Age Verification Laws: Why 'Protecting Kids Online' Is the Wrong Tool

“The road to surveillance hell is paved with child-safety intentions.”

Across the United States, state legislatures and Congress are racing to pass laws requiring websites — social media platforms, news sites, forums, health resources — to verify the age of every visitor before granting access. The motivation is real: young people do face genuine harms online, from algorithmic radicalization to predatory content to social media’s documented effects on mental health.

The Klamath Tech Collective takes those harms seriously. We work with youth in our community. We care about protecting them.

And we are deeply opposed to age verification mandates.

Not because we don’t care about children — but because these laws will not protect them, and will cause serious, lasting harm to everyone else.

What These Laws Actually Require

#

Age verification mandates typically require websites to confirm that a user is above a certain age (usually 13 or 18) before they can access content the law deems potentially harmful. To do this, websites must collect identity documents — government IDs, credit card numbers, biometric scans, or third-party verification services.

Some current and recent laws:

• KOSA (Kids Online Safety Act) — federal bill that has moved through Congress in multiple forms, requiring platforms to restrict minors’ access and verify ages
• State laws — Utah, Louisiana, Texas, Arkansas, Virginia, and others have passed or proposed age verification requirements for social media and adult content sites
• STOP CSAM Act and similar — additional federal proposals tying platform liability to age verification compliance

These laws are spreading rapidly. Several are already in effect or facing legal challenges. The architecture they require is being built right now.

The Privacy Catastrophe

#

Here is the fundamental problem: you cannot verify someone’s age without first identifying them.

Every age verification system is, by definition, an identity verification system. To prove you are over 18, you must prove who you are. That means:

• Uploading a government ID (driver’s license, passport)
• Using a credit card (linked to your legal identity)
• Submitting to a biometric scan
• Using a third-party verification service that holds your data

Every one of these methods creates a linkage between your real-world identity and your online activity. The Electronic Frontier Foundation calls this one of the most dangerous aspects of age verification: it creates “surveillance systems that critically undermine online privacy” by demanding “sensitive and immutable personal information that links offline identity to online activity.”¹

Once that link exists, it can be breached, subpoenaed, shared, or sold. The EFF has documented multiple data breaches at age verification providers — companies that now hold the identity documents of millions of people, linked to which sites those people visited.¹

Think about what that means for the specific types of sites pushing age verification:

• A person researching an abortion in a state where it is criminalized
• A young person looking up information about their sexuality or gender identity
• A domestic violence survivor researching their situation
• A whistleblower researching how to report wrongdoing
• A journalist investigating extremism by reading extremist sites

All of these people must now hand their identity to a third-party database to access information they have every right to access. The database can be hacked. It can be subpoenaed. It can be sold. It can be handed to a government agency.

The infrastructure required to “verify ages” is identical to the infrastructure required to surveil internet use at the population level. Once built, it will be used for purposes far beyond protecting children.

The Free Speech Collapse

#

The First Amendment has been understood for decades to protect the right to read, research, and receive information anonymously. The Supreme Court recognized anonymous speech as a core constitutional right in McIntyre v. Ohio Elections Commission (1995). Age verification mandates directly undermine this.

But the censorship problem goes beyond surveillance. Age verification systems do not surgically target harmful content — they create gates that must be passed before accessing any content the law deems potentially “harmful to minors.” That category has historically been stretched far beyond pornography to include:

• Sex education and reproductive health information
• LGBTQ+ content and community spaces
• Drug harm reduction information
• Political content deemed “inappropriate”
• News coverage of violence or conflict

As the EFF argues, age gates function as “tools of censorship, used to block people from viewing or sharing information that the government deems ‘harmful’ or ‘offensive’” — burdening “the expressive rights of adults and young people alike.”¹

Courts have repeatedly struck down internet censorship laws aimed at protecting minors because they impose unconstitutional burdens on adult speech. But the age verification approach is a workaround: by requiring identity verification rather than directly blocking content, lawmakers hope to achieve the same censorship effect while evading First Amendment scrutiny.

