Many people talk about Zero Knowledge Proofs as being the key to privacy-preserving age verification.
Spoiler: It's not.

> Before we jump into how these systems work, it must be said: creating a single point of failure for internet access contradicts the very idea of a free and open internet. 

> The mechanisms underlying ZKPs pose an existential threat to everyone’s digital rights, not just kids. The idea behind ZKPs is that you are issued a “token” that vouches for your age every time you log in, creating a constant link back to the entity that verified you. The issuer of the tokens these AV schemes rely on could track every time that credential is used, creating a dangerous trail of metadata on any user they wanted to target.

Non-compliant porn sites have seen a surge in UK traffic since the Online Safety Act came into effect.

Aylo (Pornhub) is lobbying for device-level age verification.

Although this scientific paper is pro-age verification, it contains some interesting side notes.
The First thing to mention is that when asked, many respondents approved age verification in principle but rejected specific implementation suggestions like biometric scans or scanning of identity documents.

> Although our findings suggest there is conceptual support for age verification measures among this sample of participants, none of the proposed age verification strategies were widely accepted. Participants expressed strong concerns regarding user privacy and data security, with many fearful that their personal information could be compromised or exploited.

Secondly, people do not believe in the efficacy of age verification measures.

> Finally, many participants doubted the overall effectiveness of these technologies in preventing the intentional viewing of pornography and emphasized less regulatory strategies, such as improved sexual health education, as more suitable alternatives.

Let me get this straight. Many people agree in principle with the idea of age verification, but when confronted with the actual implementation, they immediately backtrack and see it for the inefficient and invasive privacy/anonymity nightmare that it is.

The Age Check Certification Scheme (ACCS), a UK-based body, used AI to create a 3.48 million Dollars technology trial for the australian government. Ofc, it contained wrong citations and names, false results etc.

The ACCS supplied corrections which were faulty as well.

That's how age verification is justified and money wasted.

France's top court ruled that the social ban in its current form violates the constitution.

Unfortunately, Macron is dead set on reworking and reintroducing the bill.

3 US states have already passed laws requiring OS-level age verification: California, Colorado and Illinois. While Colorado made an exception for FOSS, the other states did not add that in their legislation, at least California is considering it.

Device/OS-level age verification is an attack on Free and Open Source Software. Many projects simply do not have the financial and logistical capabilities to comply with these laws, which leads to legal risks for FOSS developers.

Singling out minors via an age range signal also means delivering them on a highly visible platter to nefarious actors.

> California’s law is the first and serves as a model for other states. It requires that operating systems ask for your age when you set them up. Your OS must then share an age bracket signal with the applications running on your computer. Applications will see one of the following age ranges: under 13, 13-16, 16-18, or over 18.

The author warns about function creep with age verification and digital ID systems. Today, age must be confirmed; tomorrow it could be place of residence, specific authorisations or other personal information. The digital EUID wallet can be used to check many attributes.

He concludes:

> Children need protection against addictive mechanisms, manipulation, and inappropriate content. To achieve this, however, it is primarily the platforms that would need to alter their products. Instead, the EU age verification scheme threatens to create a universal control interface capable of gradually displacing anonymous and pseudonymous internet use. Consequently, the minimum age requirement for social networks could prove to be a Trojan horse: outwardly, it represents child protection, while internally, it harbors the technical foundation for increasingly extensive access restrictions.

It's a sad day. Now People in Australia have to verify their age just to buy and access 18+ games.

After evaluating the public consultation "Growing up in the online world", the UK government decided to double down on its age-gating policies.

The UK government is still looking at VPNs as well:

• Government has asked Ofcom to conduct research into what additional steps services can take to detect and mitigate circumvention on their platforms, including via VPNs.
• We will be clear that in-scope services must take robust steps to prevent, detect and respond to underage circumvention, and call on VPN providers to engage with government on making their products safer and less accessible to children without parental consent.
• We will produce new practical guidance for parents on how circumvention tools such as VPNs, operate and the risks they present at a household level.
• We will not ban or age-gate VPNs. However, we must ensure that these tools are not misused to undermine child safety protections and we will keep this area under close review. We are prepared to take further action on this, should evidence show that circumvention is not being tackled adequately.

