Age Gates Are Surveillance Gates

How child safety laws are quietly building the internet's biggest ID checkpoint system.

State of Surveillance Editorial Team

TL;DR: Twenty-five US states now require you to upload your driver's license or scan your face to access websites. The UK just announced 50 facial recognition vans and is enforcing age checks under the Online Safety Act. The EU's Digital Identity Wallet launches in 2026. These laws are sold as protecting children, but they're constructing permanent identity infrastructure that links your real name to every website you visit. Age verification providers have already been breached. Discord lost 70,000 ID photos in October 2025. A dating app leaked 72,000 selfies. You can't change your face after a breach.

Half of America Now Requires ID to Browse

As of late 2025, exactly 25 states (half the country) mandate age verification to access adult content online. Nine states enacted laws in 2025 alone: South Carolina, Florida, Tennessee, Georgia, Wyoming, North Dakota, Arizona, Ohio, and Missouri.[1]

The mechanics vary. Some states demand you upload a government ID. Others accept facial age estimation, an algorithm that guesses your age from a selfie. A few allow credit card verification. All of them require you to prove who you are before you can see a webpage.

Ten more states are pushing similar legislation in 2026.[2]

Florida's law triggered a 1,150% spike in VPN usage the day it went into effect.[3] People got the message: the government wants to watch what you browse. They opted out. Wisconsin and Michigan responded by proposing VPN bans, literally trying to outlaw the tool people use to avoid the surveillance.[4]

How Age Verification Actually Works

Politicians talk about "verifying age." Here's what that means in practice:

Government ID Upload

You photograph your driver's license or passport and send it to a third-party company you've never heard of. They extract your name, date of birth, address, and ID number. They claim to delete it. You have no way to verify that.

Facial Age Estimation

You take a selfie. An algorithm estimates your age based on your face. Companies like Yoti upload your photo to their servers for analysis. Researchers found Yoti's platforms contain numerous trackers, potentially sharing your verification attempt with data brokers.[5]

Credit Card Checks

You enter payment details. This confirms you have a card, not that you're 18. But it links your financial identity to your browsing activity, creating a permanent record.

Digital ID Systems

Louisiana's LA Wallet and the EU's Digital Identity Wallet connect your government-issued digital ID to website access. Efficient for verification. Also efficient for building a complete log of what you read online.

Every method requires you to hand sensitive, immutable personal data to a third party. Your face. Your ID number. Your financial details. Data that, once stolen, you can never change.

It's Already Being Breached

The EFF calls age verification systems "irresistible targets for hackers."[6] They're right. The breaches have already started.

Discord (October 2025): Hackers calling themselves Scattered Lapsus$ Hunters breached 5CA, Discord's third-party customer service provider. They stole 1.6 terabytes of data, including nearly 70,000 photos of government-issued IDs uploaded for age verification. Passports. Driver's licenses. All exposed.[7]

Tea Dating App (July 2025): The dating safety app leaked 72,000 images, including 13,000 photos of government IDs and 59,000 selfies submitted for identity verification.[8]

Pornhub / Mixpanel (November 2025): ShinyHunters claimed 94 GB of analytics data containing over 200 million records tied to Pornhub Premium activity: emails, locations, video URLs, timestamps. When you force people to verify identity on a porn site, a breach doesn't just expose data. It exposes what people watch.[9]

These aren't hypothetical risks. They're things that happened. In the last six months.

And here's the part nobody in Congress wants to talk about: you can reset a password. You can freeze a credit card. You cannot change your face. You cannot get a new fingerprint. Biometric data, once stolen, is compromised forever.

This Is Going Global

The United States isn't alone. Governments worldwide are building parallel systems:

  • UK (January 2026): The Online Safety Act's age verification requirements are actively enforced. Ofcom has already fined companies over £1 million for non-compliance. The regulator is now considering extending age verification to VPNs, the very tools people use to preserve privacy. Meanwhile, the government just announced 50 facial recognition vans and a £115 million Police.AI center.[10]
  • EU (2026): The Digital Identity Wallet launches this year. Originally designed for convenient government services, it's increasingly being positioned as the age verification backbone. The EFF warns about "mission creep": once the infrastructure exists to check ID for one purpose, expanding it to others is trivial.[11]
  • Australia: Enacted age verification requirements for social media, joining the global push to gate online access behind identity checks.
  • Florida's 11th Circuit Victory (2025): The court upheld Florida's social media age restrictions, allowing enforcement of a law barring children under 14 from accounts and requiring parental consent for 14-15 year olds.[12] This ruling gives other states legal cover to push even harder.

The pattern: use child safety as justification. Build the ID infrastructure. Then expand what it's used for.

