The Growing Debate on Expanding Age Verification Legislation

Technologists and policymakers are facing a significant challenge of our era on the internet: while it facilitates unmatched education and global connectivity, it also poses considerable risks to children with unmonitored access.

However, there is no simple way to monitor children’s internet activities without simultaneously surveilling adults, which may lead to serious violations of online privacy.

While some proponents view these laws as victories for children’s safety, many cybersecurity experts warn that these regulations are being introduced and enforced without sufficient planning, creating substantial security hazards for adults as well. In the U.S., 23 states had enacted age verification laws as of last month, with two more states following suit in September. At the same time, the United Kingdom’s Online Safety Act, which took effect in July, requires many online platforms to authenticate users’ identities before allowing access.

This article seeks to outline the current debate surrounding age and identity verification and the jurisdictions enforcing these laws.

What is age verification?

When we talk about age verification laws, we’re not referring to the days when you created a Neopets account as a child by simply checking a box claiming you were at least 13. In the U.S., these age checks are rooted in the Children’s Online Privacy Protection Act (COPPA), enacted in 1998. However, if you had a Neopets account at age 10, you might remember bypassing those COPPA checks just by clicking “I’m 13.”

In contrast, age verification laws emerging in the 2020s generally require users to upload a government-issued ID to a third-party verification system for identity confirmation. Users might also need to provide biometric facial scans similar to the technology utilized in Face ID on iPhones.

What is the purpose of age verification?

Ultimately, internet safety is centered not on preventing children from engaging with platforms like Neopets but on protecting them from harmful content. Parents and lawmakers are concerned about minors encountering damaging material, such as online pornography, information about illegal drug use, and social media interactions with individuals of malicious intent.

These concerns are not unfounded. Parents have shared distressing stories of their children who lost their lives after obtaining fentanyl-laced drugs through Facebook or took their own lives after relentless bullying on Snapchat.

As technology evolves, the issue becomes more acute: Meta’s AI chatbots have reportedly engaged in inappropriate conversations with children, while Character.AI and OpenAI face lawsuits related to the suicides of children allegedly driven by interactions with their chatbots.

Nevertheless, the internet also possesses immense potential for good. From learning to play guitar or code for free to forming meaningful relationships across continents, accessing specialized telehealth services irrespective of local healthcare availability, or quickly finding answers to nearly any questions (for instance, Antananarivo is the capital of Madagascar), the internet provides invaluable resources.

In light of these considerations, global lawmakers have converged on what they believe is a reasonable compromise: rather than restricting the entire internet, they are opting to place specific content behind a verification barrier requiring proof of adulthood. In this scenario, users won’t merely check a box to confirm their age; they’ll need to upload a government ID or biometric information.

Is it safe to verify your identity by uploading a government ID or biometric scan?

The safety of any digital security method depends on its implementation.

Apple has designed its Face ID feature to ensure that biometric scans never leave the device, remaining solely on the iPhone and not stored in the cloud, which significantly reduces the risk of hacker access.

However, complications arise when any connection to external networks is involved, introducing potential vulnerabilities in the identity verification process. We’ve observed cases where deficient technology has led to major breaches.

The Electronic Frontier Foundation points out, “No method of age verification is both privacy-protective and entirely accurate. These methods do not exist on a spectrum of ‘more safe’ to ‘less safe,’ or ‘more accurate’ to ‘less accurate.’ Instead, they are positioned on a spectrum of ‘dangerous in one way’ to ‘dangerous in another way.’”

Recent events illustrate how disastrous mishaps can occur when a company fails to secure its data.

Take Tea, an app aimed at women for sharing information about men met on dating platforms, which requires users to upload selfies and ID photos for verification. Unfortunately, users on 4chan exploited security weaknesses that led to the exposure of sensitive data, including government IDs, selfies, and private messages detailing personal experiences, which should have been safeguarded. What was intended as a secure platform wound up compromising users’ privacy and exposing personal details, such as home addresses.

Such incidents are not uncommon—TechCrunch’s security reports can attest to that. Not only new apps like Tea are at risk; established tech giants and governmental organizations are also vulnerable to data breaches.

