by Hailey Cummiskey
Introduction
Louisiana residents need not be tech-savvy to be familiar with LA Wallet, a fairly new application for both Apple iOS and Android that is now a lawful form of identification in the form of a digital driver’s license. The app’s origins can be traced to 2016, when Louisiana State Representative Ted James introduced House Bill 481, which the Louisiana legislature passed with Act 625, making Louisiana the first state to offer a legal, digital driver’s license.[1] Developed in 2018 primarily by the Louisiana Office of Technology Services and the Office of Motor Vehicles in partnership with Envoc, the LA Wallet app is a convenience to citizens and law enforcement alike, with over 1.4 million active users to date— nearly a quarter of Louisiana’s total population.[2] Gone are the days of not being able to walk into a bar because of the common slip up of leaving a wallet at home or losing a purse. So long as the patrons have their phone on their person, vendors can simply use LA Wallet’s “real-time age verification” instead of turning them away for forgetting to bring their license.[3] Further, the Louisiana State Police accept LA Wallet as valid proof of licensure, saving Louisiana drivers from having to scramble around their cars for an ID.[4] Recent expansions of LA Wallet’s reach, however, raise some concern about the safety of personal information contained in the app, particularly within the realm of online pornography.
I. LA Wallet: How The App Works
The free app is quite simple to download and use: after visiting the App Store and clicking “Install,” users are prompted to create an account before agreeing to LA Wallet’s Terms and Conditions of Use.[5] The Terms and Conditions notably state that the user “acknowledge[s] that when you download, install, access or use the LA Wallet Application you are accepting the risks and responsibilities associated with storing your Digital Driver’s License on a mobile device.”[6] The user is also required to
acknowledge that when you download, install, access or use the Application, Company may use automatic means (including, for example, cookies and web beacons) to collect information about your Device and about your use of the Application. . . . All information we collect through or in connection with this Application is subject to our Privacy Policy.[7]
LA Wallet’s Privacy Policy reads, in part, as follows:
We take reasonable steps to protect the User Data provided via the Application from loss, misuse, and unauthorized access, disclosure, alteration, or destruction, including through restriction of access to User Data to our employees, contractors, agents, and consultants who need to know that information in order to operate, develop, or improve the Application. These steps include internal reviews of our data collection, storage, and processing practices and security measures, as well as physical security measures to guard against unauthorized access to systems where we store User Data. However, no Internet or e-mail transmission is ever fully secure or error-free.[8]
Once a user successfully creates an account, he or she can utilize the application to legally identify his or her age. LA Wallet utilizes “VerifyYou” technology, developed and trademarked by Envoc, which scans the user’s credential through the app and validates it directly by the OMV database.[9] Those seeking to verify a user’s information can rely on being 100% accurate, since a new randomized QR code displays over a picture of the user that changes every second.[10] Other LA Wallet users can scan that QR code, and the other users will receive information from the user who is presenting their identification “within seconds.”[11] The information available through LA Wallet is identical to the information displayed on a physical driver’s license: the user’s full name, address, birthday, and photo, along with the other miscellaneous items on a typical driver’s license.[12] LA Wallet maintains that what a verifying party can see about the presenter is only the information the presenter allows to be communicated.[13]
LA Wallet’s reach is ever-expanding as more businesses and entities opt in to allowing customers and users to utilize the application for verifying personal information. As of October 26, 2018, Louisiana residents have been able to use LA Wallet for their official form of identification when voting.[14] Customers of home-delivery services can use LA Wallet to prove their identity when receiving packages, while delivery employees can use the app to prove their identities to potentially suspicious customers.[15] LA Wallet’s VerifyYou technology was even used in aiding disaster relief to residents affected by Hurricane Laura through the Disaster Supplemental Nutrition Assistance Program (DSNAP).[16] Further, the Louisiana Supreme Court adopted VerifyYou to verify citizens’ identities who appear in court remotely.[17] Hunting and fishing licenses were added to LA Wallet in 2021 through the Louisiana Department of Wildlife and Fisheries.[18] LA Wallet’s most notable expansion to date happened during the peak of the COVID-19 pandemic, partnering with the Louisiana Department of Health in May 2021 to display a user’s vaccination status.[19]
