The Creep of Age Verification Laws: From Adult Sites to the Entire Internet
Years ago, age verification bills were pitched as a way to protect children from explicit content. Make the internet safer for kids. It sounded well-intentioned. The only loud objections came from privacy advocates who warned that the cure could outgrow the disease. At the time, those warnings felt abstract.
Fast forward to today, and the landscape looks different. The steady march of new age verification laws continues to accelerate. And what began as a narrow effort aimed at adult websites is morphing into something entirely different.
On the surface, restricting access to explicit sites seems reasonable. Most people would not object to that. But the constant creep of age verification bills and the definition of harmful to minors is getting broader and broader. Now, some lawmakers argue that the law should apply to most social media websites and have also set their sights on other platforms, seeking to verify users through app stores and operating system providers, as well as AI chatbots.
In other words, it seems like it would affect nearly everything and could encompass a wide range of content, such as literature, music, television, and films that are protected under the First Amendment for both adults and young people. It gives the state a vast amount of discretion to decide which speech is harmful to young people, and the power to determine what is appropriate and what is not.
Beyond that, this approach requires creating a system that collects vast amounts of personal information from everyone who uses a service. To prove you are not a child, you may need to submit sensitive personal information or biometric data, such as a government-issued ID or a facial scan, creating opportunities for identity theft and data breaches.
We already know how that story unfolds. Companies get hacked. Databases get breached. Personal information leaks. Now imagine that your legal name and other sensitive information are no longer sitting in one compromised database but circulating far beyond it, copied, traded, and repackaged across forums, data markets, and broker networks where bad actors can access and exploit it. As explored in "When Public Records Become Private Dossiers: How Data Brokers Make Us Vulnerable", breached data rarely disappears. It is absorbed into a larger ecosystem that aggregates personal information, turning a single leak into a lasting digital trail.
Just earlier this month, Discord, a popular communication app, said it would begin rolling out a global age verification system that could require users to submit a facial scan or government ID if the company could not determine they were adults. The plan was framed as a way to comply with legal obligations and limit minors' access to certain content, but it followed a security breach at a third-party provider that exposed government ID images and drew criticism over the company's relationship with an identity verification firm backed by investors tied to government surveillance work.
If you are technically savvy, you might shrug and say there is an easy fix. Use a VPN, and appear to browse from another state or country. Problem solved.
Lawmakers have already noticed this "loophole". In states such as Wisconsin and Michigan, proposals have targeted virtual private networks, seeking to limit or monitor their use to enforce age-verification laws. The logic is straightforward - if people can bypass the system, pass new laws to restrict the tools that allow them to do so.
Sure, this is unlikely to work. People who want to bypass restrictions will use non-commercial VPNs, open proxies, or inexpensive virtual private servers that the law does not cover, or they will create their own. Others may move to platforms that operate outside the reach of these laws, which will likely pose greater safety risks.
Meanwhile, everyone else absorbs the consequences. Businesses that rely on VPNs for secure operations. Journalists protecting sources. Activists operating in hostile environments. Abuse survivors shielding their location. Students and remote workers are using basic security tools. Privacy becomes collateral damage.
We should protect children online. That is not in dispute. The real question is whether building a system that requires everyone to prove their identity before accessing lawful content is the right way to do it.
What began as a targeted proposal is turning into a structural shift in how the internet works. And once that shift is complete, it will not be easy to reverse.
For readers who want to dig deeper or push back against policies that expand online identification requirements, the Electronic Frontier Foundation's guide, "Age Verification Is Coming For the Internet. We Built You a Resource Hub to Fight Back", offers background, analysis, and practical steps for protecting digital privacy.