while we support Vonn’s chosen form of risk taking because competition is deemed a worthy enterprise by a significant portion of the human population, we also support it because we accept, at least in the context of sport, that people have a right to risk bodily harm in the process of entertaining other people.

We’re not consistent about this acceptance of risk for entertainment’s sake, of course. The response to people taking risks in the context of porn is less enthusiastic. Sometimes it inspires proposals specifically designed to deter peoplefrom plying their trade in adult entertainment.

I’m not saying I think social media should light up with words of encouragement every time a porn star gets nominated for an award, or when an adult content creator releases a new clip (although that would be nice). But maybe, if society can applaud people for risking grievous bodily harm while competing on the Olympic stage, society can at least also manage to avoid shaming people and subjecting them to paternalistic government regulation when the risks they take involve other, less celebrated forms of entertainment.

It starts with a quiet email. No warning. No phone call. Just a notice that your account is under review—or worse, closed.

That’s what’s happening to women’s health and sexual wellness companies across the United Kingdom and Europe. Not because they’ve broken laws. Not because they’ve done anything shady. But because somewhere in a compliance department, someone ticked the wrong box and labeled them “adult content.”

New research from two U.K.-based advocacy groups, CensHERship and The Case For Her, digs into what’s really going on. And it’s uncomfortable reading. The report argues that women’s health innovators are being misclassified in financial systems, triggering debanking and account shutdowns that can stall or even sink young companies.

“What we find is that misclassification, over-compliance, cultural discomfort, and outdated policy language combine to create structural barriers for women’s health innovation, and that the identified structural barriers tend to fall into two forms,” the research explains.

Those two forms? “Misclassification” and “misunderstanding.”

Misclassification is described as “where women’s health and sexual wellbeing are misread as adult content. This is the most visible and well-documented form of bias.”

Misunderstanding, on the other hand, is “where women’s health is overlooked as too new, complex, or unfamiliar to fit existing risk templates. These cases are harder to surface because they are often resolved quietly or never formally recorded.”

That second one hits differently. It’s the kind of bias that doesn’t shout. It just shrugs. Too new. Too complex. Too awkward. Next.

Some of the companies affected are household names in the space, including SheSpot, a widely recognized brand. These aren’t fringe operators. They’re mainstream wellness businesses trying to build products around bodies that, frankly, have been underserved for generations.

The report goes further: “Because most financial institutions have never explicitly defined women’s health or FemTech within their risk frameworks, systems default to the nearest analogue—typically adult content, vice categories, or other ‘sensitive’ sectors.”

That line sticks. Systems default. That’s how it happens. No villain twirling a mustache. Just outdated templates and risk models built in eras when women’s sexual health was barely discussed in polite company. So instead of creating a new category, institutions drag these companies into old ones—adult content, vice, high-risk.

It’s lazy. It’s structural. And it’s expensive.

Both CensHERship and The Case For Her argue that outdated classification systems, cultural discomfort, and unconscious bias are creating real barriers to growth. Being labeled “adult content” or “adult services” doesn’t just sound insulting—it places these businesses in a “high-risk sector” alongside firearms manufacturing and tobacco cultivation and marketing.

Think about that for a second. A company developing pelvic health tools or hormone-tracking tech ends up sitting in the same risk bucket as cigarette production.

This isn’t just semantics. Risk labels determine whether you can open a bank account, process payments, attract investors, or scale internationally. When the system quietly decides your innovation is morally adjacent to vice, you feel it everywhere.

Honestly, it raises a bigger question: if financial institutions can’t tell the difference between sexual wellness and adult entertainment, what does that say about the frameworks we’re still operating under?

Maybe the real issue isn’t that women’s health is “too new.” Maybe it’s that the systems judging it are too old.

A federal judge quietly slammed the brakes this week on a pair of lawsuits that were meant to test Kansas’ age-verification law — and in doing so, reminded everyone that the internet doesn’t neatly respect state lines, no matter how badly lawmakers might want it to.

Last year, a conservative anti-pornography group brought lawsuits against four adult websites on behalf of a 14-year-old Kansas resident and her mother. Two of those suits went after Titan Websites, which runs HentaiCity.com, and ICF Technology, which operates Jerkmate.com. The core claim was simple and familiar by now: the teenager allegedly accessed content on the sites without her age being verified.

