Age checks have a legitimate place online. But child safety should not become an excuse to turn the wider internet into an identity checkpoint. I want children to be safer online. I also want us to be honest about protecting children online and what online age verification can demand from everyone else.
When a platform asks every visitor for a passport, bank check, face scan or permission to examine their digital footprint, it is doing more than checking a birthday. It is asking people to identify themselves before entering an ordinary part of digital life.
My position is not that every age check is surveillance. Age assurance becomes surveillance when it is identifying, continuous, linkable across services, retained unnecessarily or reused for another purpose. A service may need to know whether I am above a particular age. It rarely needs my name, exact birthdate, identity document, face or browsing history.
That distinction matters now. Reuters reported on September 14 that the European Union is preparing an EU Kids Act that could restrict access to social media, video platforms, online games and AI chatbots for children under 15. The reported plan would use age verification to enforce different levels of access. At the time of writing, the details are not final, and the proposal has not become law. But it reflects a wider movement: governments increasingly see age checks as the gateway to child safety.
I understand the appeal. I do not accept that universal identification must follow.
The Danger Is Real. The Remedy Still Matters
Any credible privacy argument must acknowledge what children are encountering online.
Ofcom, the UK communications regulator, found that 8% of children aged 8 to 14 visited an online pornography service during the month it studied. That included approximately 3% of eight- and nine-year-olds. Since July 25, 2025, sites and apps allowing pornography in the UK have been required to use stronger age checks instead of relying on a box asking visitors to confirm they are adults.
Pornography is only part of the problem. Children can encounter grooming, cyberbullying, sexual extortion, unwanted contact, dangerous recommendations and product features designed to keep them engaged for as long as possible.
AI has added another concern. A 2026 Pew Research Center survey found that 64% of US teenagers had used AI chatbots. Twelve percent said they had turned to them for emotional support or advice. That does not prove that ordinary chatbot use is harmful, but it shows how quickly these systems have entered private and emotionally sensitive parts of young people’s lives.
I take these risks seriously. That is precisely why I want policies that address the risks themselves. Urgency should not become permission to accept every tool presented as a safety measure.
Age Assurance Is Not One Technology
“Age verification” sounds like one simple check. In practice, it can describe several very different processes.
A user might upload a passport or driving licence. A third-party provider might consult banking, credit-card or mobile-network information. Facial or voice analysis might estimate whether someone appears old enough. Another system might examine an email address, account activity, interests or connections to infer an age range. These methods do not create equal levels of intrusion.
A self-declared birthday collects little information but is easy to falsify. That makes it unsuitable for many high-risk adult services. A document check may produce greater certainty, but a passport contains far more information than most platforms need. Facial estimation avoids asking for a document, yet it still requires an algorithm to judge someone’s appearance. Behavioral estimation can be more invasive because it may infer age by monitoring how a person writes, what they view or whom they know.
Accuracy also matters. The UK Information Commissioner’s Office has warned that document-based checks can exclude people who lack passports, driving licences or established credit histories. Age-estimation systems may perform differently across demographic groups. Any method can make mistakes, either admitting a child to an adult service or preventing an adult from accessing lawful material.
The real debate, then, is not whether age assurance should exist. It is what a service needs to know, how it obtains that information and what it is allowed to do with it afterwards.
A Service May Need My Age, Not My Identity
The European Data Protection Board has made a crucial distinction. Age-assurance systems should not give companies additional ways to identify, locate, profile or track people. It has also argued that checking everyone’s age before allowing access to content suitable for all audiences would fail basic tests of necessity and proportionality.
The UK Information Commissioner’s Office takes a similarly practical view. In many situations, seeing an official identity document would be excessive. A provider may need only a yes-or-no result confirming that someone meets an age threshold. Information collected for that check should not then be turned into material for advertising or profiling.
Privacy-preserving alternatives are possible. Europe is developing selective-disclosure credentials designed to prove that someone is over a specified age without revealing a full birthdate or other unnecessary identity details.
These systems still require scrutiny. “Privacy-preserving” cannot be accepted as a marketing promise. Providers must be independently tested. They must not create records that allow visits across different services to be connected. Source documents and biometric material should be deleted as soon as they are no longer needed. People also require alternative methods and meaningful appeals when a system gets their age wrong.
But the underlying principle is sound: proving an age threshold does not have to mean disclosing an identity.
As a copy editor, I take private reading seriously. People often search for information about health, abuse, sexuality, addiction, religion or politics precisely when they are not ready to disclose that interest. An identification requirement can discourage lawful inquiry even when nobody formally blocks the information.
Privacy is not exclusively an adult right, either. Children also need space to learn, communicate and develop without unnecessary profiling. A protection system that creates more data about them can introduce a new risk while attempting to solve another.
Regulate the Product, Not Only the User
The debate has concentrated heavily on finding out which users are children. It has paid less attention to why so many digital products become dangerous for children. Before asking who a user is, regulators should ask what the product does.
The European Commission’s existing guidance offers practical starting points. Minors’ accounts can be private by default. Unknown users can be prevented from contacting children or adding them to groups without permission. Recommender systems can rely less heavily on behavioral signals. Features such as autoplay, engagement streaks, read receipts and excessive push notifications can be disabled. Platforms can improve blocking, reporting and parental controls while placing stronger safeguards around AI chatbots.
These changes address recognizable sources of harm. An age gate alone does not.
Some safer defaults could benefit every user. Services could offer chronological feeds, stricter location controls, better message filtering and less aggressive notifications without first demanding identity documents. Where an adult-only feature genuinely requires an age distinction, a minimal threshold check can be used.
This would place responsibility where it belongs: on the companies that control their products, business models, recommendation systems and safety settings. Child protection should not become a convenient way for platforms to leave risky design untouched while shifting the burden to users.
Protecting Children Online: Child Safety Is Not a Blank Cheque
Supporters of wider age verification have a legitimate objection: platforms cannot provide different protections to children if they do not know which users are children.
They are right about that limitation. Self-declared birthdays are easy to falsify. A simple “I am over 18” button is inadequate for services built around adult content. Stronger age assurance will therefore be necessary in some settings.
But identifying a real problem does not give governments or companies an unlimited right to identify everyone. The burden should remain on them to prove that a check is necessary, proportionate and no more intrusive than the risk demands.
I would support strong age barriers around adult services. I would support privacy-preserving threshold checks for features that present a demonstrated risk. I would also support meaningful penalties when companies retain documents unnecessarily, reuse verification data or mislead people about what a check collects.
That is not an argument against regulation. It is an argument for regulation aimed at the source of the harm, with boundaries strong enough to survive changes in governments, companies and technology.
I reject the idea that we must choose between leaving children exposed and asking everyone to surrender their identity before reading, speaking, playing or searching online. Better product design, risk-based rules and minimal-data verification offer another path.
A safer internet should collect less data from children, expose them to less manipulation and demand more responsibility from the companies that built it. Protecting children online should not require surveilling everyone.
