Child Safety Laws Keep Expanding. The Surveillance Does Too

Key Takeaways

• Age verification requirements began with pornographic websites and have expanded to social media, messaging apps, forums, app stores, and now proposals targeting operating systems.
• The EU's age verification system, which became feature-ready in April 2026, is explicitly designed to integrate with the EU Digital Identity Wallet — making child protection the entry point to a general identity infrastructure.
• According to the EFF, more than half of all U.S. states have already passed age verification laws, and Congress is weighing nineteen separate federal proposals.
• Protecting children online is a legitimate goal. Building national identity verification infrastructure in its name is a different project.

The pattern isn't subtle if you watch it long enough. Age verification requirements for online content started with pornographic websites, where the argument is about as clean as these arguments get — most people agree children shouldn't access explicit sexual material, and requiring platforms to check age before granting access sounds like a reasonable ask. 

Then the same requirement moved to social media. Then to encrypted messaging apps. Then to forums and discussion boards. Then to app stores. And now, in active policy in the UK and a blueprint published by the European Commission, to the infrastructure layer that sits below any individual platform — the digital identity systems that operate before any app even opens.

Each step looks defensible in isolation. The cumulative picture looks like something else entirely.

The Same Argument, Applied to a Bigger Target

The mechanism is consistent across every stage. A category of online content or behavior gets identified as harmful to children. A regulatory body or legislature decides platforms aren't doing enough. A verification requirement gets introduced, framed as limited and proportionate. Then, a legislative cycle or two later, the same framework extends to the next category.

Pornography was the original target because it was the easiest case to make. Social media followed, driven by documented concerns about children's mental health. Messaging apps entered the frame through the child sexual abuse material detection debate. Forums and app stores followed because once the legal infrastructure exists, extending it requires far less political effort than building it from scratch.

The European Commission's age verification system, which became feature-ready in April 2026, is worth reading carefully in this context. It’s being built on the same technical specifications as the EU Digital Identity Wallet, designed to be "fully interoperable" with that system when it rolls out across member states by the end of 2026. 

The Commission notes it can be adapted to verify "other age ranges, for example 13+ or 65+ for retirees." That’s not a child safety tool. That’s a general identity verification architecture that began with child safety as its stated purpose. How digital identity systems become harder to refuse once tied to essential services follows that same logic, and the EU's mini wallet is its clearest current expression.

What the UK's Online Safety Act Already Shows

The UK Online Safety Act, now in force, is the most developed real-world example of what comprehensive age verification looks like when it reaches platforms. The Act requires platforms to verify that users accessing certain categories of content are adults, using methods including government identification documents, facial age estimation, and credit card checks. The categories of content triggering that requirement are broadly defined and left substantially to platforms to interpret.

The predictable result: verification requirements applied to content with no relationship to the stated purpose of protecting children. Writing for EFF's Deeplinks blog on December 10th, 2025, Molly Buckley documented that age gates have been applied to forums covering LGBT+ issues, public health journalism, and general-interest communities — because the definition of harmful content was elastic enough to reach them. 

According to EFF's Age Verification Resource Hub, published that same day, these mandates aren’t a silver bullet for child safety but instead "tools of censorship, used to block people from viewing or sharing information that the government deems harmful or offensive."

Ofcom's guidance to industry acknowledges that compliance interpretation varies significantly across platforms. That variance isn't a flaw in the system — it's what happens when you give companies both the legal obligation to verify users and the discretion to decide what triggers that obligation.

When Everyone Gets ID-Checked

The case against age verification isn't that children's safety online doesn't matter. It's that age verification as implemented doesn't primarily solve that problem — it collects identity data at scale from the entire adult population to exclude a fraction of it.

Every adult who wants to access content that regulators have decided requires verification has to submit proof of identity to a platform or a third-party verification service. 

As EFF notes, no matter the method (government ID upload, biometric scan, AI behavioral monitoring, or digital ID), every system demands users hand over "sensitive and immutable personal information that links their offline identity to their online activity." 

That data sits somewhere. It can be breached, subpoenaed, or sold. EFF has already documented multiple breaches of age verification providers, and the infrastructure is still in its early stages.

There’s also a structural overbreadth problem. When a platform applies verification to all users to comply with a law requiring it only for specific content, anonymous access to that platform ends for everyone, not just children. 

Several platforms responded to state-level verification laws in the United States by blocking access in those jurisdictions entirely rather than building compliance infrastructure. For users in those places, the outcome wasn't verified access. It was no access. 

According to EFF, more than half of all U.S. states have now passed age verification laws, and Congress is actively weighing nineteen separate federal proposals — some sweeping, some contradictory, and each one broader than the last.

This Is Something Else

I don't think the people designing these laws are wrong that children face genuine risks online. The documented harms — exposure to violent or sexual content, contact with predatory adults, algorithmic amplification of self-harm material — are real. 

The question is whether age verification applied progressively to every layer of the internet addresses those harms or builds something else on their foundation.

A pornography website that checks ages is a website. An identity wallet integrated with a national digital ID system that verifies your age before you access any platform is an infrastructure layer. The political argument connecting those two things — child safety — doesn't make them equivalent interventions. One targets a category of content. The other conditions your ability to participate in digital life on proving who you are to a government-approved system.

Framing surveillance infrastructure as child protection makes it genuinely difficult to oppose, and that difficulty is part of its utility. EFF's position is that legislators who actually want to improve online safety should pass comprehensive privacy legislation instead of building new systems of surveillance, censorship, and exclusion. I think that's right. 

The expansion from one category to the next doesn't stop on its own — each stage normalizes the framework and lowers the threshold for the next application. Naming that pattern isn't opposition to protecting children. It's what paying attention looks like.