Age Verification Is Building the Internet’s Next Identity Layer

Soon, watching a show, reading the news or leaving a comment online may require proving your age by uploading a government ID or allowing a camera to scan your face. Not once, but across countless websites, each potentially retaining its own copy of your credentials. That is the future that many democratic governments are steadily legislating into existence. We are sleepwalking toward the most invasive version of it, without noticing that there was ever a choice. The debate has largely focused on protecting children. Much less attention has been paid to the digital identity infrastructure those protections require. 

The machinery is already in motion. This summer, two of the most consequential internet bills advanced within days of each other. On June 29, the U.S. House passed the Kids Internet and Digital Safety (KIDS) Act, a package built around a revised Kids Online Safety Act, with bipartisan support. The same week, E.U. negotiators held what was billed as the final trilogue on Chat Control 2.0, the bloc’s long-running child-protection regulation. Both had spent months under fire; both retreated on their most-contested measures. Yet both kept the one provision attracting little scrutiny: mandatory age verification.

On its face, verifying a user’s age sounds narrow and sensible. In practice, it is neither. To confirm that a visitor is over 18, a platform has to check the age and, usually, the identity of everyone who arrives, including adults. Multiply that across every jurisdiction now writing its own rules, and the result is not one verification system. It’s a patchwork of dozens of incompatible ones.

This is where policy matters. The regimes are diverging fast. The E.U. is consolidating around a privacy-preserving model: its own age-verification app is designed so a user can prove they are over 18 without revealing anything else about themselves. The U.S. is fragmenting the opposite way: roughly half its states now enforce age checks, most demanding a government ID or a face scan uploaded to each site, with the rules differing state by state. A federal judge blocked Nebraska’s social media age verification law in June, even as others took effect. The U.K., under the Online Safety Act, has taken perhaps the most aggressive approach. Its regulator has opened dozens of investigations and begun issuing fines, and users now hand over IDs or submit to face scans to reach ordinary content.

A global platform cannot build twenty versions of its front door. It builds one that satisfies the strictest, most common requirement, and because the most widespread demand is “upload an ID,” that becomes the default that the whole internet inherits. Fragmentation does not average out to a reasonable outcome; it ratchets toward the most invasive option. The result is a growing archipelago of digital identity honeypots: centralized repositories of passports and face scans sitting on servers, waiting to be breached. A single vendor already reportedly powers age checks for around 60 percent of the websites that require them, a remarkable concentration of the world’s personal information that ought to alarm anyone who has watched a large-scale data breach unfold.

The debate is stuck on the wrong axis. Lawmakers frame it as safety versus freedom; critics frame it as protection versus privacy. Both assume that keeping children out of adult spaces requires identifying the adults. It does not. Verifying a fact about someone and collecting their sensitive data are fundamentally different operations, and we have known how to separate them for years. A privacy-preserving age check lets someone demonstrate they are over 18 to a website that learns nothing else, no name, no birth date, no document to store. Minimum disclosure, on a strict need-to-know basis. The proof is verified and discarded; no honeypot is created because no identity was collected. The E.U. has grasped this. The trouble is that the laws mandating verification rarely mandate the method, leaving it to whichever vendor is cheapest and most invasive.

We have seen this film before. When Europe set out to protect people’s data, its rules demanded that websites obtain consent to track you, but specified the goal, not the mechanism. The market answered with the cookie banner: the pop-up you dismiss a hundred times a week without reading, which protects almost no one and irritates everyone. Age verification is on course to become the cookie banner of identity, except this time, what you hand over to make the box disappear is not a click. It is your passport.

The distinction matters for more than age verification. The same question, how someone proves authorization without exposing unnecessary personal information, is rapidly becoming central to the next generation of internet infrastructure, where A.I. agents will increasingly act on behalf of individuals. 

The window to fix this is open precisely because the legislation is still moving. The U.S. bill heads to a skeptical Senate; Chat Control 2.0 is chasing negotiations over the summer. In both cases, the principle that platforms should be able to distinguish adults from children is effectively settled. What remains unsettled is whether that capability is built on privacy-preserving proofs or on a mountain of uploaded passports.

And this is only the rehearsal. The same question, whether you can verify something about an actor without exposing who they are, is about to return at a far larger scale, because the internet is being rebuilt around software that acts on our behalf. The familiar sorting of web traffic into “bot” or “human” is already breaking down. A third category is emerging: verified agents acting, with permission, for real people. Those agents will need to demonstrate they are authorized and what they are allowed to do, without dragging their owner’s entire credentials through every site and service they touch. In the agent economy, accountability requires identity, but identity you can prove without surrendering. It is the very same architecture choice, provable, private proof versus mass personal information collection, only now the “users” number in the billions and never sleep.

The fight over age verification is therefore bigger than pornography or social media. Settle it by defaulting to ID uploads into centralized databases and honeypots, and we do not merely build a surveillance layer for the people logging in today; we set the template for how every A.I. agent proves itself tomorrow. Get it right, and we establish the framework—provable, private, portable—for the agent economy that follows. Get it wrong, and we hard-wire identity surveillance into the foundations of the internet, for people and machines alike. The technology to do it the right way already exists. The only question is whether policymakers choose to write it into law before a more invasive model becomes the internet’s default.