In November 2024, Australia passed a law banning anyone under sixteen from using social media. The public reaction was predictable: finally, someone is doing something about the children. The headlines wrote themselves. The opposition barely registered as a whisper. Who would defend giving Instagram to a twelve-year-old? The argument felt airtight because it started from a premise nobody could dispute: children should be protected, platforms should be held responsible, and if a law achieves that, it is a good law. The problem is that the premise is not the law. The law is not about protecting children. The law is about building a machine that can verify the identity of every person who connects to the internet, and children are just the reason you were willing to turn it on.

The mechanics of Australia’s law have not been fully specified because they cannot be specified without revealing the contradiction at the center of the entire project. The law says platforms must take reasonable steps to verify age. It does not say what those steps are because the government knows that any specific method it names will trigger a political firestorm: upload your driver’s license to Facebook, scan your face with a government-approved app, insert a digital ID chip that follows you across websites. So the law leaves the implementation to the platforms, and the platforms, facing billion-dollar fines, will default to the most aggressive identification they can get away with. The vagueness is not a drafting error. It is a feature. It lets the government claim it never mandated ID checks while the platforms implement exactly that and blame the law for forcing them. Everyone gets what they want except the citizen, who gets a panopticon with a smiley face sticker on it.

Australia is not alone. It is not even the most aggressive. The United Kingdom’s Online Safety Act gives Ofcom the power to require age verification on any service it deems likely to be accessed by children, which in practice means every service, because no website can guarantee a child will not try to visit it. The European Union’s Digital Services Act mandates risk assessments for minors and has already produced regulatory guidance recommending age verification for platforms large and small. In the United States, the Kids Online Safety Act has been bouncing around Congress with bipartisan support so strong that the only real debate is how many ID checks to mandate, not whether to mandate them. Utah passed a law requiring social media platforms to verify the age of every user and obtain parental consent for minors. Arkansas, Louisiana, Texas, and Florida have passed or introduced similar legislation. The speed of this legislative wave is remarkable — in the span of three years, age verification went from a fringe idea floated by moral panic think tanks to a legal requirement in multiple G20 countries, all in the name of children who, it must be said, were also children during the thirty years the internet existed without anyone needing to prove it.

The rhetorical pattern is identical across every jurisdiction and every bill. A legislator stands at a podium and tells a story about a child who was harmed by something they saw online. The story is real, and the harm is real, and the emotional impact of the story makes it impossible to respond with technical analysis. Nobody wants to be the person explaining that perfect age verification is mathematically impossible while the parent of a bullied teenager is standing ten feet away. So the technical analysis never happens in public. It happens in standards bodies and cryptography conferences, where the people who actually know how identification systems work have reached the same conclusion for decades: you cannot verify age at scale without creating a surveillance infrastructure, and you cannot create a surveillance infrastructure without someone eventually using it for purposes you did not authorize.

To understand why, you need to understand what age verification actually requires. There are only three categories of methods, and all three are broken in ways that either destroy privacy or fail to work reliably. The first category is document-based verification: you upload a photo of your government ID, a third-party service checks it against a database, and returns a yes-or-no answer about your age. This sounds clean in theory because the platform never sees your ID. In practice, someone sees your ID. The verification service sees your ID. That service now has a database containing the government documents of millions of people, each one linked to an account on a social media platform. This database is a target. It cannot be made secure because no database containing millions of high-value identity documents has ever remained secure. The Office of Personnel Management breach, the Equifax breach, the Aadhaar breach in India — these were government and financial institutions with security budgets larger than any age verification startup. They all failed. An age verification database would be smaller, less experienced, and holding documents tied directly to social media accounts, which is a strictly more valuable target for stalkers, blackmailers, and repressive governments who would very much like to know which citizens are reading dissident content on which platforms.

