We must fight age verification with all we have
Age verification laws exploit the moral panic over social media and mental health to repackage old censorship tactics under the guise of protecting children.
I’ve been talking a lot over the past couple weeks about what an unmitigated disaster the rollout of identity verification has been in the U.K. I wrote a whole piece about it for The Guardian and a story about how these “child safety” crackdowns are a gift to big tech in Zeteo.
The UK’s rollout shows how digital ID systems lead to mass censorship. They serve those in power, harm human rights, and we have to do everything we can to fight their expansion in the U.S.
Today, I’m excited to present a guest post by Cynthia Conti-Cook, Rebecca Williams, and Pratika Katiya. These three women are doing incredible work fighting back against the surveillance state.
Cynthia is the Director of Research & Policy at Collaborative Research Center for Resilience, where she leads the Center’s Surveillance Resistance Lab. Rebecca Williams is a lawyer and senior strategist for privacy and data governance at the ACLU and teaches Information and Human Rights at Pratt Institute. Pratika Katiyar is a Gen Z activist focused on tech policy and free expression currently working in privacy and data governance at the ACLU.
As people on the left and right continue to boost these laws and spread misinformation about the dangers of identity verification, please consider supporting User Mag so we can continue to publish stuff like this. I cannot continue to publish this newsletter without your financial support.
Who Age Verification Laws Really Benefit & How to Resist
By Cynthia Conti Cook, Pratika Katiyar, Rebecca Williams
On July 25th, the UK became one of the first countries to widely enforce age verification online. Under the Online Safety Act, sites hosting content deemed “harmful” must verify that users are over 18 using any “reasonable” method.
Proponents claim this will protect children, but in practice, it restricts young people’s ability to learn, express themselves, and connect; creates a pretext for censoring political dissent; and concentrates more power in the tech industry.
Within a week, the rollout triggered unprecedented censorship, novel surveillance concerns, and a wave of workarounds, exposing how easily safety rhetoric can be weaponized to discriminate and control. Those harms will not just impact minors but also adults whose access to lawful information will be curtailed. Communities subject to political suppression, and anyone forced to hand over sensitive data to participate online will also become more vulnerable.
Now this model is moving beyond the UK, with YouTube preparing to launch age checks in the United States on Aug. 13, dozens of U.S. states advancing similar laws, and other countries following suit. Let’s unpack who age verification laws actually benefit, who they harm, and how we can resist oppressive ID checks online.
Age Verification Laws Are Safety Theater That Benefit Policing & Profits
Morality Policing & Safety Theater
Age verification laws exploit the moral panic over social media and mental health to repackage old censorship tactics under the guise of protecting children. Much like book bans across the United States, age verification proponents have performed a lot of concern for children and parents’ ability to control what information they have access to.
Like age verification, book bans began by targeting books that they claimed discussed sexuality. This quickly expanded to also include books discussing gender and racial identity–even histories of slavery and genocide became targets too sensitive for students to learn about. Meanwhile, a lawsuit filed in Texas last month claimed that abortion pills were “obscene material” under an 1873 anti-obscenity law, the Comstock Act, which has not been enforced in a hundred years.
Age verification, like book bans and obscenity laws, will not be narrowly used to prevent access to pornography–it will be used to “legislate morality,” control access to information and limit people’s freedom to self-manage their health and family well-being according to their own morals.
We know this is a moral panic and political theater and not a genuine effort to protect kids because while age verification systems excel at the blunt goals of surveillance and censorship, there is plenty of evidence that they are technically unable to effectively and equitably assess age or discreetly to “harmful” content. France’s Commission on Information Technology and Liberties (CNIL), Australia’s eSafety Commission, and the United States’ Federal Trade Commission have all found that current age verification technologies are unreliable.
