Age verification laws are quietly becoming the biggest privacy expansion of the decade
A wave of these has landed in the last two years — the UK Online Safety Act, a dozen-plus US state laws, the EU floating age-assurance requirements — and the debate keeps getting framed as "protect kids vs free speech." The privacy angle gets almost no airtime, which is strange, because the mechanism is the whole story. To check an age you have to establish an identity. There's no way to prove someone is over 18 without some party learning who they are and, usually, what they're trying to look at. The early implementations are exactly as bad as that sounds: upload a government ID to a third-party verification vendor, or hand over a face scan for age estimation, in order to load a page. You've now created a record linking a real identity to specific content — the precise thing any sane threat model for adult or sensitive material is supposed to avoid.
The proposed fix is "privacy-preserving age verification" — zero-knowledge proofs, digital ID wallets that attest "over 18" and nothing else. The cryptography is real and genuinely elegant. The problem is that almost nothing deployed actually works that way. The wallets that exist route through a small number of issuers and platform vendors, so you've swapped "every site sees your ID" for "one issuer sees every site you age-gated into." That's a different shape of surveillance, not the absence of it. And a ZK proof only protects you if the verifier can't collude with the issuer and the whole exchange isn't logged "for compliance" anyway — which is exactly the carveout these laws tend to leave wide open.
The part I can't resolve: the goal itself isn't unreasonable, but every implementation I've actually seen either doesn't verify age at all (a self-attestation checkbox) or builds identity-to-content linkage at population scale. There doesn't seem to be a middle. Has anyone come across an age-assurance scheme that's both effective and doesn't just relocate the surveillance to a new chokepoint?
0 replies