Age Verification Laws Won't Protect Kids — But They Will Build a Surveillance Machine

“We need to protect children from harmful content online.” Nobody disagrees with that sentence. But when the proposed solution is a system that verifies the identity of every person using the internet, the conversation changes entirely. In 2026, governments across the globe are racing to pass online age verification laws — and the implications reach far beyond keeping kids off adult websites.

The Global Push Is Already Underway

This isn’t hypothetical. Australia passed legislation in late 2024 banning social media for children under 16, and is now working out which age verification technology to mandate. In the US, Texas, Louisiana, and a growing list of states now require government ID verification to access adult websites. The UK’s Online Safety Act places age verification at the center of its enforcement framework. France has gone further, piloting AI-powered facial age estimation.

Every one of these efforts shares two things in common. They all invoke child protection as the justification. And they all require infrastructure that fundamentally changes how adults use the internet.

There’s No Way to “Just” Verify Age

Age verification sounds simple. It isn’t. The approaches currently on the table each come with serious baggage.

ID upload — scanning your driver’s license or passport — is the most straightforward. It’s also the most dangerous. Your government-issued identity documents end up on a third-party server. One breach means mass identity theft.

Facial age estimation uses AI to scan your face and guess your age bracket. Beyond the obvious accuracy problems (good luck if you’re a 30-year-old who looks 17, or vice versa), this is biometric data collection by another name.

Digital identity tokens — issued by a government or certification authority to prove you’re over 18 without revealing who you are — sound privacy-friendly in theory. In practice, the questions are who issues the token, who logs when it’s used, and how long before the “anonymous” part quietly disappears.

Every approach leads to the same place: to access a website, you must prove your identity to someone. That is the end of online anonymity.

The Perfect Political Shield

The most effective part of this push is the framing. Oppose age verification, and the immediate response is: “So you’re fine with children watching pornography?” There is no stronger rhetorical shield in democratic politics.

These bills pass with bipartisan support everywhere they’re introduced. No legislator wants to be the one who voted against protecting kids. But history has a clear pattern here. The War on Terror gave us mass communications surveillance. CSAM-blocking infrastructure became the foundation for broader internet censorship systems. The Patriot Act was supposed to be temporary.

Infrastructure built for one purpose never stays limited to that purpose. A system that can verify your age can verify your identity. A system that can verify your identity can track your behavior. The capability doesn’t care about the original justification.

Will It Actually Protect Anyone Under 18?

Here’s the part that rarely gets airtime in legislative debates: there’s little evidence this will work.

A VPN defeats every age gate. A teenager borrowing a parent’s ID bypasses the whole system. Tech-literate minors — which is most of them — will treat age verification as a minor inconvenience, not a barrier. Security researchers have been saying this about Australia’s social media ban since the day it passed.

The result is a familiar one in surveillance policy: the people the system targets route around it, while law-abiding adults get absorbed into a permanent identity verification infrastructure.

The more effective approaches to child safety are less dramatic and less politically useful. Regulating recommendation algorithms so platforms can’t push harmful content to minors. Investing in digital literacy education. Requiring safety-by-design in platforms where children are known users. None of these require building an identity checkpoint at the door of every website.

The Real Choice We’re Making

This debate isn’t really about technology. It’s about what kind of internet we want to live with.

The internet as it exists today — where you can read, search, and speak without first proving who you are — is not a bug. It’s a feature that has enabled whistleblowers, activists, abuse survivors, and ordinary people who simply want to browse without being watched.

Mandatory age verification is not a narrow technical policy. It is a decision to redesign the internet from an open space into a gated one, where entry requires identification. Children’s safety matters. But before we build the infrastructure, we should be honest about what we’re actually building — and whether we trust every future government to use it only for the purpose we had in mind.