These tools are not just inaccurate; they’re also easily manipulated. In the UK last week, some users bypassed Discord’s age verification system by holding up animated footage from the video game Death Stranding, using its photo mode to manipulate facial expressions and the liveliness requirements of these systems. Virtual private networks (or VPNs) obscure the location of a person accessing a site by routing traffic through servers in other regions.
VPNs have long been essential for people living under repressive regimes such as in China, Russia, and Iran, seeking to maintain anonymity and access censored information. Their use surged in the wake of the UK's age verification law, as people looked for ways to avoid handing over personal data just to browse online. However, platforms like YouTube are now reportedly detecting and blocking VPN usage, tightening enforcement, and creating an internet where freely traveling without submitting to digital ID checks is increasingly impossible.
Policing & Profit
Law enforcement and the government is pushing digital ID systems to feed information into expanding surveillance infrastructure. Age verification serves both policing and profit interests by collecting vast search histories and biometric data from young people.
Just like Facebook and McDonald’s have invested in products designed to hook future customers to their brand as early as possible, third-party digital ID and biometric vendors have invested in lobbying for age verification laws in order to collect as much lifelong data on future consumers as early as possible.
Because children often do not yet have government-issued IDs or credit cards, age verification laws ultimately required children to submit more invasive biometric and identifiable data instead. This can include not just a static selfie, but also more invasive capture of a wider range of biometric markers like facial movement, expressions, and behavioral patterns.
This data will be brokered, bought, sold, and pumped into tools that claim to predict children at risk of school discipline or criminal accusation. It may be used to recruit or push students into the military or other high-risk vocations.
Educational software technology companies are similarly creating data collection technology that tracks students from pre-K through graduation–data that can be combined with age verification data and added to profiles that will track children onto disciplinary, vocational, military, academic, or other tracks that prevent them from self-determining their life paths.
Despite known technical issues with age verification tools, the digital ID systems industry keeps pushing these solutions and tech companies keep buying them. Most large platforms use third-party age verification services that are members of the Age Verification Providers Association (AVPA). For example, Bluesky uses Kids Web Services, Reddit uses Persona, and Discord uses k-ID. AVPA lobbies for bills like the UK’s Online Safety Act, which is big business for their members.
Big Tech companies like Meta also profit from age verification laws. They can absorb the legal costs, automate moderation, and position themselves as compliant by default. Meanwhile, smaller platforms and public-interest projects like Wikipedia face impossible choices: restrict access, compromise user privacy, or risk penalties.
Age Verification Laws Oppress Us All
Free Speech & Censorship
Mandating age verification online has far-reaching consequences for free expression and other human rights. These laws often require users to upload sensitive ID documents like passports, driver's licenses, or biometrics to access lawful content. This can be particularly discouraging for those seeking information, especially on stigmatized or sensitive topics such as reproductive and sexual health.
Courts have long recognized these risks. In Reno v. ACLU (1997), the Supreme Court struck down a federal online age-verification law, affirming that such requirements place an unconstitutional burden on free speech and access to information.
Nevertheless, that precedent is starting to erode. Recently, states like Utah, Louisiana, and Texas have enacted laws requiring age verification to access certain online content, often under the guise of protecting minors, and these laws are holding up in court.
For example, in June, the U.S. Supreme Court allowed Texas’s age verification law to stand, while a Mississippi law requiring age checks for social media access was also permitted to go into effect despite legal objections. This shift signals a growing judicial tolerance for laws that restrict online expression and privacy, contradicting longstanding First Amendment precedent and paving the way for broader state-level crackdowns on digital access.
This moral panic isn’t just limited to access to pornography; it expands state and corporate control by chilling expression and thus creating a climate of self-censorship. Just like how some schools and libraries have become overly cautious about not stocking books that someone may be offended by, in the UK, similar dynamics are already playing out with age verification online. Under the UK’s Online Safety Act, Reddit users attempting to access subreddits covering war crimes in Gaza and Ukraine were required to post a selfie or provide a photo ID.