But Judge Holly Teeter of the U.S. District Court for the District of Kansas wasn’t persuaded. She dismissed both cases outright, pointing to something that often gets lost in the political noise — jurisdiction still matters.

In the case against Titan Websites, Teeter ruled that the plaintiffs failed to show HentaiCity.com had “purposefully directed its activities at Kansas.”

“The contacts between Defendant and the forum were not due to discriminating, intentional conduct that targeted Kansas,” Teeter wrote. “Rather, they were the random, and fortuitous contacts inherent in the operation of an indiscriminate and universally accessible website … This is insufficient to support the exercise of specific personal jurisdiction.”

If you’ve ever run a website, that language probably lands with a thud of recognition. The internet is global by default. You don’t wake up deciding to “target Kansas” unless you’re buying billboards off I-70 or running a very specific ad campaign. Sometimes a click is just a click.

In a statement, the Free Speech Coalition welcomed the decision as a meaningful step forward.

“As the first age verification case filed by a private plaintiff to reach final resolution, the ruling suggests that private plaintiffs can lack personal jurisdiction to sue out-of-state website operators under the Kansas statute,” the statement reads.

The organization’s executive director said the ruling offers “critical guidance” for platforms trying to navigate age-verification laws in Kansas and beyond — a legal patchwork that’s getting harder to track by the month.

“While not precedent-setting, nor necessarily applicable in every case, the District Court’s ruling is an important victory against state laws enforced by private rights of action,” said Boden. “In the meantime, the threat of litigation is real, and we encourage our members to continue to comply with all applicable laws.”

That last part matters. This wasn’t a mic-drop that ends the conversation forever. The plaintiffs still have the option to appeal, and the broader legal fight is far from over.

Two other cases backed by the same group are still winding their way through the system. In the lawsuit against Multi Media LLC, which operates Chaturbate.com, the judge granted a motion to compel arbitration and paused the case while that process plays out. In the case against Techpump Solutions, which runs Superporn.com, the court hasn’t yet ruled on a motion to dismiss for lack of jurisdiction.

So yes, one door just closed — but plenty of others remain cracked open. And if there’s a lesson here, it’s this: the battle over age verification isn’t just about who clicks what. It’s about where the law thinks the internet actually lives.

There’s something quietly disturbing about discovering that a tool meant to help people wrestle with their most private habits accidentally left the blinds wide open. An app that claims to help users stop consuming pornography ended up exposing intensely sensitive personal data — the kind of stuff most people wouldn’t even admit to a close friend. Ages. Masturbation frequency. Emotional triggers. How porn makes them feel afterward. And tucked inside that data were a lot of minors, which makes your stomach drop a little when you really sit with it.

One user profile, for instance, listed their age as “14.” Their “frequency” showed porn use “several times a week,” sometimes up to three times a day. Their “triggers” were logged as “boredom” and “Sexual Urges.” The app had even assigned a “dependence score” and listed their “symptoms” as “Feeling unmotivated, lack of ambition to pursue goals, difficulty concentrating, poor memory or ‘brain fog.’” It reads less like analytics and more like a vulnerable diary entry — something that was supposed to stay locked away.

The app isn’t being named because the developer still hasn’t fixed the issue. The problem was uncovered by an independent security researcher who asked to remain anonymous. He first flagged it to the app’s creator back in September. The creator said he’d fix it quickly. That didn’t happen. The flaw comes from a misconfiguration in how the app uses Google Firebase, a popular mobile app development platform. By default, Firebase can make it surprisingly easy for anyone to become an “authenticated” user and access backend storage — the digital attic where all the private boxes tend to live if you’re not careful.

Overall, the researcher said he could access information belonging to more than 600,000 users of the porn-quitting app, with roughly 100,000 identifying as minors. That number lands heavy. It’s not abstract. It’s classrooms. It’s school buses. It’s kids who probably assumed they were talking into a void, not a wide-open window.

