What do age-verification laws actually require websites to do?

They require websites and apps to confirm a user is old enough before granting access, which typically involves uploading a government-issued ID, scanning your face, or using a third-party verification service rather than a simple checkbox or birth date entry.

What privacy risks come with uploading an ID for age verification?

Each verification step creates a new point where sensitive information like your name, birth date, address, and photo is collected, transmitted, and potentially stored, and linking that data to browsing activity creates a far more revealing record than most people expect.

Do these privacy risks only affect minors?

No, the EFF notes these risks apply to everyone who has to verify, not only minors, since adults are pulled into the same system and a leak or misuse of verification data would affect them too.

Who could be locked out by mandatory age verification?

People without identity documents could be blocked regardless of their age, potentially affecting millions due to cost, administrative barriers, displacement, or never having needed a document.

Age Verification Privacy Risks: EFF Warns of ID Lockout

The Electronic Frontier Foundation (EFF) is raising a concern that often gets lost in the debate over children's online safety. Mandatory age-verification laws, the group warns, carry serious age verification privacy risks, but they may also shut out millions of people who simply do not have identity documents. The worry is that proving who you are could become a precondition for using large parts of the internet.

The source report is short, so this post sticks to what the EFF has argued and explains the reasoning behind it in plain terms.

What Age Verification Mandates Actually Require

Age-verification laws require websites and apps to confirm that a user is old enough before granting access to certain content or services. A simple checkbox or a typed birth date does not meet that standard. Compliance usually means a stronger check, which in practice can involve uploading a government-issued ID, scanning your face, or handing data to a third-party verification service.

That is the shift the EFF is pointing to. Once a check like this is legally required, it stops being an optional feature and becomes a gate. The internet, long accessible without proving your identity, starts to look like a service conditioned on identification.

How ID Uploads Create Privacy and Security Risks

The privacy concern is straightforward. Every verification step creates a new point where sensitive information is collected, transmitted, and potentially stored. Government IDs contain a name, a birth date, an address, and a photo. Linking that information to browsing activity creates a far more revealing record than most people expect to hand over just to read a page or join a forum.

The EFF's warning also covers data-breach and surveillance exposure. The more places that collect identity documents, the more targets exist for attackers, and the more detailed the trail of who accessed what. Importantly, these risks apply to everyone who has to verify, not only to minors. Adults are pulled into the same system, and a leak or misuse of verification data would affect them too.

This is one reason the argument has played out in legislatures. In one live example, the EFF urged California's governor to veto an age verification bill, arguing the measure is far broader than lawmakers admit.

Who Gets Locked Out Without Identity Documents

The less discussed half of the EFF's warning is about exclusion. If access depends on presenting an ID, then people without one are blocked, regardless of their age. The EFF says this could affect millions of people.

There are many reasons someone might lack a valid document: cost, administrative barriers, displacement, or simply never having needed one. The practical result is that a rule designed to protect young users could cut off adults from information, communication, and services they have every right to use. Because the internet is now central to work, education, and civic life, being locked out is not a minor inconvenience.

This connects to the federal debate as well. Critics of the Kids Online Safety Act have raised similar structural concerns, as covered in our piece on why the Senate should reject KOSA's duty of care rule.

Where VPNs Fit In, and What Users Can Do

Many people ask whether a VPN solves the problem. The honest answer is that it is not a complete fix. A VPN can change your apparent location and shield your traffic from your network, but it does not remove an ID requirement imposed by a service you want to use. If a platform demands a document or face scan, a VPN does not change that demand, and the laws in question are aimed at the services themselves.

What users can do is focus on limiting exposure:

Share as little as possible. If a verification step is required, understand what is being collected before you submit anything.
Question who handles your data. Third-party verifiers may store information, so look for clear statements on retention and deletion.
Prefer options that avoid uploading documents when a service offers alternatives.
Use strong, unique passwords and two-factor authentication on any account tied to your identity.
Pay attention to proposed laws in your region, since the rules are still being written.

What This Means For You

If you are an adult, age verification may soon mean handing identity data to more companies than ever before, which increases your exposure to leaks and tracking. If you are among the people without ID, it could mean losing access to parts of the internet entirely. If you are a parent, the tradeoff matters too: tools meant to protect children can introduce new risks for the whole family's data.

The EFF's core message is that these costs are real and widely shared, even when the goal behind the laws is well-intentioned. Understanding age verification privacy risks now puts you in a better position to weigh proposals as they come up.

Key Takeaways

Mandatory age verification can make ID checks a condition of using the internet.
Collecting identity documents creates new data-breach and surveillance risks for everyone.
Millions of people without identity documents could be excluded from online access.
A VPN is not a full answer to an ID requirement, so limit what you share and stay informed.

To see how these arguments play out in an active legislative fight, read about the EFF's call for a California veto, and for the federal angle on the same debate, see our KOSA analysis.