While some of the images on those subreddits were likely considered graphic, such requirements erode anonymity on the internet, a huge pillarstone of what allows free expression to flourish online, while also setting a dangerous precedent for accessing content that is seen as politically sensitive, opening up a pathway to further censorship. Spotify in the UK has been forcing all users to expose their faces for a biometric scan to access explicit content, aka pop songs and rap lyrics.
Privacy & Security
Beyond the harm to lawful speech, these mandates also introduce serious privacy and security risks by creating centralized troves of sensitive data that are not only attractive targets for hackers but also vulnerable to misuse by the platforms themselves.
Even in jurisdictions with stronger privacy laws like the UK’s GDPR, enforcement gaps remain. In the U.S. and elsewhere, where only a patchwork of protections exists, users have little control over how long their data is stored, who can access it, or how it’s used. In the name of protecting children, these laws may end up exposing everyone to greater harm.
The same week the UK’s Online Safety Act went into effect, a quintessential example of the privacy and security risks of digital ID systems emerged when driver’s licenses and selfies submitted to Tea, an app designed to protect women from harm while dating, were targeted. The exposed data was posted to 4chan, including embedded metadata to determine the women’s locations, and used the information to orchestrate targeted harassment campaigns, including creating a Hot-or-Not-style called Spill the Tea targeting the same women.
A similar exposure occurred last year, when AU10TIX, an identity verification vendor for TikTok, Uber, and others, left administrative credentials exposed online for over a year, demonstrating that this is not an isolated risk but a recurring consequence of collecting the identifying information demanded in digital ID systems.
Inequitable Application & Discrimination
These laws claim to protect all minors, but in practice, they are not applied evenly and often over-block, surveil, or exclude already marginalized youth exploring identity, sexuality, or mental health. First, age estimation tools not only fail to work reliably, they work even less well for people with darker skin tones, non-conforming gender presentations, and disabilities.
Platforms tend to over-categorize and gatekeep potential “harmful” content to avoid liability, further entrenching discrimination. In the UK, this has played out with Reddit effectively censoring LGBTQ+ forums by applying age verification, limiting access to vital identity-affirming spaces, and showcasing the discriminatory nature of these laws in application.
How to Resist Digital ID and Over-Verification
Age verification laws don’t just fail to protect children; the digital ID systems that enforce them fundamentally change how everyone accesses the Internet and will cause real harm.
Once the infrastructures of unique identification are constructed, it won’t only be advertisers profiling and microtargeting customers but states profiling and microtargeting any political opponents or other public enemies-du-jour. That is in addition to chilling free speech, restricting access to vital health and identity resources, disproportionately impacting historically oppressed communities, and forcing users to hand over sensitive biometric or government ID data to unaccountable third parties.
We must stop the harms caused by digital ID and paternalistic laws like age verification. We can resist with daily acts of resistance, organize, legislate real protections, and litigate.
Legislation & Litigation
It’s worth noting that online safety concerns can be addressed through known, less invasive means, as outlined in Australia’s eSafety Commission roadmap, and Eric Goldman’s recent “Segregate-and-Suppress” Approach to Regulating Child Safety Online,” which call for increased platform transparency, greater paternal support, digital literacy education for youth, and most importantly privacy protections that apply to everyone, not just minors.
When it comes to protecting children from sexual abuse, research shows that creating non-judgmental environments for children to seek help is far more effective than fueling moral panic. Given these known solutions and the harms of the “quick fix” of age verification, policymakers should stop the expansion of digital ID systems and reassess their purpose, protect human-centered infrastructure, redesign services to reduce dependence on online ID checks, and, if digital ID is used, ensure rights-based guardrails are in place from the outset.
Rather than complying with overbroad digital ID mandates, more organizations should follow the lead of those mounting legal challenges to defend an open internet.
In the U.S., the Center for Democracy and Technology (CDT) has joined an amicus brief with other free expression organizations, urging the Supreme Court to strike down a Texas censorship law that threatens core First Amendment protections.