II. Louisiana House Bill 142 Introduces LA Wallet Verification Requirement for Access to Pornography
The latest expansion of LA Wallet’s reach should not come as a surprise for viewers of online pornography: as of January 2023, Louisiana House Bill 142 requires sites comprised of 33.3% pornographic content or more to verify that their users are 18 years old or older.[20] Pornhub now requires users in Louisiana to present a government-issued ID for access.[21] Upon entering the website, Louisiana users of Pornhub are now presented with a screen that asks users to verify their age through third party AllpassTrust with LA Wallet. New users must either exit the website or click “Check my age,” which transfers the user to the AllpassTrust website where the user then either creates an account or logs in with an existing Pornhub account.[22] According to its website, AllpassTrust assures users that no data or information is relayed from LA Wallet other than a simple notification that the user is 18 years of age or older.[23]
Legislators in support of HB 142 cite child safety as the main motivation for passing the bill, while also shining light on the fact that heightened pornography use due to ease of online access to pornographic material is a growing concern.[24] HB 142 goes further to provide legal consequences for an entity that “knowingly and intentionally publishes or distributes material harmful to minors on the internet from a website that contains a substantial portion of such material” and that they “shall be held liable if the entity fails to perform reasonable age verification methods to verify the age of individuals attempting to access the material.”[25] The civil remedy available to minors affected by such violation include damages with court costs and reasonable attorney fees.[26] HB 142’s legislators contemplated the potential problem of using the LA Wallet application on such websites, which would mean that users are providing pornographic websites with their full name, date of birth, and photo—clear, obvious evidence of their identity on a taboo website. HB 142 states that a commercial entity or third party who complies with its age verification law “shall not retain any identifying information of the individual after access has been granted to the material.”[27] Further, an entity that violates this policy and “knowingly retain[s] identifying information of the individual after access has been granted to the individual shall be liable to the individual for damages resulting from retaining the identifying information,” including court costs and attorney fees.”[28]
III. Potential Privacy and Data Security Implications
Since Louisiana citizens are the sole users of the LA Wallet app, it follows that Louisiana’s data security laws apply. Louisiana Revised Statutes § 51:3071, et seq. sets out the laws applicable to a potential breach in security of personal information.[29] Under the title “Database Security Breach Notification Law,” the law states that persons or agencies who conduct business in Louisiana or license computerized data that includes personal information “shall implement and maintain reasonable security procedures and practices appropriate to the nature of the information to protect the personal information from unauthorized access, destruction, use, modification, or disclosure” and “shall take all reasonable steps to destroy or arrange for the destruction of the records within its custody or control containing personal information that is no longer to be retained by the person or business.”[30] Persons and entities subject to these laws are required to notify any Louisiana resident when an unauthorized person acquires his or her personal information following discovery of a breach in the security system containing personal data.[31] Under § 51:3075, persons affected by a failure to notify of data breaches are entitled to recover actual damages in a civil action.[32] Despite these laws being in place in conjunction with House Bill 142, potential breaches are still possible, and Louisianans are not totally protected from having their personal information leaked by hackers and the like.
Pornhub’s privacy policy does not explicitly mention LA Wallet.[33] More generally, for users who visit the website without logging into a Pornhub account, Pornhub collects “any . . . information which you voluntarily provide to us at your direction for a specific function,” which is a notably vague policy[34] Pornhub also collects data on website activity, including search history, devices used to access the website, and IP addresses.[35] Pornhub cites its reasons for collecting this personal data to customization of content and marketing, analytics about user activity, and compliance with legal obligations.[36] The site also states that Pornhub may disclose any personal information provided to its affiliates and related entities of its corporate group “to the extent [that it] is necessary” in addition to its authorized service providers for age verification and payment processing, though the service providers “are not permitted to share or use such information for any other purposes.”[37] Even with all of these precautionary terms, there is still a risk that an accidental leak of personal information either from Pornhub’s database or a third-party database is possible.