Adults who are unwilling to surrender their identity — for entirely legitimate reasons — will simply not access the content. The chilling effect is the point.

Who Gets Hurt Most

#

Age verification mandates are not neutral in who they harm. The EFF identifies the populations most affected:¹

People seeking sensitive health information — including abortion access, contraception, STI testing, mental health resources. In states where healthcare is criminalized or surveilled, connecting your identity to these searches has real legal consequences.

LGBTQ+ youth and adults — seeking community, information, and support in environments that may be hostile at home. Many rely on anonymous access to online spaces to safely explore their identities. Mandatory identification destroys that safety.

Survivors of domestic violence and stalking — who may need anonymous access to legal resources, support communities, and safety information without their abuser knowing.

Immigrants and undocumented people — for whom any expansion of identity-verification databases carries heightened risk.

Small and independent platforms — who cannot afford the compliance costs of building age verification infrastructure, effectively driving internet consolidation toward only the largest corporations who can. The EFF notes this “favors Big Tech” over independent platforms, community spaces, and nonprofits.¹

Rural and low-income people — who may lack the government ID or credit card required by verification systems, effectively locking them out of the internet.

Why These Laws Won’t Work

#

Leaving aside the harms, the central premise is flawed: age verification does not stop determined young people from accessing content online.

Every researcher who has studied this agrees. Young people will:

• Use a parent’s or sibling’s account or device
• Use a VPN to route around geographic restrictions
• Use friends’ credentials
• Find the content on platforms that aren’t compliant

Meanwhile, the compliance burden falls entirely on domestic, law-abiding platforms — driving users toward foreign sites, dark web alternatives, or peer-to-peer networks with no moderation at all. The unintended consequence of aggressive age verification may be to push the internet underground, away from any accountability.

A 2024 Stanford Internet Observatory study found that age verification requirements had minimal effect on minors’ access to restricted content while significantly burdening adult users. The Australian government, which has been one of the most aggressive in pursuing these policies, found similar results in its own commissioned research.

The harms age verification is meant to address — algorithmic manipulation, predatory advertising, social comparison, engagement-maximizing design — are design problems, not access problems. A thirteen-year-old who cannot get onto Instagram will find a way. A thirteen-year-old on an Instagram that is legally prohibited from tracking them, manipulating their feed for engagement, or targeting them with predatory advertising is actually protected.

What Would Actually Help

#

The EFF, along with most digital rights organizations, advocates for approaches that protect young people without building surveillance infrastructure:¹

• Comprehensive data privacy law — prohibiting targeted advertising to minors, limiting data collection on young users, and requiring algorithmic transparency. This actually addresses the design problems that cause harm.
• Platform design standards — requiring default privacy settings, limiting engagement-maximizing features for minor accounts, and banning addictive dark patterns.
• Meaningful enforcement of existing law — COPPA (Children’s Online Privacy Protection Act) already prohibits collecting data on children under 13 but is chronically underenforced.
• Digital literacy education — exactly what the Klamath Tech Collective does: teaching young people and their families to understand how these systems work, how to protect themselves, and how to think critically about what they encounter online.

None of these require every internet user to hand their identity documents to a third-party database. None of them build the infrastructure of universal surveillance. All of them actually target the documented harms.

The Irreversibility Problem

#

Here is why this matters beyond any single law: infrastructure, once built, does not disappear when the political winds change.

If the United States — or enough states — requires age verification infrastructure to be built into the internet’s architecture, that infrastructure will exist. It will have been paid for. Corporations will have built business models around it. Law enforcement will have begun using it. Other governments will point to it as justification for their own, more authoritarian, versions.

The internet has survived decades of attempts to impose centralized control over it partly because the technical architecture made mass surveillance difficult. Age verification mandates are an attempt to solve that problem — to retrofit identity infrastructure onto a network designed for anonymous communication.

Once that retrofit is in place, it can be used for purposes that have nothing to do with children. A future government hostile to political opposition, to reproductive rights, to religious minorities, or to Indigenous sovereignty movements will find ready-made infrastructure to monitor and control who accesses what.

