Age Verification Laws Are Spreading. Is the Free Internet Dying?

Key Takeaways

• 25 US states and dozens of countries now mandate age verification for social media or harmful content
• Privacy advocates argue these laws create identity verification infrastructure, not just age checks
• Social media platforms already know users' ages. Politicians could mandate platform-side restrictions instead.

The Global Push for Age Verification

Australia banned social media for users under 16. Indonesia and Brazil followed. Denmark, Portugal, and Malaysia have approved similar laws but not yet enforced them. France has reached an agreement, with details still in negotiation. Spain and Turkey have proposals on the table. Germany's major parties agree on age restrictions. Sweden is investigating the issue.

In April 2026, the European Commission launched an EU age verification app. One month later, Commission President Ursula von der Leyen announced plans for EU-wide restrictions.

In the United States, 25 states have mandated digital age verification as of June 2026. Half of all states either have pending legislation or have already passed laws imposing age restrictions for social media or content deemed inappropriate for minors.

The Czech Republic, Greece, Austria, Poland, Canada, Slovenia, and the Netherlands are also debating similar measures. Techpolicy.press tracks ongoing developments.

The Child Safety Framing

Governments frame these laws as protecting children from harmful content and addictive platforms. The argument is simple: children shouldn't be on social media, so verify ages and block minors.

But there's a problem with this logic. Social media companies already know which users are children. Their entire business model depends on knowing user demographics. They know how old you are, who your friends are, what content you engage with. They have known this for over a decade.

If politicians wanted to protect children from social media, they could mandate that platforms block minors using the data platforms already have. They could force platforms to stop practices they consider harmful to children. They could regulate algorithmic amplification for young users.

Instead, lawmakers chose a path that requires every user to prove their identity to access these services.

Age Verification Is Identity Verification

Here's the core issue: most age verification systems don't just check your age. They verify your identity. You submit a government ID, a biometric scan, or link to a national identity system. The platform or a third-party verifier then confirms you're old enough.

This creates a permanent record linking your real identity to your online activity. The anonymous internet, where users could speak freely under pseudonyms, becomes an identity-verified internet where every action traces back to a government record.

“The shift from website-level age gates to OS-level identity verification isn't just about protecting children; it's about forcing hardware manufacturers to become the primary gatekeepers of state-mandated digital identity.”

— Dr. Elena Vance, Senior Policy Researcher at the Digital Rights Institute

The Electronic Frontier Foundation has warned that OS-level age verification transforms hardware into government-mandated tracking devices. When your phone or operating system becomes the gatekeeper, there's no opting out.

The Security Problem

Age verification systems create what security researchers call data honeypots. They concentrate sensitive identity documents in centralized databases that become targets.

This isn't theoretical. In 2025, a single data breach involving a third-party verification contractor exposed 70,000 user ID documents. When you require identity verification at scale, breaches at scale follow.

The companies running verification services may not be social media giants with dedicated security teams. They're often contractors, startups, or government agencies with varying security practices.

Who Loses Pseudonymity

For many internet users, anonymity isn't about hiding wrongdoing. It's about safety.

• Domestic abuse survivors who don't want abusers tracking their online presence
• LGBTQ+ users in countries or communities where their identity puts them at risk
• Political dissidents and whistleblowers
• Anyone discussing mental health, addiction, or personal struggles
• Journalists protecting sources

A verified internet makes these groups visible to anyone with access to verification databases, whether through legal requests, data breaches, or insider abuse.

The Technical Theater of Privacy-Preserving Solutions

Some advocates propose privacy-preserving age verification using Zero-Knowledge Proofs. The idea: prove you're over 18 without revealing your actual identity or birthdate.

In theory, this sounds reasonable. In practice, these systems face serious problems.

First, they still require initial identity verification to generate the proof. Someone, somewhere, must confirm your real age before issuing the cryptographic credential. That initial verification creates the same data concentration risk.

Second, implementation matters more than theory. Hacker News discussions note that privacy-first verification solutions are frequently bypassed or broken. The gap between cryptographic papers and deployed systems is wide.

Third, governments can change requirements. A system designed for age verification today can be modified to require identity verification tomorrow. Once the infrastructure exists, expanding its scope is a policy decision, not a technical one.

What This Means for Platform Operators

If you run a platform that might fall under age verification mandates, the compliance landscape is fragmenting rapidly. Different countries are implementing different standards, different verification methods, and different age thresholds.

• Australia: under-16 ban for social media
• EU: App-based verification launching, with broader restrictions planned
• US: State-by-state patchwork with 25 states already mandating verification

For global platforms, this means either implementing jurisdiction-specific verification, geoblocking regions with strict requirements, or building age verification into core architecture.

For smaller platforms and startups, compliance costs may prove prohibitive. The verification infrastructure itself becomes a barrier to entry, potentially cementing the market position of incumbents who can afford implementation.

The Real Objective

Mullvad, the VPN provider that published the original analysis, argues bluntly: politicians don't want to protect children. They want to impose control.

The evidence for this view is structural. If child safety were the goal, regulators would target platform behavior, not user identity. They would mandate that platforms use their existing data to restrict minors, rather than requiring every user to verify themselves.

The choice to build identity verification infrastructure instead suggests different priorities. An internet where every user links their activity to a government identity is an internet where speech can be monitored, tracked, and punished at scale.

This doesn't require conspiracy thinking. It's a predictable outcome of the infrastructure being built. Once identity verification exists, uses for it will expand. That's how infrastructure works.

What Happens Next

The number of countries implementing age verification is growing rapidly. Momentum favors expansion, not rollback.

For users concerned about privacy, the window for anonymous internet access is narrowing. VPNs and privacy tools may provide temporary workarounds, but OS-level verification would close that gap.

For policymakers who genuinely care about child safety, there's still time to reconsider the approach. Mandating platform-side restrictions based on existing data would achieve the stated goal without building mass surveillance infrastructure.

The question is whether that's actually the goal.

Frequently Asked Questions

How does age verification work on social media?

Most systems require users to submit government-issued ID, biometric scans, or link to national identity databases. A platform or third-party contractor verifies the ID and confirms the user's age before granting access.

Which countries have social media age verification laws?

Australia, Indonesia, and Brazil have implemented laws. Denmark, Portugal, and Malaysia have approved but not enforced them. France, Spain, Turkey, Germany, Sweden, and many others are actively working on legislation. In the US, 25 states have mandated verification.

Are there privacy-preserving age verification methods?

Zero-Knowledge Proofs theoretically allow proving you're over a certain age without revealing your identity. In practice, these systems still require initial identity verification and have been frequently bypassed or broken in implementation.

Why don't platforms just block children using data they already have?

They could. Social media platforms already know user demographics. Politicians could mandate platform-side restrictions without requiring all users to verify their identities. The choice to require universal identity verification suggests goals beyond child safety.

What are the security risks of age verification databases?

Centralized ID verification creates data honeypots. In 2025, a single breach at a verification contractor exposed 70,000 user ID documents. Requiring verification at scale means breaches at scale.

Source: Hacker News: Best