The second category is biometric estimation: the system looks at your face through your camera and estimates your age using a machine learning model. Yoti, one of the leading vendors in this space, claims its system can estimate age to within about three years for most demographics. The problem is that “most demographics” is doing a lot of work. Multiple independent studies have found that these systems perform significantly worse on people with darker skin, on women who appear older than their chronological age, and on anyone whose facial geometry does not match the training data distribution. A sixteen-year-old who looks eighteen gets through. A twenty-five-year-old who looks young gets blocked. A forty-year-old Black woman gets estimated as seventeen and locked out of her LinkedIn account. The false-positive and false-negative rates are not theoretical edge cases — they are baked into the statistical nature of the technology, and they distribute unevenly across populations in ways that reinforce existing patterns of discrimination. But even if the accuracy were perfect, the privacy problem remains: to estimate your age, the system must capture and process your face. You are now doing biometric authentication to read a news article. The difference between facial age estimation and facial recognition is a few lines of code, and the same camera, the same sensor, and the same software stack already support both.

The third category is the only one that privacy researchers consider acceptable: zero-knowledge proofs and cryptographic age credentials. In this model, a trusted authority issues you a signed credential that says you are over sixteen, and you present a zero-knowledge proof of that credential to any service that asks, without revealing your exact age, your name, your document number, or anything else. The service learns exactly one bit of information: this person is over the threshold. This is mathematically possible and has been demonstrated in research systems. It is not deployed in production anywhere at national scale because it requires solving coordination problems that make the technical problems look easy. Every citizen needs a secure device capable of generating zero-knowledge proofs. Every issuing authority in every country needs to implement the same credential format. Every platform needs to integrate the same verification protocol. The global identity infrastructure required to make ZK age proofs work is roughly the same infrastructure required to make digital ID work, and governments that are pushing age verification are, entirely coincidentally, also pushing digital ID.

The common thread across all three methods is that they collapse anonymity. Document verification creates a database linking real identities to platform accounts. Biometric estimation requires capturing and processing biometric data. Cryptographic credentials require a universal identity issuance system. There is no fourth option. There is no way to verify age without anchoring the verification to something that identifies you. The people designing these laws know this. They are not confused about the technical trade-offs. They are counting on you to discover the trade-offs after the infrastructure is built, because by then it will be too expensive to tear down and too useful for law enforcement to surrender.

What makes this wave of legislation different from previous attempts at internet control is the attack surface it targets. Earlier efforts focused on content. Copyright holders wanted ISPs to block The Pirate Bay. Governments wanted platforms to remove terrorist propaganda. Religious groups wanted filters on pornography. These were content-level interventions, and content-level interventions can be routed around. You can use a VPN to reach a blocked site. You can move from a censored platform to an uncensored one. You can encrypt your traffic so nobody sees what you are reading. Content control is a game of whack-a-mole that censors lose because the architecture of the internet routes around blockages by design.

Age verification does not attack content. It attacks access. You cannot route around a system that blocks you from opening the browser. You cannot encrypt your way past a check that demands your face before the app launches. You cannot switch platforms when every platform is required by law to verify age. The choke point moves from the destination to the origin, and the origin is you. Your device. Your camera. Your identity documents. This is a structural shift in how the internet is controlled, and it is far more dangerous than content filtering because there is no circumvention. The only way to evade universal age verification is to be invisible to the verification system, and the only way to be invisible is to not use the internet as we know it.

The surveillance potential of this infrastructure is not an accidental side effect. It is the primary value proposition for governments that have spent twenty years failing to build mandatory digital ID through the front door. Australia’s own Digital ID Bill passed in 2024 alongside the social media ban, and the age verification requirements of one feed directly into the adoption incentives of the other. The UK has been trying to build a national identity system since the early 2000s, and every attempt has failed because people do not want to carry a government ID card. But people do want to protect children. Frame age verification as a tool for protecting children, and suddenly you have a reason to build the identity infrastructure that was rejected when it was framed as an ID card. The children are not the beneficiaries of these laws. They are the packaging.

