Age-verification mandates are spreading across the internet. From social media platforms to adult content sites, lawmakers in multiple countries are requiring platforms to verify users' ages. The stated goal is protecting minors. The practical effect, according to privacy advocates, may be a surveillance infrastructure that affects everyone who uses the internet.

Key Takeaways

  • Age verification is being mandated by laws including the UK Online Safety Act, the US KIDS Act, and similar legislation in Europe.
  • Zero-Knowledge Proofs (ZKPs) are often proposed as a privacy-safe solution, but they do not eliminate the upstream identity verification problem.
  • The EFF has identified several unresolved risks, including metadata leakage, centralisation, and function creep.
  • The infrastructure created for age verification can be expanded to other purposes — proof of citizenship, proof of address, proof of identity.
  • The safest approach for users is to minimise the data available to platforms in the first place.

The Case for Age Verification

The argument for age verification is straightforward: children and teenagers use platforms that were not designed for them, and age verification is a tool to enforce age-appropriate content restrictions. The UK's Online Safety Act, which received Royal Assent in 2023, requires platforms to prevent children from accessing harmful content. The US's KIDS (Kids Internet Design and Safety) Act includes provisions requiring platforms to verify users' ages or face significant penalties. Similar legislation is under consideration in the EU, Australia, and Canada.

The motivation is understandable. Social media, messaging apps, and gaming platforms have been linked to mental health concerns among young people, including increased rates of anxiety, depression, and social comparison. Age verification is one of the few tools lawmakers have to enforce access restrictions.

The Privacy Problem

The privacy concern with age verification is that it requires users to prove something about themselves — typically their age — to a platform. Even if the platform only needs to know "over 18" or "under 13," the verification process often collects far more information.

When you provide a government ID to a verification service, you are not just proving your age. You are proving your name, your date of birth, your address, and potentially your ID number. The verification service stores this information. The platform may receive a confirmation that includes a unique identifier that can be linked across sessions. The verification transaction itself may be logged, creating a record of when and where you accessed certain services.

Zero-Knowledge Proofs (ZKPs) have been proposed as a solution to this problem. ZKPs are a cryptographic technique that allows one party to prove a statement (such as "I am over 18") to another party without revealing the underlying data (such as the exact date of birth). In theory, this solves the privacy problem: the platform learns only whether you are over or under a threshold, not your exact age or identity.

The ZKP Reality Check

In practice, ZKPs are not a silver bullet. The EFF's analysis of the KIDS Act and related legislation identifies several unresolved risks:

**Upstream identity verification**: ZKPs prove a mathematical statement, but they do not address the upstream identity verification problem. To generate a ZKP that you are over 18, you still need a trusted authority — such as a government ID issuer, a credit bureau, or a third-party verification service — to attest to your age. That authority holds your personal data, and the quality of the attestation depends on the security of that authority's systems.

**Metadata leakage**: Even if the ZKP itself does not reveal age, the fact that someone is verifying age at a particular time and place can be revealing. If a verification service tracks which platforms a user is trying to access, it can build a profile of the user's online behaviour.

**Centralisation risk**: If a small number of verification providers become the standard, they become attractive targets for data breaches and government surveillance. A single breach of a centralised verification provider could expose the personal data of millions of users.

**Precedent and function creep**: Once age verification infrastructure is in place, it can be expanded to other purposes — proof of citizenship, proof of address, proof of identity — without the same level of public debate. The technical infrastructure makes it easier to add requirements, and the political conversation shifts from "should we do this?" to "the infrastructure already exists."

The AliExpress Precedent

The European Commission fined AliExpress €550 million in July 2026 under the Digital Services Act for, among other violations, failing to adequately verify the age of users and using dark patterns that made it difficult for users to control their data. The case demonstrates that regulators are beginning to enforce age-related obligations with substantial penalties.

What the Laws Actually Require

The requirements vary by jurisdiction:

**UK Online Safety Act**: Requires platforms to prevent children from accessing harmful content. Ofcom, the regulator, has published codes of practice that include age verification requirements. Platforms that fail to comply face fines of up to 10% of global annual revenue.

**US KIDS Act**: Requires the Federal Trade Commission to establish rules for age verification for platforms likely to be accessed by minors. The Act also includes restrictions on data collection and targeted advertising for users under 17.

**EU**: The Digital Services Act requires platforms to assess and mitigate risks related to minors' access to harmful content. The EU is also developing a harmonised approach to age verification through the proposed European Digital Identity framework.

The Practical Balance

The goal of protecting minors online is legitimate. But the tools used to achieve that goal have consequences for everyone's privacy. The challenge for lawmakers and platform designers is to implement age verification in a way that does not create a universal identity infrastructure.

For now, the safest approach for users is to be aware of what information they are sharing during verification, and to use privacy-preserving tools — such as encrypted messaging apps and privacy-focused browsers — to minimise the data available to platforms in the first place.

Age of Algorithms Perspective

Age verification is a classic example of a policy problem where the legitimate goal and the practical implementation are in tension. The desire to protect children online is real and urgent. But the infrastructure created to achieve that goal can become a mechanism for broader surveillance.

The lesson from the privacy community's analysis of ZKPs is that technical solutions alone are not enough. The governance and institutional design of verification systems — who controls the data, how it is protected, what it can be used for — matters as much as the cryptographic technique.