The app also invites users to write confessions about their habits. One of them read: “I just can’t do this man I honestly don’t know what to do know more, such a loser, I need serious help.” You can almost hear the frustration in that sentence — the messy spelling, the emotional spill. That’s not data. That’s a human having a rough night.

When reached by phone, the creator of the app said he had spoken with the researcher but claimed the app never exposed any user data due to a misconfigured Google Firebase. He suggested the researcher may have fabricated the data that was reviewed.

“There is no sensitive information exposed, that’s just not true,” the founder said. “These users are not in my database, so, like, I just don’t give this guy attention. I just think it’s a bit of a joke.”

When asked why he previously thanked the researcher for responsibly disclosing the misconfiguration and said he would rush to fix it, he wished me a good day and hung up. One of those conversations that ends abruptly, leaving a strange quiet buzzing in the room.

After the call, an account was created on the app. The researcher was then able to see that new account appear inside the misconfigured Google Firebase environment — confirmation that user information was still exposed and accessible. Sometimes reality has a way of answering arguments faster than any debate ever could.

This type of Google Firebase misconfiguration isn’t new. Security researchers have been talking about it for years, and it continues to surface today. It’s one of those problems that feels boring until it suddenly isn’t — until someone’s real life data is sitting out in the open.

Dan Guido, CEO of cybersecurity research and consulting firm Trail of Bits, said in an email that this Firebase issue is “a well known weakness” and easy to find. He recently noted on X that Trail of Bits was able to build a tool using Claude to scan for this vulnerability in just 30 minutes.

“If anyone is best positioned to implement guardrails at scale, it is Google/Firebase themselves. They can detect ‘open rules’ in a user’s account and warn loudly, block production configs, or require explicit acknowledgement,” he said. “Amazon has done this successfully for S3.” S3 is a cloud storage product from AWS that previously struggled with similar data exposure issues due to misconfigurations.

The researcher who uncovered the app’s vulnerability added that this insecure setup is often the default in Google Firebase. He also pointed a finger at Apple, arguing that apps should be reviewed for backend security issues before being allowed into the App Store.

“Apple will literally decline an app from the App Store if a button is two pixels too wide against their design guidelines, but they don’t, and they don’t check anything to do with the back end database security you can find online,” he said. It’s one of those comments that lands with an uncomfortable kind of truth — polished surfaces, shaky foundations.

Apple and Google did not respond to requests for comment.

And that’s the part that lingers. People trusted this app with their most awkward truths, their late-night regrets, their quiet attempts at self-control. Some of them were kids. They weren’t posting for an audience. They were whispering into what they thought was a locked room. Turns out the door was never really closed.

A lawsuit filed in Pennsylvania alleges that NoFap founder Alexander Rhodes was targeted in a years-long civil conspiracy involving Aylo (Pornhub’s parent company), UCLA, scientists Nicole Prause and David Ley, and academic publisher Taylor & Francis. Rhodes claims the defendants coordinated to silence and discredit him and NoFap by portraying the group and some of its members as aligned with extremist or pseudoscientific beliefs, and by promoting research asserting that pornography is not addictive and that NoFap is not an effective treatment. The suit casts Aylo as the central player in this alleged scheme, pointing to its legal efforts against state laws regulating porn and its ties to Ley as an expert witness, although the filing acknowledges no evidence that Aylo paid Prause or otherwise directly funded the researchers’ work.

The complaint seeks apologies, retractions, and gag orders and names dozens of journalists and other commentators whose largely factual reporting about NoFap is labeled defamatory. It frames the case not as a cultural debate but as a sweeping claim of disinformation, exploitation, and racketeering aimed at critics of the porn industry, while also accusing Taylor & Francis of trademark dilution and UCLA of aiding the alleged plot through employment of Prause. Observers note the contradiction between these claims and established academic and professional positions—such as the APA’s stance that pornography addiction is not a recognized diagnosis—raising questions about the lawsuit’s breadth and its implications for journalism and scientific inquiry.

NoFap Founder Sues Aylo, UCLA, Scientists & Academic Publisher AVN

Aylo leads a class of defendants in a state-level defamation lawsuit brought by the founder of NoFap, a controversial anti-pornography group.

Read More