Florida has launched two lawsuits that aim directly at Nutaku, a massive hub for anime games, and Segpay, a payment processor known for serving adult platforms.
The Attorney General’s office claims the companies failed to comply with the state’s age verification digital ID law, HB3, which mandates websites confirm Florida-based visitors are at least 18 before viewing adult content.
Nutaku is operated by Aylo, the same parent company behind Pornhub and several of the largest adult sites in the world.
Announcing the lawsuits, Attorney General James Uthmeier said his office is suing both Aylo and Segpay, a firm that bills itself as a high-risk merchant processor specializing in adult entertainment.
More: The Digital ID and Online Age Verification Agenda
The complaint against Segpay goes further, arguing that the company bears responsibility for age verification because it processes payments for the adult gaming site xh.lustyheroes.com, owned by Gethins Ltd., another defendant.
We obtained a copy of the complaint for you here.
Florida officials point to Segpay’s Florida business address as further grounds for jurisdiction.
Florida’s lawsuit turns the state’s new age-verification law into a privacy and free-speech flashpoint.
The complaint leans heavily on the statute’s language while also accusing the companies of refusing to comply, language the lawsuit uses to argue for large fines and court orders.
The Attorney General’s filing quotes the statute and the companies directly, and those exact lines reveal the core tensions between protecting minors and protecting user privacy.
The complaint points to what the law requires, quoting the statute’s coverage of who must act: a “commercial entity that knowingly and intentionally publishes or distributes material harmful to minors on a website or application” must “use either anonymous age verification or standard age verification to verify that the age of a person attempting to access the material is 18 years of age or older and prevent access to the material by a person younger than 18 years of age.”
That language may sound straightforward, but the filing also reproduces the statute’s technical definitions that raise immediate privacy questions.
The complaint quotes the statutory test for banned content as material that the “average person applying contemporary community standards would find, taken as a whole, appeals to the prurient interest” and that “[d]epicts or describes, in a patently offensive way, sexual conduct” that “[w]hen taken as a whole, lacks serious literary, artistic, political, or scientific value for minors.”
The definitions the state uses to identify prohibited content are broad and subjective, and the complaint prints them in full.
On enforcement and penalties, the Attorney General’s papers repeat the statute’s power: a violation “is deemed an unfair and deceptive trade practice” and the State may “collect a civil penalty of up to $50,000 per violation and reasonable attorney fees and court costs.”
The filing asks the court to “temporarily and permanently enjoin the Defendants” and to require compliance.
The complaint does not limit itself to quoting the statute. It quotes its allegations about the companies’ conduct in direct terms: “Defendants know that they are subject to Florida’s age verification requirements. However, despite knowing that they must comply with Florida’s age verification law, the Defendants have openly defied this law during the relevant time period.”
The Attorney General frames the suit as seeking to “stop the unfair, deceptive, and unconscionable business practices that the Defendants have used to build a vast and lucrative Florida user base that includes vulnerable children and adolescents.”
Those quoted assertions are central to the Attorney General’s case, but they also illustrate why free-speech and privacy advocates are alarmed by such digital ID laws.
The statute offers two verification routes, “anonymous age verification or standard age verification,” yet the complaint and the statutory text both leave open how anonymous verification would work in practice.
The complaint reproduces the statutory description of anonymous verification as a method “conducted by a nongovernmental, independent third party organized under the laws of a state of the United States” that “[h]as its principal place of business in a state of the United States” and “[i]s not owned or controlled by a company formed in a foreign country, a government of a foreign country, or any other entity formed in a foreign country.”
Those constraints aim to limit foreign control, but they do not resolve whether verification will require sharing government IDs, facial scans, or other identifiers with private providers.
Privacy specialists warn that even so-called “anonymous” systems have leaked data and can create centralized records that link browsing to identity.
The complaint’s choice to reprint the statutory language highlights the risk: a state order enforcing verification, plus civil penalties of “up to $50,000 per violation,” creates a strong incentive for platforms to adopt whatever verification method courts accept, even if that method requires personal data collection.
The case also demonstrates how content definitions can sweep widely. By quoting the statute’s test for “material harmful to minors” and the administrative rule that a “substantial portion” is “more than 33.3 percent of total material on a website or application,” the complaint shows the legal levers the state will use to classify sites.
Those measures could push platforms to lock down broad swaths of content to avoid liability, with consequences for lawful adult speech.
The Florida filing demands injunctive relief and penalties and asks the court to “require that Defendants comply with Florida’s Age Verification laws and FDUTPA.”
The exact wording the Attorney General uses makes clear the stakes: strong enforcement tools, vague content standards, plus verification requirements that could collect personal data.
