438 Experts Warn on Age Verification Risks; US States, Congress Advance Laws Anyway

Published
Score
12

Why it matters

In early March 2026, 438 security and privacy researchers from 32 countries released an open letter opposing mandated internet age verification systems. The researchers identified fundamental technical flaws: the systems are easily circumvented through VPNs and other workarounds, require invasive collection of biometric or behavioral data, and create centralized breach risks—citing Discord's exposure of 70,000 government ID photos as a cautionary example. The letter called for a moratorium on large-scale deployment pending study of the systems' benefits against their harms to security, equality, and user autonomy.

Legislators have proceeded regardless. Idaho enacted parental consent and age verification requirements for social media; Missouri advanced similar measures for minors on social media and AI chatbots. At least half of U.S. states have now passed age verification or digital ID laws, beginning with Louisiana's 2022 requirement for adult sites, followed by Texas and Virginia. Federally, H.R. 8250—introduced by Rep. Josh Gottheimer (D-NJ) and co-sponsored by Rep. Elise Stefanik (R-NY)—would mandate operating system providers verify all users' ages. The House is advancing the Kids Internet and Digital Safety Act under Rep. Brett Guthrie, while the Senate passed updates to COPPA 2.0 extending protections to age 17. Greece is planning teen social media bans.

The legislative push reflects post-2022 efforts to close online child safety gaps, initially driven by Republican-led states concerned that self-reported ages are easily falsified. The movement has now become bipartisan at the federal level, though it remains divided over whether privacy risks outweigh child protection benefits. Attorneys should monitor state implementations and federal bills closely: the expert consensus against these systems is substantial and specific, yet enforcement is accelerating despite mounting evidence of both technical failure and breach vulnerability.

mail

Get notified about new Privacy developments

Primary sources. No fluff. Straight to your inbox.

See more entries tagged Privacy.

Also on LawSnap