Online age-verification tools spread across U.S. for child safety, but adults are being surveilled

Recent U.S. legislation aimed at safeguarding minors is inadvertently dragging millions of adults into mandatory age-verification processes to access online content. This development has sparked significant backlash from users and raised alarms among privacy advocates about the potential erosion of a free and open internet. Approximately half of the states in the U.S. have implemented or are considering laws that require platforms—including adult content sites, online gaming services, and social media applications—to prevent underage access, compelling companies to verify the age of all users at digital entry points. Joe Kaufman, the global head of privacy at Jumio—one of the leading digital identity verification platforms—notes that the varying state laws present a complex landscape, with differing technical requirements and compliance expectations. "The regulations are moving in many different directions at once," he commented. In February, Discord announced plans to introduce a global mandatory age verification system, intending to employ methods that conduct facial analysis on users' devices, with any submitted data being deleted immediately. However, this proposal faced backlash from users apprehensive about sharing selfies or government IDs, prompting Discord to postpone the rollout until later this year. "We knew this rollout was going to be controversial. Any time you introduce something that touches identity and verification, people are going to have strong feelings," stated Stanislav Vishnevskiy, Discord's chief technology officer. Platforms offering adult content or financial services typically require comprehensive identity verification, which involves scanning a government-issued ID and matching it to a live image. The verification systems used—often managed by specialized vendors—rely heavily on artificial intelligence technologies such as facial recognition and age estimation to quickly determine if users are of legal age. Vendors face the challenge of ensuring user safety while minimizing friction in the verification process. Rivka Gerwitz Little, chief growth officer at identity verification platform Socure, emphasized the need for a balance, stating, "We want to keep minors safe while allowing adults access with as little friction as possible." However, many users find these mandatory checks invasive, with some seeking workarounds through prepaid cards or unauthorized channels, which could lead to increased piracy. In many cases, the identity information is processed and stored by verification vendors rather than the platforms themselves, returning only a pass-fail signal to the websites. Socure assures that it does not sell verification data and maintains minimal records for lightweight age-estimation scenarios. Yet, in more thorough identity verification contexts, such as those needed for gaming and fraud prevention, data may be retained for compliance purposes for up to three years. Civil liberties advocates highlight the risks associated with consolidating large volumes of identity data with a few vendors, making them attractive targets for hackers. Discord recently experienced a data breach, exposing ID images of around 70,000 users, underscoring the security vulnerabilities linked to storing sensitive information. Expanded age verification systems not only pose usability challenges but also represent a significant shift in how personal identity is tied to online activities. Molly Buckley, a legislative analyst at the Electronic Frontier Foundation, warned that age verification could link users' most sensitive data—names, birthdays, and addresses—to their online behavior. "Age verification strikes at the foundation of the free and open internet," she asserted. While regulators argue that age-verification laws are necessary to protect young users from harm, they stress that companies must adhere to strict privacy standards. Existing consumer protection regulations require businesses to limit data collection and safeguard confidentiality. Virginia's attorney general's office emphasizes that maintaining strong verification and data handling standards is crucial for protecting young users. However, Virginia's age-verification law faced a setback when a federal court temporarily blocked its enforcement, siding with a First Amendment challenge from a trade group representing major social media companies. In response, Attorney General Jay Jones affirmed the commitment to protect Virginia's children from the harms of unrestricted access to online content. Buckley argues that lawmakers shouldn't have to sacrifice privacy for safety. Instead, she advocates for a comprehensive federal privacy law that empowers users to control their data. Other countries, including the UK and Australia, already have age verification laws in place, and U.S. platforms are navigating how to implement such measures amid ongoing controversy. As age-verification laws proliferate, industry experts predict a shift towards systems that allow for persistent age verification across platforms, creating a digital proof of age that could streamline access while maintaining security. This evolving landscape suggests that identity verification may become an integral part of the online experience, particularly for adults, as platforms aim to comply with regulations while addressing privacy concerns.