LA Wallet’s developing company Envoc states that its priority in helping to create the first digital driver’s license was “to build a secure app that protected individual’s rights and personal information,” including invoking a “no-touch” policy preventing an officer from taking physical possession of a citizen’s cell phone at the request of the Louisiana State Police.[38] However, even though the app is founded on the values of protecting individual privacy, there is a potential for personal information leaks when providing other websites and applications with access to the information contained on LA Wallet. Sure, a user’s IP address could be stored on file, but a leak of all of Pornhub users’ IP addresses would look like nothing more than thousands of confusing arrangements of numbers with no further identifying information. While Envoc’s President and Senior Analyst Calvin Fabre insists that LA Wallet’s system merely tells third-party entities the user’s age, he warns: “Hacking is always, always a possibility . . . the worst thing you want to do is say ‘We’re uncrackable.’”[39] University of Chicago assistant professor of computer science Blase Ur further explains the biggest privacy concern when it comes to pornographic websites using LA Wallet: “Even if the data is not stored, the attacker could break into the system being used for verification, recording who is accessing a site for the potentially long time they are able to remain undetected.”[40] A leak of a list of names, even with photos accompanying them, would be much more embarrassing and damaging. In fact, such a leak of personal information from a promiscuous entity would not be the first of its kind for Louisiana. Louisianans can look back on the infamous Ashley Madison Agency client list leak in 2015, a website for adulterous spouses, to get a feel for what a data breach would look like on a smaller scale.[41] After being hacked and involuntarily releasing the data of millions of account holders, the Ashley Madison Agency’s list circulated quickly, including the name of Louisiana GOP executive director.[42] Perhaps this might bolster the HB 142 legislators’ policies after all—the fear of a potential information leak and bearing a personal scarlet letter could deter users from seeking to access pornographic content online altogether.
HB 142 also faces some legal controversy when it comes to constitutional rights. The Supreme Court has historically struck down laws that attempt to restrict the right to access pornography under the First Amendment.[43] The Supreme Court in Ashcroft v. American Civil Liberties Union held that the Child Online Protection Act (COPA), a law with the same goals as Louisiana HB 142, was unconstitutional because it burdened adult access to pornography, which is protected speech.[44] Burdens arise for Louisiana users who do not have a state ID card; for example, out-of-state college students, tourists, or individuals working short-term in Louisiana could not access pornographic websites while located in the state because they do not possess a Louisiana license on LA Wallet. However, Representative Laurie Schlegel who introduced HB 142 assures that the bill is not overly burdensome: “[W]e [are] very confident that the bill was designed in a way that’s very narrowly tailored, not unduly burdensome for adults to access legal pornography, and so we believe that it could pass constitutional muster.”[45] By using LA Wallet’s new VerifyYou technology, HB 142 might be the first of its kind to meet constitutional requirements for not being overly burdensome to adults seeking to access pornography online.
Conclusion
Because LA Wallet is clearly expanding its reach into new realms, including its “coming soon” concealed carry and motor vehicle registrations, potential implications are important to keep in mind.[46] Though entities like Envoc and Pornhub who have access to users’ identifying information vow to try their darndest to prevent a breach in security of their database, total protection is impossible with the increasing requirements for users to hand over their personal information to access certain facilities and commodities. Entities looking to expand their business model to accept or require LA Wallet verification should be diligent in implementing policies and practices to be prepared for a potential data leak. Finally, Louisiana citizens should remain cautious about which entities they provide their legal name, birthday, and photo to via LA Wallet, even virtually, in case of a fortuitous event.
[1] LA Wallet, Envoc, https://envoc.com/work/portfolio/la-wallet [https://perma.cc/8NDF-HP55] (last visited May 6, 2023) [hereinafter Envoc].
[2] LA Wallet, La. Division of Admin., https://www.doa.la.gov/doa/ots/tech-spotlight/la-wallet/ [https://perma.cc/R6R4-W9H9] (last visited May 6, 2023) [hereinafter LA Wallet, La. Division of Admin.]; LA Wallet Timeline, LA Wallet, https://lawallet.com/timeline [https://perma.cc/4H8T-XUSE] (last visited May 6, 2023).
[3] LA Wallet, La. Division of Admin., supra note 2; LA Wallet Timeline, supra note 2.
[4] LA Wallet, La. Division of Admin., supra note 2; LA Wallet Timeline, supra note 2.
