2026-09-21
The Supreme Court just let Texas require ID to download an app. What happens to the photo age verification asks you for?
On July 6, 2026, the Supreme Court let Texas start enforcing a law that has nothing to do with pornography. The Court's brief, unsigned orders declined to block the state's App Store Accountability Act while a First Amendment challenge continues, so the law — which requires Apple's and Google's app stores to sort every user into one of four age categories, and to get a parent's consent before a minor downloads most apps at all — stays in force. That's just over a year after a narrower Texas law crossed the same constitutional bar for a different reason: on June 27, 2025, the Court ruled 6-3 in Free Speech Coalition v. Paxton that requiring commercial websites to verify a visitor's age before showing sexual content "only incidentally burdens the protected speech of adults." Neither ruling invented the idea of checking ID online. Together, they're why "prove your age" has gone, in about a year, from something a handful of adult sites asked for, to something roughly half of US states require by law, to — in one state so far — something the app store itself may ask before you install a weather app.
What the law actually tells a site to ask for, and what it tells them to delete
The Texas law behind the 2025 ruling, HB 1181, gives sites two paths, spelled out in the bill's own text: "provide digital identification; or ... comply with a commercial age verification system that verifies age using: (A) government-issued identification; or (B) a commercially reasonable method that relies on public or private transactional data." The same section then says something a data-hungry law wouldn't: a commercial entity or third party that performs the check "may not retain any identifying information of the individual" once it's done. The 2026 app-store law, SB 2420, is written the same way. Effective January 1, 2026, it only requires a "commercially reasonable method of verification" to sort a user into "child" (under 13), "younger teenager" (13-15), "older teenager" (16-17), or "adult" (18+), and separately requires the app store to "delete personal data provided ... on completion of the age verification" and collect no more than the minimum needed. On paper, neither law asks anyone to build a permanent library of driver's license photos. In practice, "government-issued identification" is the cheapest commercially reasonable method for a smaller site or app to stand up, so it's the one a lot of them pick — and "delete it after" is a line in a compliance filing, not a technical guarantee about what a third-party verification vendor's server actually does with your file five minutes, or two years, after you send it.
The vendors holding that photo don't have a clean record
Two incidents from the last two years show exactly that gap. Tea, a dating-safety app that required a selfie and a government-issued ID before granting access, stored the images in a Google Firebase bucket with no authentication at all — anyone with the URL could download it. When a security researcher found the open bucket in July 2025, it held roughly 72,000 images: about 13,000 selfies and driver's-license or passport photos, some dating back to early 2023 — Tea says it had migrated to more secure infrastructure in February 2024 and simply never deleted the old bucket behind it. At least ten lawsuits followed, including Illinois biometric-privacy claims over the selfies specifically. The second incident is bigger and isn't about a dating app at all. AU10TIX, an identity-verification vendor whose customers include Uber, TikTok, X, Coinbase, LinkedIn, Fiverr, and Saxo Bank, left an administrator credential exposed on a public Telegram channel for more than a year — first likely compromised in December 2022, posted publicly in March 2023, and still working when a researcher tested it in June 2024 — with, according to Malwarebytes' reporting on the same disclosure, access to images of driver's licenses submitted for verification across those platforms. Neither company built its system to leak. Both simply left a legacy piece of it standing after they'd moved past it — a failure mode no "delete it after verifying" clause can catch once it's already happened.
What encrypting your own copy actually fixes
None of the middle or right columns above are under your control, and this post won't claim NearSeal reaches them. What is under your control is the file that exists on your own device around the moment you comply with one of these checks: the phone photo you took of your driver's license to upload for a dating app, an age-gated forum, or — starting in Texas — an app store; the same scan reused because three different services asked for "a photo of your ID" in the same month; the copy still sitting in your camera roll or Downloads folder after the check already passed, because deleting it never felt like a required step. That file is exactly as sensitive as the ones Tea's and AU10TIX's customers had exposed, and it's the one part of this whole chain that never has to leave your device unencrypted. NearSeal runs entirely in the browser — nothing is uploaded, so encrypting the copy you're keeping doesn't touch, help, or interfere with the verification you're about to do or already did.
What it honestly can't do
Encryption can't stand in for the verification itself: whatever vendor is checking your age has to be able to read your actual document to check it, so there's no way to send them ciphertext and still pass. The moment you submit the real file to that vendor's system, whatever you did to your own copy stops mattering to theirs — an encrypted backup on your own laptop wouldn't have kept AU10TIX's exposed credential from reaching a live one on their server, any more than it would have kept Tea's abandoned bucket from being public. NearSeal's own format also isn't a way to hide what a file is from someone who already has it: the container's header keeps the original filename in the clear — authenticated against tampering since the current format version, but readable — so "drivers_license_front.jpg.nearseal" still tells you what's inside even though nobody can open it. Rename the file to something unremarkable before encrypting, or use the opt-in age-encryption.org format available in the same tool, which carries no filename field at all. And like every file NearSeal seals, there is no passphrase recovery of any kind, and no cipher helps if the device is already compromised when you photograph the document or type the passphrase — a keylogger or malware with file-system access reads the plaintext before encryption or after decryption, regardless of what happens in between.
Where NearSeal fits
Two rulings just over a year apart didn't create the habit of photographing your own ID for a stranger's server; they made it legal, common, and — as of July 2026, in at least one state — a precondition for something as ordinary as installing an app. What NearSeal can do about that is narrow and specific: the copy that's still yours, sitting on your own device before or after one of these checks, doesn't have to sit there in the clear. AES-256-GCM, a passphrase-derived key via PBKDF2-SHA256 at 220 iterations, entirely client-side — for the file itself. Everything downstream of the "submit" button on someone else's verification form is a separate, honest limit, not a gap in this tool so much as a gap in what any file encryptor run on your side of that transaction could ever reach.