States across the U.S. are rolling out age-verification systems for social media and adult content, ostensibly to protect children online. The problem is that the technology doesn't work without collecting biometric data, browsing history, or government IDs from everyone—not just minors.
We're building a surveillance infrastructure that will long outlast whatever child safety crisis prompted it.
The pattern is depressingly familiar. A genuine problem—kids accessing inappropriate content or being targeted by predators online—becomes the justification for sweeping measures that affect the entire population. The stated goal is narrow and sympathetic. The implementation is broad and invasive.
I've built identity verification systems during my startup days. There is no technical way to verify that a specific user is under 13 or under 18 without also creating a database of everyone who isn't. Age verification requires proof, and proof requires collecting identifying information from every user attempting to access a restricted service.
The technologies being deployed fall into a few categories, all of them problematic:
Government ID scanning: Users upload a driver's license or passport. The system extracts their birthdate and, incidentally, their full name, address, photo, and often biometric markers embedded in the ID chip. This data gets stored by third-party verification services, creating honeypots for hackers and governments.
Facial age estimation: AI analyzes a selfie to estimate age range. This sounds less invasive until you realize it requires building a database of face scans linked to online activity. And the accuracy is poor—particularly for people of color, who facial recognition systems consistently misidentify.
Credit card verification: The assumption is that only adults have credit cards. This excludes legitimate adult users who don't have traditional banking, creates privacy concerns around linking financial data to browsing behavior, and is trivially bypassed by teens using their parents' cards.
Device fingerprinting and behavioral analysis: The system tracks how you type, scroll, and navigate to infer age. This is comprehensive surveillance dressed up as child protection.
Every approach shares a fatal flaw: you can't build a gate that only checks children without also checking everyone else who wants to pass through it.