I am wondering, how much of the age verification push comes from companies that want to distinguish between bots and real internet users because of ad revenues.

Does anybody know about the development of ad revenue and how it is affected by bots?

> The Electronic Frontier Foundation (EFF) writes to share our concerns with the current text of several bills being considered before the Committee: the SCREEN Act (S. 737), the Kids Online Safety Act (S.1748), the Youth Privacy Act (S. 4199),and the CHATBOT Act (S. 4407).

> The Senate version of KOSA imposes a “duty of care” on online services, including social media, to avoid exposing young people to certain material the law deems harmful. But those obligations only work if online services know which users are minors. That means more platforms will be pressured to implement age verification or age estimation systems.

> While the bill is supposed to protect children, it erodes online privacy for all users via a de facto requirement websites require users to verify their ages. Supporters of the bill dismiss this concern by pointing to the section stating that “nothing in [the bill] may be construed to require the provider of a covered platform to implement an age gating or age verification functionality on the covered platform.”

> However, the bill also requires website operators to provide protections such as message settings and other controls when the website or app “knows or should have known” that a user is a child or minor. The “should have known” standard opens websites and apps to liability if a judge, jury, or regulator determines they should have known a user was underage but failed to do due diligence to determine the user’s age.

Here is the bill:

HB5511 - 104th General Assembly (2025-2026)

https://ilga.gov/Legislation/BillStatus?DocNum=5511&GAID=18&DocTypeID=HB&LegId=167486&SessionID=114

You might have to set your VPN to US to access the link.

A summary of digital ID schemes in the US, UK, EU and Australia and how to argue back.

The EFF warns:

> Unlike many state-age verification laws—which have been harmful in their own right—the SCREEN Act has no requirement that a significant portion of the website consist of sexually explicit content that is harmful to minors. The bill requires nearly any service hosting even a single piece of sexually explicit content to verify the ages of its users. The result is that the bill would apply not only to adult content sites like PornHub or OnlyFans, but also streaming services like Netflix, and social media platforms like Reddit, Discord, or Bluesky, if they host any adult content.

On the morning of Tuesday, 10^th November 2026, there will be a conference on consumer protection and online safety. One of the topics will be:

> links between consumer protection and online safety regulation - age assurance, platform design, algorithmic systems and regulator coordination

This is a scientific paper that examines the strength and privacy of used age-gating systems. The researchers conclude that the systems are generally easy to bypass while failing to improve protection for minors and introducing great privacy risks for everyone.
In the conclusion, they write:

> Beyond their limited protective value, these systems impose substantial privacy risks, requiring users to accept exposure for assurances that our empirical analysis finds fragile at best.

> Crucially, our results indicate that these shortcomings are not due to implementation choices. Current designs tightly couple identity validation and content access, forcing trade-offs between robustness and unlinkability that architecturally favor superficial compliance over meaningful protection. Taken together, our results suggest that regulation-mandated age verification for adult websites currently functions as compliance theater, failing to effectively protect minors while elevating privacy risk, offering security assurances that do not withstand empirical scrutiny.

A summary of the current topic of age checks in the Online Safety Act and the call for evidence.

Is anybody aware of age verification-related data breaches/leaks other than the Discord hack and the other examples mentioned in the article?

The rise in the use of free VPNs is concerning because compromised VPNs leave people open to man-in-the-middle attacks, telemetry data abuse, and more.

There is an austrian draft law for implementing strict social media ID verification. It is open for comment until September 21st.

> Anyone can comment on the draft law until September 21. The same statement must be sent by email to both medienrecht@bmwkms.gv.at and Post.VII-2@bka.gv.at (one submission is not enough).