Age Verification Becomes the Internet’s New Flashpoint

In the U.S. and EU, age verification is still standing even after other controversial parts were removed. Critics worry that it puts privacy and digital identity under pressure.

Key Takeaways

• Two major internet laws in the U.S. and the EU have been watered down, but the requirement for mandatory age verification stayed in place.
• Critics warn that age checks can turn into collecting identity data, like IDs or face scans, even for adults.
• The debate also matters for Europe and web3, because laws without a privacy-friendly method could lead to more data collection and security risks.

This week, two major internet laws in the U.S. and the EU were softened on one major point, but both still preserve a requirement critics say goes well beyond child safety: mandatory age verification. That moves the conversation away from content moderation and encryption and toward a bigger issue: how much personal identification should adults have to hand over just to use the internet?

Weaker Laws, Same Stubborn Requirement

On June 29, the U.S. House passed the Kids Internet and Digital Safety Act, which included a revised version of the Kids Online Safety Act. At the same time, negotiators in Brussels were meeting for what was supposed to be the final trilogue on Chat Control 2.0. In both cases, the most controversial provisions were stripped out. In the U.S., the disputed duty of care was removed, and in the EU, mandatory client-side scanning of private messages was dropped.

Even with those changes, age verification remained in both proposals. Critics argue that this is the part that turns anonymous browsing into identified browsing, including for adults. The U.K.'s Online Safety Act shows how quickly these rules can spread in practice: regulator Ofcom has already launched more than 90 investigations and issued fines to platforms that fail to comply, while users are increasingly being asked for an ID or face scan before they can access ordinary content.

Privacy vs. Identity Data

The core objection is that proving age does not have to mean handing over identity. Instead of saving a passport copy or a face scan, platforms can use privacy-preserving tools such as zero-knowledge proofs. That allows someone to show they are over 18 or 13 without revealing a name, birth date, or document.

That distinction matters because many laws require the result, an age check, but do not spell out how platforms should do it in a privacy-friendly way. In practice, that leaves the easiest route on the table: uploading identity documents or using biometric verification. For platforms, that creates more than just extra compliance work. It also means holding a larger amount of sensitive data, with the added risks of breaches, subpoenas, and misuse.

Why This Also Matters for Europe

For European crypto and web3 users, this debate matters because the same logic can spill into digital identity, wallets, and access to online services. If lawmakers only care about the end result and not the method, privacy by design can still get pushed aside in favor of systems that collect more data than necessary. That affects not only social platforms, but also the wider infrastructure that digital access and verification are increasingly built on.

The timing makes the issue even more delicate. The KIDS Act is now moving to the Senate, while Chat Control 2.0 is trying to reach a political agreement in July. So the real question is no longer whether platforms should be able to check age. It is whether they do it with minimal data or create a new norm for storing identity. In an internet that also has to distinguish AI agents from humans more and more often, that choice could end up shaping far more than these two laws alone.