Researchers Say Age Verification Has Guaranteed Costs and Uncertain Benefits

We've spent months covering the age verification wave — Australia's ban, Türkiye's e-Devlet token system, the Philippines Senate's total prohibition for under-18s, Georgia's law revived by an appeals court, Ofcom investigating whether Pornhub's age checks actually work, a federal judge blocking Utah's VPN provisions, Pennsylvania advancing a bill one senator described as a blackmail toolkit while voting for it anyway. In every piece, we've made the same argument: the costs of age verification are concrete, immediate, and borne by everyone; the benefits are uncertain, contested, and may not materialize as legislators intend.

Policy scholars (Jennifer Huddleston and David Inserra) at the Cato Institute published a paper making the same argument in the kind of format that tends to get read in Washington. Their paper is titled "Online Age Verification Has Guaranteed Costs and Uncertain Benefits." If you've been skeptical of a newsletter covering internet freedom making this case, here are two people whose job is technology policy, making it in a peer-reviewed format.

The Six Costs

Huddleston and Inserra identify six specific costs that should be factored into any honest assessment of age verification policy.

1. False positives and disparate impact: No age verification system is perfectly accurate. Adults get incorrectly flagged and lose access to lawful content. That burden falls unevenly — people without standard forms of identification, older adults less comfortable with verification interfaces, immigrants, and members of minority groups face higher rates of failure. The cost of a false positive is absorbed by the user, not the system that produced it.
2. Compliance and opportunity costs: Implementing age verification is expensive. Large platforms can absorb the cost; smaller platforms, independent publishers, and community services often can't. The result is a market that favors established incumbents and creates barriers for new entrants and independent voices.
3. Data breaches and privacy risks: Every age verification system creates a database — a linkage between an identity and a record of access to a particular category of content. We've tracked 88 identity verification breaches since 2011, affecting at least 2.15 billion records. Age verification doesn't eliminate data risk; it industrializes it by requiring the creation of identity-linked access records at scale.
4. Restricted access to lawful information: Age verification gates apply to content that adults have a legal right to access. The mechanism designed to keep minors out also introduces friction, errors, and failures for adults — particularly for sensitive information like reproductive health, LGBTQ+ resources, and mental health support, where the people most in need of the information are often least positioned to navigate additional barriers.
5. Loss of anonymous and pseudonymous speech: Anonymity has constitutional protection in the United States and is recognized as important to free expression in international human rights frameworks. Age verification, by definition, requires identity. It eliminates anonymous access to whatever it's applied to — not just for the intended population of minors, but for everyone.
6. Weakened role of parents: Laws that require platform-level age verification shift responsibility from parents to governments and corporations. The paper's argument isn't that parents don't matter — it's that mandatory age verification replaces parental judgment with regulatory compliance, in ways that don't necessarily reflect individual family values or circumstances.

What the Evidence From Australia and the UK Shows

The paper cites early evidence from the two jurisdictions with the most established age verification regimes — Australia and the United Kingdom. Their finding: the benefits are "at best, uncertain" and "restrictive policy-based approaches are typically ineffective."

That finding aligns with what we reported when Ofcom launched its investigation into Pornhub's age verification in the UK. The question Ofcom is asking — whether the verification process is actually stopping children from accessing the site — is the same question the Cato paper is asking about the policy category. Pornhub's UK traffic dropped 75% when OSA checks came in. The traffic went somewhere else. Age verification created a gate at the compliant site and left the non-compliant internet untouched. Whether that outcome constitutes success depends on how you define the goal.

The Framework Worth Keeping

The argument against age verification legislation isn't that child safety doesn't matter. It's that the costs of age verification are real, concrete, and borne by everyone — and the benefits are uncertain enough that they don't automatically outweigh those costs.

Every week we cover a new jurisdiction passing or advancing age verification legislation, the costs get larger, and the evidence base for the benefits stays thin. A paper from policy researchers at a credible think tank saying the same thing 6 is useful because it's separable from any particular editorial position. The Cato Institute has its own politics. Its researchers' methodology is their own. Their six costs are the same six costs that keep appearing in the case law, the breach records, and the enforcement failures. That's not a coincidence.