Does it matter if I lose my online anonymity? I’m not doing anything inappropriate.

The backlash surrounding these laws isn’t solely due to privacy concerns related to personal conduct.

In areas where political expression may lead to prosecution, anonymity is essential for enabling authentic conversations and critiques of authority figures without fear of retaliation. Corporate whistleblowers may find it difficult to report malfeasance if their online activities are linked to their identities, and survivors of domestic abuse would have a harder time escaping dangerous environments.

In the U.S., the risk of prosecution based on political views is becoming increasingly real. Former President Trump has threatened punitive actions against political opponents, and there have been instances of visa revocation for international students expressing dissent against government actions.

What age verification laws have been enacted in the U.S.?

As of August 2025, twenty-three states across the United States have implemented age verification laws, with two more states planning to enact similar measures by the end of September 2025.

These laws primarily target websites featuring specific percentages of “sexual material harmful to minors,” which varies by state.

Practically, this means adult websites are required to verify a user’s identity before granting access. Some platforms, such as Pornhub, have opted to block access from specific states entirely.

“Age verification software requires the submission of sensitive information, increasing the risk of data breaches,” Pornhub stated on its blog. “Regardless of intent, governments have historically struggled to secure this kind of data.”

What is classified as “sexual material harmful to minors”?

The definition of this term varies depending on the overseeing authority.

At a time when LGBTQ rights are facing setbacks in the U.S., activists caution that such laws might be misapplied to label non-pornographic LGBTQ-related content and fundamental sex education as “sexual material harmful to minors.” These concerns seem justified, particularly in light of the Trump administration’s removal of references to civil rights movements and LGBTQ history from official government webpages.

The Supreme Court upheld Texas’s age verification law in June, coinciding with additional legislative restrictions aimed at the LGBTQ community, including limitations on public drag performances and a ban on gender-affirming healthcare for minors. The drag show law was later ruled unconstitutional as it violated the First Amendment.

What’s the situation with age verification in the U.K.?

The United Kingdom implemented the Online Safety Act in July 2025, mandating numerous online platforms to verify users’ identities prior to granting access. Minors identified through this verification will be barred from certain websites. This Act applies to search engines, social media, video hosting sites, instant messaging platforms, and cloud storage services—essentially anywhere users engage with media or interact.

This implies that platforms like YouTube, Spotify, Google, X, and Reddit will require UK users to authenticate their identities before accessing certain materials. These protocols are not restricted solely to pornographic or violent content; users in the UK have encountered barriers to important educational and news resources, complicating their access to vital information while increasing privacy concerns.

The UK lacks a uniform method for identity verification—individual websites can choose their verification processes, overseen by Ofcom, the communications regulator. However, as highlighted by the Tea example, confidence in authentication technologies remains fragile.

Consequently, users must choose between accessing information openly or exposing themselves to privacy risks.

Does the U.K. age verification law impact me if I reside outside the U.K.?

Even if you’re not a U.K. resident, you could still experience the effects of tech platforms that are preemptively adapting to these regulations.

In the U.S., YouTube has begun implementing technology designed to estimate users’ ages based on their interactions, regardless of the age they provided during account registration.

Can you just use a VPN to circumvent these barriers?

Yes, and the App Store’s rankings in the U.K. reflect this—the Online Safety Act led to VPNs taking up half of the top ten free apps on iOS. Downloads of VPNs surged after Pornhub was blocked in multiple U.S. states.

When Pornhub was temporarily suspended in France, ProtonVPN reported a staggering 1000% increase in registrations within half an hour, claiming this surge surpassed even that seen during TikTok’s brief USA blockage.

You may have used a VPN before, perhaps to remotely access your office desktop or to spoof your location to watch British comedies for free from the U.S.

This situation raises another issue: free VPNs may not always adhere to strong privacy standards, even if they claim to be secure.

If you’re interested in exploring VPNs further, TechCrunch has detailed guides on what to consider when using a VPN and how to determine if it’s right for you.