Age verification (or age-gating) laws generally require online services to check, estimate, or verify all users’ ages—often through invasive tools like ID checks, biometric scans, or other dubious “age estimation” methods—before granting them access to certain online content or services. 

Governments in the U.S. and around the world are increasingly adopting these restrictive measures in the name of protecting children online. But in practice, these systems create dangerous new forms of surveillance, censorship, and exclusion. 

Technologically, the age verification process can take many forms: collection and analysis of government ID, biometric scans, algorithmic or AI-based behavioral or user monitoring, digital ID, the list goes on. But no matter the method, every system demands users hand over sensitive and immutable personal information that links their offline identity to their online activity. Once that valuable data is collected, it can easily be leaked, hacked, or misused. (Indeed, we’ve already seen several breaches of age verification providers.)

EFF has long warned against age-gating the internet. Age verification technology itself is often inaccurate and privacy-invasive. These restrictive mandates strike at the foundation of the free and open internet. They are tools of censorship, used to block people from viewing or sharing information that the government deems “harmful” or “offensive.” And they create surveillance systems that critically undermine online privacy, chill access to vital online communities and resources, and burden the expressive rights of adults and young people alike.

TAKE ACTION

Don't let congress censor the internet

Age Verification Won’t “Protect the Children”

We all want young people to be safe, but age verification is decidedly not the silver bullet solution to young people's online safety that regulators and corporations want you to think it is. 

First, age verification mandates diminish the safety that comes with online privacy. For decades, we've rightfully taught young people this simple rule: don’t share personal information with strangers. But age verification laws fly in the face of that longstanding internet safety norm by requiring users to hand over their real names, real faces, real proof of their real life identities—and in some cases, their parents’ identities too—just to use basic online services. These mandates will make it harder to distinguish between legitimate services and scams, creating new opportunities for fraud and identity theft. If adults struggle to tell the difference, how can we expect our children—whose data is even more valuable to data thieves—to fare any better? 

Second, age verification mandates threaten the safety that comes with empowering young people’s autonomy and allowing them broad access to important information. Young people across the world have the right to freedom of expression. In the United States, that means their right to access information and to communicate with others is protected by the First Amendment. Cutting off young people’s access to the internet will not only erase their important voices and perspectives, but could also impact their development, ability to form offline relationships, and autonomy. After all, social media sites are not just for entertainment; they provide space for young people to explore their identities—whether by creating and sharing art, practicing religion, or engaging in politics. Blocking our youth from these diverse spaces robs them of opportunities to develop as individuals and participate in public life, and to find safety in supportive online communities that they can’t always access in the physical world. 

Third, it is impossible to define what’s “appropriate” for everyone under 18. Each young person is different, shaped by their family, cultural background, and maturity level. It makes little sense to treat all people under 18 the same—and what’s “appropriate” for a 6-year-old is not the same for a 17-year-old. Yet age verification mandates commonly treat all young people the same, erasing that critical nuance.

In the end, it’s families—not lawmakers or tech companies—who are best positioned to meaningfully guide their young people’s online lives. Open, honest conversations with young people about privacy, safety, and digital literacy are far more effective safety measures than blanket age-gating restrictions that hand those important decisions over to the government. And for those parents who do want some digital assistance guiding their children’s internet use, there are already plenty of existing parental controls they can use to customize nearly every level of the user experience—without forcing the entire internet to show ID at the door. 

Age Gates Threaten the Expressive Rights of Every Internet User

At its core, age-restrictive legislation is a harmful censorship regime masquerading as an online safety measure. But it's important to know that this kind of mandate doesn't just affect young people. After all, in order to restrict access for one select age group, platforms must require every user to prove they are old enough to enter. 

There are millions of U.S. adults who could be effectively locked out of much of the internet by draconian age verification measures because they lack valid government ID. Many more, including undocumented people, unhoused people, trans and nonbinary individuals, and survivors of abuse, have good reasons to keep their real-world identities separate from their online lives. Age gates risk turning huge parts of the web into closed spaces for the “verified,” cutting off access to protected speech and vital information.

These laws also hand governments the power to arbitrarily decide what speech is “harmful.” These definitions are often vague, subjective, and unscientific, causing platforms to over-censor user content (or shut down entirely) to avoid punishment. Indeed, we’ve already seen platforms respond to age-verification mandates in the U.S. and abroad by censoring or blocking things like LGBTQ+ resources, reproductive health information, global news, and political organizing spaces. 

In the U.S., anonymity is a fundamental cornerstone of free expression. Around the world, it has protected journalists, whistleblowers, and activists. But age verification laws threaten to tie your most sensitive, immutable data—your name, face, birthday, and home address—to your online activity, ruining your anonymity in the process. 

Blocking entire communities or resources because of their subject matter does not make the internet safer; rather, it silences the people who rely on those online spaces for life-saving support, education, or safety. 

Age Verification Systems Are Surveillance Systems

Here’s the kicker: the technology being used to implement these mandates isn’t even up for the task. Age estimation and ID verification tech is clunky at its best, and discriminatory at its worst. And every age-verification system is, at its core, a surveillance system. 

While there are several different age-checking methods on the market, there is no technology available that is entirely privacy-protective, fully accurate, and that guarantees complete coverage of the population. Facial-recognition systems are notoriously unreliable for marginalized communities, and commonly misjudge age based on skin tone, gender, and disability. And ID- or data-based systems exclude those who either don’t have ID or whose appearance doesn’t match their current documents. 

The most common method of age verification—uploading a photo of your government ID along with a “live” selfie or video—is far more invasive than an in-person ID check. Online, there’s no way for users to verify that their private information has been deleted, or to ensure that it won’t be copied, sold, or stolen. Companies that claim to delete personal data such as IDs—including age verification companies—have already experienced data breaches, and the more data a company collects, the more likely the chance of a data breach. 

Alternative approaches, like facial age estimation or behavior tracking, aren’t safe either. They rely on algorithms or AI systems with high error rates, particularly when it comes to estimating age across race and gender lines. Other schemes link users to financial databases or digital ID systems, worsening discrimination and excluding people in the process. Finally, as EFF has shown, even promising technologies like zero-knowledge proofs or VPNs can’t solve the underlying problem when the law itself is flawed.

These mandates create irresistible targets for hackers and governments alike, normalizing constant ID checks across the web and defying long-standing internet safety norms in the process. No one should have to sacrifice their privacy or anonymity in order to exercise their free speech rights online.

Help Us Fight Back

Age verification laws give governments and corporations the power to decide what we can see, say, and share—and to track who we are while we do it. 

EFF is fighting back by challenging these unconstitutional laws in court, pushing lawmakers to reject them before they pass, and helping communities protect their rights to privacy, anonymity, and free expression online. 

Ready to join us? Urge your state lawmakers to reject harmful age-verification laws. Call or email your representatives to oppose KOSA and any other proposed federal age-checking mandates. Make your voice heard by talking to your friends and family about what we all stand to lose if the age-gated internet becomes a global reality. Because the fight for a free internet starts with us.