The cost of this packaging is the end of anonymous internet access for everyone who is not technically sophisticated enough to evade it. Whistleblowers cannot leak documents to journalists if accessing the journalist’s secure drop requires facial verification. Political dissidents cannot organize on encrypted platforms if those platforms must verify age before allowing an account. Domestic abuse survivors cannot search for help without leaving a trace if every search engine requires proof of identity. LGBTQ teenagers in countries where homosexuality is illegal cannot find community online if every social network knows exactly who they are and exactly how old they are. These are not hypothetical scenarios. They are the daily reality of millions of people who depend on internet anonymity not for convenience but for survival. Age verification laws do not carve out exceptions for them because the laws were not designed to. They were designed to identify everyone, and exceptions defeat the purpose.

None of this is to deny that children face real problems on today’s internet. They do. Social media platforms have demonstrated, consistently and across multiple leaked internal studies, that their products harm the mental health of teenagers and that they know it and do nothing about it because engagement metrics go up when teenagers feel anxious and inadequate. The problem is real, and the anger at platforms is justified. But the premise that age verification is the solution requires believing a sequence of claims that do not survive scrutiny: that the platforms, which have failed at every other form of content moderation, will somehow succeed at age verification; that the verification infrastructure, once built, will only be used for verifying age and never for anything else; that governments which have spent decades expanding surveillance capabilities will voluntarily restrict themselves to a narrow interpretation of a child safety mandate; and that the children, who grew up with the internet and are far better at navigating it than their parents, cannot bypass a system that asks for a birthday before showing a video.

The last point deserves emphasis because it exposes the absurdity at the center of the entire project. The children these laws claim to protect are the same children who jailbreak school iPads, install VPNs to bypass content filters, and create TikTok accounts with fake birthdays in the time it takes their parents to pour a cup of coffee. A sixteen-year-old who wants to use Instagram will use Instagram. They will borrow an older sibling’s phone. They will use a parent’s account. They will register with a fake ID purchased for cryptocurrency on a darknet market. They will route their traffic through a server in a country that does not enforce age verification. The only people who will be stopped by age verification are the people who lack the technical skill or the financial resources to bypass it, and those people are disproportionately poor, elderly, less educated, and already marginalized from digital life. The law does not protect children from social media. It protects affluent, technically literate children from social media while building a surveillance system that affects everyone else.

There is an honest conversation to be had about children and the internet, and it looks nothing like the conversation that produced these laws. It starts with digital literacy education that teaches children how algorithms manipulate attention, how recommendation engines create filter bubbles, and how to recognize the difference between content that informs and content that exploits. It includes parental controls that operate at the device level, where parents who know their children can decide what is appropriate without involving a government database. It requires platforms to redesign their products to reduce addictive patterns — chronological feeds instead of algorithmic ones, rate limits on infinite scroll, friction on sharing — rather than pretending they can keep children out entirely while keeping their engagement-maximizing architecture intact. It acknowledges that different ages need different protections and that a flexible, family-level approach is more effective than a binary government checkpoint. These are real solutions to a real problem, and none of them require anyone to upload a driver’s license. They are also slower, harder to legislate, and do not produce a database. This is why governments reach for age verification instead.

The age verification laws being passed around the world today are not about children. They are about identity, and children are the justification that makes identity mandates politically viable. The pattern is by now well-rehearsed: a genuine social problem is identified, a technical solution is proposed that happens to require universal surveillance, and anyone who objects is accused of not caring about the problem. It worked for terrorism after September 2001 and produced mass surveillance programs that were later declared illegal. It worked for child sexual abuse material and produced client-side scanning proposals that would break encryption. It is working now for teenage mental health and will produce a global age verification infrastructure that identifies every internet user. By the time the public realizes that the infrastructure is being used for purposes beyond child safety, the infrastructure will be too entrenched to dismantle. The playbook is not new. Only the justification changes.

The question to ask about any age verification proposal is not whether it will protect children. The question is whether it can be built without destroying the anonymity that makes the internet worth having. The answer, known to every cryptographer and privacy engineer who has studied the problem, is that it cannot. Age verification at internet scale is identification at internet scale, and identification at internet scale is the end of the internet as a space where you can read, write, and speak without proving who you are first. You do not have to be a privacy absolutist to find that trade unacceptable. You just have to remember that the internet you grew up with never asked for your ID, and the children turned out fine.