Surveillance Infrastructure, Not Safety Infrastructure

The EFF published three major pieces on age verification in January 2026 alone, calling these systems exactly what they are: surveillance systems.[6]

Their argument is straightforward: every age verification method demands that users hand over sensitive personal information linking their offline identity to their online activity. That data gets stored by companies with financial incentives to keep it and inadequate security to protect it.

The EFF isn't alone. Proton (the company behind ProtonMail and ProtonVPN) argues that age verification laws "should not be implemented before genuinely secure, decentralized solutions that respect privacy are developed."[7] Those solutions don't exist yet. The laws are rolling out anyway.

Here's what these systems actually create:

  • A browsing identity layer: Your government ID linked to what websites you visit
  • Centralized biometric databases: Third-party companies holding your face and ID photos
  • Vendor surveillance: Age verification companies see which platforms you access, and when
  • Tracker exposure: Researchers found verification providers embed trackers that share data with data brokers
  • Demographic profiling: Facial estimation fails on darker-skinned individuals, transgender people, and people with disabilities, creating a system that excludes the most vulnerable[5]

Congress Is Making It Worse

The 119th Congress (2025-2026) considered nearly 20 federal proposals related to children's online safety. The big ones:[13]

  • KOSA (Kids Online Safety Act): Reintroduced in May 2025. Technically doesn't mandate age verification, but its "duty of care" provisions push platforms toward it. Mandates a Commerce Department study on device-level age verification.
  • KOSMA (Kids Off Social Media Act): Bans social media for under-13s. Advanced through Senate Commerce Committee. Uses a "reasonable knowledge" standard that critics say is weaker than existing COPPA protections.
  • California SB 976: The "Protecting Our Kids from Social Media Addiction Act" requires age verification by end of 2026. California's AG held public hearings in November 2025 on verification standards.
  • California AB 1043: The "Digital Age Assurance Act" requires operating system providers to implement age verification at the device level, building the check into every phone and computer.

Notice the ratchet effect. First, websites must verify. Then apps. Then devices. Then operating systems. Each law builds on the last, expanding the surveillance footprint.

What You Can Do

Use a VPN

A VPN masks your location and prevents your ISP from logging which sites you visit. This sidesteps state-level age verification, for now, until states like Wisconsin succeed in banning them. Choose a no-log VPN provider based outside the US.

Oppose These Laws

Contact your federal and state representatives. The EFF's age verification hub provides templates and tracked legislation. These bills pass because nobody shows up to oppose them.

Minimize ID Exposure

When forced to verify, use the least invasive method. Credit card over ID upload. Email check over selfie. Never submit a government ID if an alternative exists. The less biometric data floating around, the less can be stolen.

Support Digital Rights Organizations

The EFF, ACLU, and CDT are fighting these laws in court and in legislatures. They need funding and public support. The EFF Age Verification Resource Hub tracks threats globally.

The Bottom Line

Child safety online is a real problem. Nobody disputes that. But the solution being built isn't safety infrastructure. It's surveillance infrastructure. A system that requires every adult to prove their identity to access the internet is an ID checkpoint, not a parental control.

When Discord's verification vendor got breached, 70,000 people had their passport photos stolen. When the next age verification provider gets hacked (and they will) the damage will be measured in millions of exposed faces and IDs. Data you can never change. Linked to websites you never wanted anyone to know you visited.

Half of America is already behind the age gate. The other half is next. The UK, EU, and Australia are building the same walls. And every brick in that wall is somebody's face, ID, or browsing history, sitting on a third-party server, waiting to be stolen.

If you wouldn't hand your driver's license to a stranger on the street before entering a bookstore, ask yourself why you should do it online.

References

  1. EFF - The Year States Chose Surveillance Over Safety: 2025 in Review (December 2025)
  2. TechBuzz - Age Verification Laws Hit 25 States as Congress Weighs 19 Bills
  3. 404 Media - Half of the US Now Requires You to Upload Your ID or Scan Your Face
  4. State of Surveillance - Wisconsin and Michigan VPN Ban Proposals (January 2026)
  5. EFF - So, You've Hit an Age Gate. What Now? (January 2026)
  6. EFF - Age Verification Systems Are Surveillance Systems
  7. Proton - Discord ID Data Breach: Why the World Isn't Ready for Age Verification Laws (October 2025)
  8. EFF - The Breachies 2025: The Worst, Weirdest, Most Impactful Data Breaches of the Year
  9. Malwarebytes - SoundCloud, Pornhub, and 700Credit Data Breaches (December 2025)
  10. Biometric Update - UK Announces Largest Ever Facial Recognition Rollout (January 2026)
  11. EFF - Age Verification Threats Across the Globe: 2025 in Review
  12. Florida Politics - Florida Cleared to Enforce Child Social Media Restrictions (November 2025)
  13. EFF - Congress's Crusade to Age Gate the Internet: 2025 in Review