The Case Against Age Verification

Analysis demonstrating that all proposed "privacy-preserving" age verification schemes either leak identity data or can be trivially circumvented. The technical limitations are fundamental, not engineering problems. Even zero-knowledge proofs cannot solve this cleanly.

If a system can determine someone's age, it can determine who they are. There is no technical architecture that separates age from identity. The phrase "privacy-preserving age verification" is a contradiction in terms.

Age verification systems create centralized stores of personally identifiable information that become high-value targets for data breach. The "protection" infrastructure creates more risk than the harms it claims to prevent.

The privacy compliance industry's own professional body examines the gap between age verification theory and practice. Device-level solutions provide consistent controls but cannot account for developmental context. App-based systems offer tailored experiences but face interoperability challenges and rely on accurate self-reporting. Enforcement has been "inconsistent or easy to bypass." When the people whose job is to implement privacy compliance publish skepticism about age verification's viability, that is a different flavor of credibility than advocacy organizations saying the same thing.

Published in the Stanford Technology Law Review — one of the top-tier legal journals in technology law. Age-gating laws inevitably segregate children into a separate, inferior internet experience and suppress their access to lawful speech. The "segregate-and-suppress" framework maps directly onto AB 1043's architecture: identify children (segregate), then restrict what they can access (suppress).

Age verification laws eliminate online anonymity — not just for children, but for everyone. You cannot verify a child's age without requiring adults to prove they are not children. The right to anonymity is a prerequisite for free expression.

The Court upheld Texas's age verification law for sexually explicit content under intermediate scrutiny, but the ruling was narrow: it applies only to age restrictions on sexual materials that minors have no legal right to access. The dissent (Kagan, Sotomayor, Jackson) argued the law should have faced strict scrutiny and that it burdens adults' access to lawful speech. The decision does not authorize broader age-verification mandates on social media, general-audience websites, or app stores. AB 1043 was designed to survive Paxton by avoiding content regulation entirely—it mandates age collection at the OS level regardless of content. But the enforcement paradox Ageless Linux has identified (fines assessed "per affected child" requiring the very data collection the law mandates) may reopen the constitutional question.

Age verification mandates entrench dominant platforms that already collect age data and impose impossible burdens on smaller platforms and open-source projects. The compliance cost is zero for Apple and Google and existential for everyone else.

A comprehensive alternative framework. Rather than requiring identity verification to access content, regulate the harms themselves: ban behavioral advertising, require real data minimization, prohibit deceptive design patterns.

The actual model bill text drafted by ICMEC and presented to state legislatures. Not a policy recommendation — a ready-to-introduce statutory draft, published with a technical whitepaper, constitutional analysis, and FAQ.

Documents ICMEC’s November 6, 2024 presentation of the DAAA model bill to Virginia’s Joint Commission on Technology and Science and the resulting request for draft legislation by Senator Craig.

Thirty-four companies that sell age verification tools filed in support of mandating age verification. The vendors asking the court to create their market.

Primary research showing that teenagers and parents view age verification as both ineffective and privacy-invasive. Teens bypass it trivially. Parents prefer education and conversation to technical controls.

The international child welfare organization concludes that age restrictions are not a substitute for platform investment in child safety. Many children will access platforms through workarounds or less regulated alternatives, making them harder — not easier — to protect.

Policy analysis cataloging the practical failures of age verification: false positives locking out legitimate users, false negatives letting children through, and the impossibility of a system that does both well.

Age verification systems that require government ID disproportionately exclude trans people whose documents do not match their identity. The harms are not hypothetical — they are documented and ongoing.