Dear reader,
A couple of weeks ago, an app called Tea suffered a data breach, which leaked 72,000 images and IDs that the company had used for verifying user accounts. A few days after this, the app got breached again, exposing over 1 million private messages between the users.
Most of the commentary has focused on the app and the ethical concerns related to its intended purpose of women discussing and sharing details about the men they have been dating. The case also made it clear what would happen in a world of ever-present age verification, where people would constantly share their highly personal information to companies. In this world, where countless different companies handle your data, only one data breach is enough to have your personal information leaked and potentially used for malicious purposes. Age verification truly presents an unprecedented threat to people’s privacy, and that’s why we need to oppose it.
In recent years, age verification has become a big trend all over the world, with development happening in the U.S., EU, and Australia. When UK’s Online Safety Act came to force in July, people could really see what it was like to browse the web, when everyone were suddenly asking you to provide your personal information to some third-party verification company you have probably never heard of.
The people who promote age verification argue that it is important to protect the children from harmful content online, but as important as that goal might be, age verification laws are a deeply problematic way of trying to fix the issue and will put everyone, children included, at risk.
Normalizing age verification is not only terrible for people’s privacy, but it also increases the risk that people’s personal information will get leaked to criminals. In fact, the age verification company AU10TIX was hacked in 2024, demonstrating that implementing wide-scale age verification systems presents a tremendous threat to people’s personal information. When you give out your personal information to these third-party companies, you can’t protect it anymore. You can only hope that none of these companies will get hacked in the future, which doesn’t seem realistic in a world where data breaches are constantly happening. Age verification is like asking to get your personal information leaked.
Some attempts have emerged to do age verification in a more privacy-respecting manner, such as the app that the EU is currently working with together with a few of its member states. The app would allow users to verify their age to the service without uploading IDs to any companies. You would still need to upload your ID to the app itself, which still increases the risk that your personal information could get leaked after a potential data breach. The app would be open source, but national governments could create their own customized versions of it. Having a government deciding what kind of content is inappropriate to children remains an issue that the EU’s implementation can’t fix. The EU has admitted that member states could basically decide themselves what they want to do with the app: “It will technically be possible to extend the age verification solution to other age limits, or to other use-cases, such as purchasing alcohol. Member States can decide to do so when customizing it to the national context, or at a later stage.” I bet that Hungary and its prime minister Viktor Orbán could surely use this app for their authoritarian purposes if you hand them the perfect tool for it.
Governments could surely use this kind of legislation to restrict information to content they would not want people to see. This could range from content related to sexual minorities, to rival political parties or scientific research and media. We have even recent examples of this, such as when the Republican Senator Marsha Blackburn argued that the Kids Online Safety Act, a proposed law to protect children on social media, would also protect children from trans people. What politicians should realize is that these age verification tools are the perfect censorship weapon, which is why we shouldn’t be moving forward with them.
However, the risk of losing access to important information is not only a problem related to governments as companies can themselves restrict people’s access to information. For example, Verge has reported that Reddit has restricted access to the subreddits “r/periods, r/stopsmoking, r/stopdrinking, and r/sexualassault,” because of the UK’s Online Safety Act. In addition, social media companies have restricted people’s access to posts about the wars in Ukraine and Gaza.
These examples illustrate how companies can take the requirement for age verification to the extreme, as if it were harmful for minors to learn about their periods, which is just basic sexual education that should be available for everyone. But speaking of sex education, researchers and human rights groups have warned that online platforms often censor sex education. I would expect that this tendency will only grow together with the demands of age verification.
The UK law has also proved to be unpopular among the public, as the petition to “Repeal the Online Safety Act” has already reached over 515,000 signatures. We really need a lot more public debate regarding these laws. A big problem is that this isn’t currently happening, and governments are working on these laws under the curtain.
Another issue with age verification is that instead of using more legitimate sites that comply with the law to access certain content, people could instead use more shady and potentially malicious sites that haven’t complied with the law.
These restrictions are also easy to avoid with tools like VPNs, which isn’t difficult for minors to install on their phones. In fact, this appears to be exactly what happened in the UK after the law went into effect. The British Technology Secretary Peter Kyle also noted this and said the following about the matter:
"For everybody who’s out there thinking of using VPNs, let me just say to you directly: verifying your age keeps a child safe, keeps children safe in our country. So, let’s just not try and find a way around."
The argument itself is pretty absurd because by verifying your age to an online platform by giving them your personal information, you are only affecting yourself and how likely your data will get breached in a data breach. It will obviously have no effect on children. But this kind of comment tells a lot about the people who are making up these laws. They rarely understand the potential privacy risks and are dismissing the criticism.
VPNs are also a legitimate privacy tool, so it is questionable to demand that people stop using them. However, a problem with soaring VPN use is that choosing a great VPN provider is difficult if you don’t know what to look for. Many free VPNs could especially harm your privacy. So, in the process of restricting people’s access to information, the UK law and other age verification laws could risk people’s privacy even further.
In the end, age verification is the wrong tool for the problem, and according to researchers, it doesn’t even work, as people shift to sites that haven’t complied with these laws or just get a VPN. Right now, people can even trick some of these checks by pointing their camera at a video game character, which just reveals how politicians haven’t really thought this through. The proper solution should be comprehensive sex education in schools and at home, and discussions between the child and their parents.
Parents could also use parental controls, which could be especially effective with younger children but wouldn’t be something teens couldn’t bypass. There is also a risk that parents could misuse these technical solutions. For example, conservative and religious parents could restrict access to educational LGBTQ content if they are afraid that their child might belong to this group. So overall, I’m not a big fan of these kinds of technical solutions and would rather focus on providing children the information they need to browse the internet more safely. Is this a perfect solution? No, but there doesn’t exist one that would just magically make the entire issue disappear.
Ultimately, privacy is important because it is a fundamental human right, and people should be able to control their personal information and how it gets shared and used by other people or companies. Age verification laws attack the core of this principle, and that is why we should fight them. The risks are simply too high to ignore. We have a right to privacy, even if governments seem to forget that regularly. 🌔