This is not a hypothetical. It is how surveillance infrastructure has worked everywhere it has been built. The question is not whether it will be abused, but when and by whom.

What Parents, Guardians, and Mentors Can Actually Do

#

If you are raising or mentoring a young person and genuinely worried about what they encounter online — you are right to be. The harms are real. But handing ID documents to a database or hoping a corporation’s age gate holds are not the answer. Here is what actually works.

Start with the Devices Themselves

#

Know what’s installed. Sit down together and go through the apps on their phone. Ask what each one is for. This is not surveillance — it is the same thing you would do with any powerful tool you handed a young person. Make it a conversation, not an inspection.

Use the built-in parental controls, selectively and transparently. Both Android and iOS have parental control features. The key word is transparently — young people who know why limits exist and feel respected by them are far more likely to work with you than around you.

• Android: Settings → Digital Wellbeing & Parental Controls → Parental Controls (or use Google Family Link for younger kids)
• iPhone/iPad: Settings → Screen Time — set app limits, content restrictions, and communication limits

Set up a shared device for younger children rather than giving them a personal smartphone. A tablet kept in a common space, without cellular data, dramatically limits exposure without requiring surveillance infrastructure.

Router-level filtering — if you want to block certain categories of content for everyone on your home network, tools like Pi-hole (free, open-source, runs on a Raspberry Pi) or NextDNS let you block entire categories of sites at the network level. This is more effective than per-device filtering because it covers every device, including game consoles and smart TVs.

Teach, Don’t Just Restrict

#

Restrictions without understanding breed workarounds. Every young person who understands why something is harmful is more protected than one who just can’t access it at home.

Talk about how algorithmic feeds work. Explain that the platform’s job is to keep them scrolling, not to show them what’s good for them. Once a young person understands that the “For You” page is an engagement machine optimized for their specific psychological triggers, they look at it differently.

Teach them to recognize manipulation. Outrage content, sensationalism, “you won’t believe this” headlines, accounts that always make them feel bad about themselves — help them name these patterns and make conscious choices.

Talk about data and privacy in terms they can relate to. Would they hand a stranger on the street a list of everyone they talked to today, and what they said? That is what most apps collect by default. Making it concrete makes it real.

Walk through our Privacy 101 guides together. Setting up a password manager or switching browsers is a good project to do side by side. It builds skills and opens conversation.

Recommended Tools for Families

#

A note on Bark: it sits between full surveillance (reading all messages) and no oversight. It monitors for specific risk patterns and alerts you rather than showing you everything. Whether that tradeoff fits your family is worth thinking through — we mention it because it exists, not as a blanket recommendation.

The Conversation Is the Protection

#

No technical control replaces an ongoing relationship where a young person trusts that they can come to you when something online makes them uncomfortable, confused, or scared — without fear of having their phone taken away.

Research consistently shows that young people who feel they can talk to a trusted adult about what they experience online are significantly safer than those who cannot, regardless of what technical restrictions are in place.

That relationship is built over time, through small conversations, not crisis interventions. The best protection you can give a young person online is the same as offline: they know you will listen without punishing them for being honest.

• Contact your representatives — at the state and federal level — and tell them you oppose age verification mandates. The EFF’s Action Center (act.eff.org ) has tools for this.
• Read the EFF’s coverage — they track these laws as they move through legislatures: eff.org/issues/age-verification
• Use and support tools that protect anonymous access — Tor Browser, VPNs, private browsers (see our Privacy 101 guides)
• Talk to young people in your community — about how algorithmic systems work, how to recognize manipulation, and how to protect their own privacy. Informed young people are more protected than gated young people.

This page reflects the Collective’s ongoing engagement with digital rights policy. Have resources to add, or want to discuss this in person? Reach us at contact@klamathtech.diy .

Stay updated through our mailing list:

Subscribe

Klamath Tech Collective Mailing List
Opt-in to the Klamath Tech Collective Mailing List to receive updates and announcements around events, workshops, news, meetings, fundraisers, etc.