Experts in technology and government are confronting a major issue of our era: although the internet has the power to transform global education and human connection, it also exposes children to risks if their access is completely unrestricted.
However, any attempt to control what kids can see online risks monitoring adults as well, which could lead to severe breaches of privacy.
Some see these regulations as important steps towards child protection, but many cybersecurity specialists caution that the way these laws are being enacted is flawed, putting adult users at risk. In the US, 23 states had passed age verification laws by last month, with another two joining in September. Across the Atlantic, the UK's Online Safety Act, which came into force in July, mandates that many online services confirm users’ identities before allowing access.
Here’s an overview of the current discussion about age and identity checks online.
What does age verification mean?
Age verification laws today are not the same as simply checking a box to say you’re old enough to join a site like Neopets as a child. In the US, these basic checks were introduced by the Children’s Online Privacy Protection Act (COPPA), which became law in 1998. But, as many remember, it was easy to bypass these—just click a box and claim to be 13.
The recent laws of the 2020s, though, generally require users to upload government-issued identification to an external service to verify their age, or to provide biometric data, such as facial scans similar to Apple’s Face ID system.
Why require age verification?
The goal of internet safety is not simply to stop kids from playing games like Neopets. Lawmakers and parents worry about minors encountering harmful material—ranging from explicit adult content and drug-related information to social platforms where strangers could pose threats.
These fears are real. Parents have testified to lawmakers about losing children to drugs purchased online or to suicide after severe bullying on social media platforms.
Advancing technology is making these problems worse: reports allege that Meta’s AI chatbots have engaged with minors inappropriately, while companies like Character.AI and OpenAI face lawsuits claiming their bots influenced children who later died by suicide.
Yet, the internet also offers enormous benefits. You can learn new skills, connect with people worldwide, receive remote medical care, and find answers to nearly any question, all without leaving your home or spending money (for example, Madagascar’s capital is Antananarivo).
This has led lawmakers globally to what they consider a balanced solution: instead of restricting the whole internet, they require proof of adulthood to access certain material. But instead of just checking a box, you now must provide an official ID or biometric scan to gain entry to specific content.
Is it secure to upload your government ID or biometric data?
How safe these digital security measures are depends heavily on how they are set up and managed.
For example, Apple designs Face ID so that your facial data never leaves your device, which significantly reduces the chances of it being stolen by hackers.
However, once any data is transmitted over external networks, the process becomes riskier. We’ve seen numerous cases where poor implementation of these systems led to security failures.
The Electronic Frontier Foundation notes, “There is no age verification method that is both fully protective of privacy and completely accurate. It’s not just about being more or less safe or more or less precise—each method brings its own unique dangers.”
There have been notable incidents where inadequate security has had serious consequences.
Take Tea, an app for women to share experiences with men they met on dating platforms. It required users to upload selfies and identification. Hackers on 4chan discovered a flaw that left user data vulnerable, exposing thousands of IDs, photos, and private conversations—some containing sensitive personal details like home addresses—despite the company’s assurances that such data was not stored and would be deleted right away, which turned out to be untrue.
Such breaches are not rare—TechCrunch frequently reports on security lapses. And it’s not only new startups at risk; even governments and the biggest tech corporations have suffered data leaks.
These incidents are common, as TechCrunch’s reporting shows, and not limited to newcomers like Tea. Even national governments and massive tech companies experience data breaches.
Does losing online anonymity really matter if I’m not hiding anything?
The pushback against these laws stems from more than people wanting to keep their adult browsing habits private.
Anonymity is essential for people in countries where political dissent can lead to prosecution, as it allows open discussion and criticism without fear of punishment. Whistleblowers might be discouraged from exposing wrongdoing, and domestic abuse survivors could find it harder to seek safety if their online actions are traceable.
In the US, the idea of punishment for political views is increasingly plausible. Former President Trump has threatened to jail his critics, and the government has revoked visas from students protesting Israeli policies or actions.
Which age verification laws are active in the US?
As of August 2025, 23 US states have implemented age verification laws, with two more set to enact similar regulations by September’s end.
Most of these laws apply to websites that contain a certain percentage of content considered “sexually explicit and harmful to minors,” though the exact definition differs by state.
In practice, this means adult sites must confirm users’ ages before granting access. Some, like Pornhub, have instead chosen to block visitors from those states entirely.
Pornhub explained in a blog post, “Because age verification tools require people to provide highly sensitive data, they increase the risk of data leaks. Even with good intentions, governments have a poor record of keeping this kind of information secure.”
How is “sexual material harmful to minors” defined?
The meaning of this phrase depends on the authorities enforcing the law.
With LGBTQ rights facing challenges in the US, advocates worry that these laws could label even non-explicit LGBTQ content or standard sex education as “harmful sexual material.” Their concerns are supported by actions such as the removal of LGBTQ and civil rights history from some official websites during the Trump administration.
Texas’s age verification law—upheld by the Supreme Court in June—was passed alongside new restrictions targeting the LGBTQ community, including bans on certain drag performances and gender-affirming healthcare for minors. The ban on drag shows was ultimately ruled unconstitutional for violating free speech rights.
What’s the status of age verification in the UK?
The UK’s Online Safety Act, enacted in July 2025, obligates many online services to verify users’ identities before granting access. If a user is found to be underage, they are denied entry to certain sites. The Act covers everything from search engines and video platforms to messaging services and online storage—anywhere people might interact or view media.
In reality, this means platforms like YouTube, Spotify, Google, X, and Reddit now require UK users to verify their age before accessing some content. These requirements go beyond adult or violent material—some users have lost access to important educational and news sources, making it tough to get information without risking their privacy.
There isn’t a single mandated method for age verification in the UK—each site can choose its own system, overseen by the communications regulator Ofcom. But, as the Tea app example shows, no verification technology can be considered completely secure.
As a result, UK users must weigh their desire for information against the privacy risks involved in identity verification.
Do UK age verification rules apply if I live elsewhere?
Even outside the UK, users may experience changes as tech companies start complying with these rules ahead of time.
For example, YouTube in the US has begun testing systems that estimate users’ ages based on behavioral patterns, regardless of the birth date entered during sign-up.
Is it possible to bypass these restrictions using a VPN?
Yes, and the UK’s App Store rankings make this clear—after the Online Safety Act was enforced, VPN apps made up half of the top ten free downloads for iOS. Similarly, VPN use increased after Pornhub was blocked in several US states.
When Pornhub access was blocked in France, ProtonVPN reported a 1000% surge in new users within 30 minutes—a larger spike than after TikTok’s temporary US ban.
You might have used a VPN to connect remotely to your office, or to watch UK shows from elsewhere for free.
This, however, raises another concern: despite their claims, free VPNs often fail to protect user privacy as promised.
For more information about VPNs, TechCrunch offers resources on understanding VPNs and deciding whether you should use one.
