A new paper from the Cato Institute adds fresh weight to a debate that is moving from theory to law in many countries. In "Online Age Verification Has Guaranteed Costs and Uncertain Benefits," the authors identify six key costs or harms that policymakers should count when weighing youth online safety rules. For readers of a privacy site, the age verification privacy risks stand out, because they touch the data you hand over, the chance that data leaks, and the pressure on tools like VPNs.

A note on scope: the blog post announcing the paper only summarizes it and does not list all six costs. This article focuses on the ones most relevant to privacy and draws on other reporting from vpn.social for context.

What age verification asks you to hand over

The core argument in the paper's title is an asymmetry. The costs of age verification are described as guaranteed, while the benefits are described as uncertain. Everyone who uses a covered service pays the cost, whether or not the policy ends up protecting a single child.

In practice, the cost starts with data. Proving your age online usually means giving a service, or a third-party verifier working for it, something more sensitive than a birth year. That can mean an ID document or a biometric scan. For years, age checks in places like Ireland were little more than a form field, as we covered in our look at Ireland's Online Safety Code age checks and the privacy trade-off. Replacing that with real verification is the point of the new rules, but it also changes what an ordinary login involves.

Where the age verification privacy risks come from

The risk is not only that a company collects your ID. It is that a new pool of sensitive records now exists, and records can be breached, misused, or retained longer than anyone intended. The more services that require checks, the more places a copy of your identity data may sit.

Three things make this worth taking seriously:

  • Sensitivity: ID documents and biometric data are hard to change if exposed. You cannot reset a face the way you reset a password.
  • Scale: A mandate applies to everyone, so the pool of people affected is far larger than the group the policy aims to protect.
  • Linkage: Verification ties a real identity to activity that may previously have been anonymous or pseudonymous.

Biometrics deserve particular attention. Our coverage of civil liberties groups pressing Nottinghamshire Police to halt facial recognition shows how concerned advocacy groups are about face-based systems more generally, even outside the age-check context.

Why VPNs become part of the policy fight

When a rule is hard to live with, people look for workarounds, and VPNs are the obvious one. That puts them at the center of enforcement debates.

The UK offers an early example. Government research found that a significant share of children use VPNs to slip past checks under the Online Safety Act, which we detailed in our report that 1 in 4 kids use VPNs to dodge age checks. That finding goes directly to the paper's point about uncertain benefits: if a mandate can be bypassed this way, the protection it delivers is less certain than it looks.

Regulators are noticing too. Documents obtained under Freedom of Information laws showed Australia's eSafety Commissioner expects providers to actively block VPNs and other workarounds, as we reported in the eSafety FOI documents. For privacy-minded users, this is the concern: a tool many people use for ordinary security could come under pressure because of a policy aimed at a different problem.

What This Means For You: Weighing the trade-offs for your own data

You do not control whether a law passes, but you do control how much you share when a check appears. A few practical habits help:

  • Ask what is collected and kept. Before uploading an ID or face scan, look for a clear statement on whether the data is stored, who processes it, and how long it is retained.
  • Prefer the least invasive option offered. If a service gives several ways to confirm age, choose the one that reveals the least.
  • Treat verification data as high value. Use unique passwords and strong account security on any service that holds your identity details, and watch for breach notices.
  • Be cautious about workarounds. A VPN can protect your connection, but it is not a guaranteed way around age checks, and some regulators are explicitly targeting such workarounds. Check a service's terms before relying on one.
  • Follow how your platforms implement checks. Gaming and entertainment services are rolling out their own processes, such as the one in Blizzard's Battle.net UK age verification guide.

The bottom line

The Cato paper does not argue that protecting young people online is unimportant. Its claim is that policymakers should count the guaranteed costs honestly, including the age verification privacy risks that fall on every user, before assuming the benefits justify them. Whatever side you take, the trade-offs are real and worth understanding before you hand over an ID or a face scan.

To see how these trade-offs play out in real regimes, read our piece on Ireland's age-check privacy trade-off and our report on UK kids using VPNs to dodge age checks.