Similarly, the Wikimedia Foundation attempted to challenge the UK’s Online Safety Act, arguing that its identity verification and content restrictions undermine users’ rights to access and contribute to knowledge anonymously. Unfortunately, the foundation lost the first round of its court battle on Monday, but may still appeal.
Women impacted by the Tea app’s data breach are banding together in a class action suit.
These lawsuits serve as critical reminders that compliance is not the only path forward, and that meaningful resistance through litigation is essential to preserving online anonymity, free expression, and privacy in the face of growing regulatory overreach.
This type of resistance is becoming increasingly urgent in the United States, where a wave of state-level age-verification laws threatens to reshape the internet for everyone. With 7 states considering age verification laws, and 19 taken or bound to take effect this year, lawmakers are testing the boundaries of the First Amendment, and the Supreme Court is poised to weigh in again.
The Mississippi law in NetChoice v. Fitch, on the Supreme Court’s shadow docket, requires platforms to verify user ages, secure parental consent, and shield minors from a wide swath of content, from discussions of suicide to images of “illegal activity.”
Under the Court’s own precedent in Brown v. Entertainment Merchants Association (2011), such a law would almost certainly fail the toughest constitutional test, as it restricts far more speech than necessary. Yet the Court’s recent decision in Free Speech Coalition v. Paxton, applying a looser standard to a Texas porn law, raises the possibility that Brown’s protections could be narrowed.
If that shift extends beyond pornography, states could gain far greater power to determine what young people can see and say online. The outcome of Fitch will reveal whether the Court’s Texas ruling was an outlier or the start of a broader redefinition of free speech, and whether the resistance to age verification and digital identity laws will have to grow even bolder.
Daily Resistance & Organizing
Every single day, we make decisions that have the power to erode the global digital identity complex that cops and corporations are building to tighten their net around all the information they can about all of us. What do you think they will do with that control?
The first step is resisting the idea that the future of digital identity is inevitable. Things like choosing to use cash when we can, choosing to check out with workers when we can, and opting out of digital options when we can, can create ripple effects that can slow the roll of surveillance creep.
Organizing is also crucial. In the UK, users began compiling a list of banned sites, and public outrage over the Online Safety Act led to a petition calling on parliament to repeal it that has already gathered nearly half a million signatures. One UK artist, David Gerard, created a satirical website, Use-their-id.com, critiquing the Online Safety Act and demonstrating how easy it is to generate fake IDs.
The most essential form of resistance is reaching out to your state and federal lawmakers and demanding protections against these bad tech policies. Educate your representatives about the harms of these laws, stage protests at their offices, and do whatever you can to stop or slow down digital ID efforts.
It is imperative to spread the word on the dangers of these laws, while also holding lawmakers accountable. Through organizing, speaking out loudly online and off, and consistently putting pressure on the lawmakers tasked with representing us, we can stop these laws before it's too late.
For steps you can take, see The Surveillance Resistance Lab’s Navigating Your State’s Digital ID System and Demands for Protecting Human Dignity and Choice from Digital Identification Systems, and join Fight for the Future’s stoponlineIDchecks.org, DependVPNs.com, and stopkosa.com campaigns.
Cynthia Conti-Cook is the Director of Research & Policy at Collaborative Research Center for Resilience, where she leads the Center’s Surveillance Resistance Lab work focused on digital public infrastructures, public sector procurement, and government’s evolving use of digital technologies.
Rebecca Williams is a writer, lawyer, and artist exploring how technology shapes power, government, and our relationships with one another. She is currently the Senior Strategist for Privacy and Data Governance at the ACLU, serves on the board of MuckRock, and teaches Information and Human Rights at Pratt Institute.
Pratika Katiyar is a Gen Z activist and writer focused on technology policy and free expression. She currently works in Privacy and Data Governance at the ACLU and advises the New England First Amendment Coalition.