[5] Envoc, LA Wallet – New Features (Release 1.3), YouTube (Aug. 17, 2018), https://www.youtube.com/watch?v=Vppj7oNCI3U [https://perma.cc/7PYT-CDP2] (last visited May 6, 2023).
[6] LA Wallet Terms and Conditions of Use, LA Wallet, https://lawallet.com/terms-of-use [https://perma.cc/Y5FW-9S9R] (last visited May 6, 2023).
[7] Id.
[8] LA Wallet Privacy Policy, LA Wallet (Nov. 10, 2022), https://lawallet.com/privacy-policy [https://perma.cc/P7WC-TVA7].
[9] Envoc, supra note 1.
[10] Id.
[11] Id.
[12] VerifyYou, LA Wallet, https://lawallet.com/verifyyou [https://perma.cc/4YAA-NVHP] (last visited May 6, 2023).
[13] Id.
[14] LA Wallet, La. Division of Admin., supra note 2.
[15] LA Wallet Timeline, supra note 2.
[16] Id.
[17] Id.
[18] Id.
[19] LA Wallet COVID-19 Information, LA Wallet (Aug. 27, 2021), https://lawallet.com/covid19 [https://perma.cc/PM8N-SZT5].
[20] H.B. 142, 2022 Leg., Reg. Sess. (La. 2022).
[21] Adi Robertson, Louisiana Now Requires a Government ID to Access Pornhub, The Verge (Jan. 3, 2023), https://www.theverge.com/2023/1/3/23537226/louisiana-pornhub-age-verification-law-government-id [https://perma.cc/J376-BX8X].
[22] @fodderyfodder, Twitter (Jan. 2, 2023, 2:44 PM), https://twitter.com/fodderyfodder/status/1610014207533060099?ref_src=twsrc%5Etfw%7Ctwcamp%5Etweetembed%7Ctwterm%5E1610014207533060099%7Ctwgr%5E3f24d183f2767e9b8d68ffd63c2a5c92c1bf3612%7Ctwcon%5Es1_&ref_url=https%3A%2F%2Fwww.pcmag.com%2Fnews%2Flouisiana-law-requires-id-to-view-porn [https://perma.cc/9N2D-MYX9].
[23] Privacy Policy, Allpass Trust (Feb. 28, 2022), https://www.allpasstrust.com/en/privacy [https://perma.cc/WDN5-VK77].
[24] H.B. 142, 2022 Leg., Reg. Sess. (La. 2022).
[25] Id.
[26] Id.
[27] Id.
[28] Id.
[29] La. Rev. Stat. § 51:3071 (2023).
[30] Id. § 51:3074.
[31] Id. § 51:3074(C).
[32] Id. § 51:3075.
[33] Privacy Policy, Pornhub, https://www.pornhub.com/information/privacy [https://perma.cc/6QCM-E9X5] (last visited May 6, 2023).
[34] Id.
[35] Id.
[36] Id.
[37] Id.
[38] Envoc, supra note 1.
[39] Megan Wyatt, Louisiana Residents Now Need LA Wallet to Access Porn Online, The Advocate (Jan. 13, 2023), https://www.theadvocate.com/acadiana/news/politics/louisiana-residents-now-need-la-wallet-to-access-porn-online/article_295d1c54-91f1-11ed-a0a6-83adbe726bc2.html [https://perma.cc/778R-7CN8].
[40] Id.
[41] Kevin Litten, Ashley Madison client list includes Louisiana GOP executive director; he says it was for research, NOLA.com (updated July 18, 2019), https://www.nola.com/news/politics/ashley-madison-client-list-includes-louisiana-gop-executive-director-he-says-it-was-for-research/article_80a67240-1833-57bd-82fc-d3b8ac536eb0.html [https://perma.cc/Y8VA-WPRU].
[42] Id.
[43] See generally Reno v. Am. C.L. Union, 521 U.S. 844 (1997); Ashcroft v. Am. C.L. Union, 542 U.S. 656 (2004).
[44] Ashcroft, 542 U.S. 656.
[45] Wyatt, supra note 39.
[46] LA Wallet Timeline, supra note 2.