Age Verification for Social Media and the Future of Internet Privacy

Age Verification as a Gateway to Systemic Identity Verification

Mandatory age verification for social media is fundamentally a shift toward universal identity verification, creating a permanent link between real-world identities and online activity. While framed as a measure to protect children, these systems typically require users to provide government-issued IDs or credit card information to a service provider or a third-party verifier, effectively eliminating anonymity for millions of users.

This shift creates significant risks for freedom of expression and information. When identity is tied to every interaction, the "chilling effect" encourages self-censorship, as users fear that current opinions may lead to future personal or legal consequences. In several jurisdictions, this is already a reality:

  • United Kingdom: Authorities have arrested individuals for posting content deemed "grossly offensive."
  • Germany: Police have conducted raids on individuals for insulting politicians online.
  • Canada: Emergency acts were used to identify social media demonstrators and freeze their bank accounts.

The Global Expansion of Age Restrictions

Governments worldwide are rapidly implementing or proposing age-based restrictions on social media and harmful content. The trend has moved beyond simple guidelines to legally mandated blocks:

  • Implemented: Australia (under 16), Indonesia, and Brazil have introduced social media age restrictions.
  • Approved/Pending: Denmark, Portugal, and Malaysia have approved restrictions; proposals are active in Spain, Turkey, Germany, and Sweden.
  • Under Discussion: The Czech Republic, Greece, Austria, Poland, Canada, Slovenia, and the Netherlands are considering similar bans.
  • United States: Approximately half of all states have pending or active legislation imposing age restrictions on social media or inappropriate content.

The Slippery Slope: From Apps to Operating Systems and VPNs

As users bypass national restrictions using digital tools, governments are expanding the scope of verification to the infrastructure level. This progression moves from the application layer to the operating system (OS) and network layers.

Targeting VPNs

Because VPNs are the primary tool for bypassing geographic restrictions, they have become a target for regulation. In the UK, legislation now grants the government power to introduce restrictions via secondary legislation, with hints that identity verification for VPN usage may be considered. Similarly, France and the US (specifically Utah) have explored or implemented laws making it illegal to circumvent restrictions using a VPN.

OS-Level Verification

Control is shifting toward the devices themselves. In the UK, Apple implemented identity verification on iPhones via a system update in March 2026, forcing 35 million users to verify their identity to avoid automatic web content filters and communication monitoring. Brazil and California have also pursued laws requiring identity verification at the OS level, including requirements that extend to open-source systems in Brazil's case.

The EU Approach and the Zero-Knowledge Proof Alternative

The European Commission has proposed a privacy-focused age verification app based on the concept of credentials. Instead of sharing a full identity with a website, a user presents a credential issued by a member state that confirms they meet the age requirement without revealing their identity.

However, technical critics point out a critical flaw: the issuer (the state) still knows which credentials were issued to whom. Without Zero-Knowledge Proof (ZKP) cryptography—which allows a user to prove a statement is true without revealing the underlying data—the state can still link a credential back to a specific citizen if requested by a platform.

Currently, the EU app lacks full ZKP functionality and is designed to fall back to a non-ZKP model, meaning the infrastructure for state-linked identity verification is being built even if privacy features are promised for the future.

Community Perspectives and Counter-Arguments

Technical discussions surrounding these mandates reveal a deep divide between those prioritizing child safety and those prioritizing systemic privacy.

Arguments for Restrictions

Some argue that the "slippery slope" is a necessary trade-off for child protection. One perspective suggests that the internet is naturally evolving toward a licensed and regulated model, similar to the early days of radio. Others argue that the responsibility should remain with parents through better tooling, such as:

"Improve tooling for parents that allow more centralized control instead of mandating social media to do the age verification on their end."

Arguments Against Restrictions

Critics argue that the "protect the children" narrative is a pretext for mass surveillance. They point out that Big Tech companies already possess the data necessary to identify children and could block them without requiring government-mandated ID uploads. Others suggest that the only way to truly protect children is to dismantle the surveillance capitalism business model:

"If algorithmic social media would be prohibited from offering their services for free, it would solve most of the problems... Kids would basically disappear if their parents are not paying for them."

Technical Alternatives

Community members have proposed several alternatives to identity verification:

  • TLD-based blocking: Creating specific Top-Level Domains (e.g., .social) that parents can block at the router level.
  • Local OS settings: Allowing parents to set an age on a local account that apps can query without sending data to a central server.
  • Decentralized Web: Moving toward peer-to-peer protocols and open-source operating systems to bypass centralized control.

Sources