What California's Age Verification Bill Would Require

The Electronic Frontier Foundation (EFF) has formally asked California's governor to veto a bill that would mandate online age verification, arguing the measure is far broader than lawmakers admit and rests on shaky scientific footing. The digital rights group's request comes as the bill sits on the governor's desk awaiting a signature or a veto, the final step before it could become enforceable law in California.

Age verification laws generally require websites, apps, or platforms to confirm a user's age before granting access to certain content or features. In practice, this usually means collecting some form of identifying information, whether that's a government ID, a selfie run through facial estimation software, or credit card data used as a proxy for adulthood. California's bill follows this same basic structure: it aims to keep minors away from specific online content by forcing verification checks before access is granted.

On its face, the goal sounds reasonable. Protecting children online is a policy priority shared across the political spectrum. But the EFF's letter to the governor argues that the way this bill is written would sweep in far more than its stated target, turning a child safety measure into something closer to a mass identity-collection requirement for adults and minors alike.

Why the EFF Says the Bill Is Overbroad and Privacy-Invasive

The core of the EFF's objection is that the bill is too broad in scope and too invasive in practice. Rather than narrowly targeting content genuinely harmful to minors, the group argues the bill's language could require verification checks across a much wider swath of the internet than lawmakers intend. That broad net means adults who have no interest in age-restricted content would still be forced to hand over identifying information just to browse ordinary websites.

The EFF also points to what it calls uncertain science underpinning the bill. Age estimation technology, which uses facial analysis or behavioral signals to guess a user's age range, has a documented track record of inaccuracy, particularly for teenagers whose faces sit close to adult thresholds. Relying on imprecise tools to gate access to speech and information, the EFF argues, risks blocking legitimate speech for adults while giving lawmakers false confidence that the problem has been solved.

Finally, the letter frames the bill as a First Amendment problem. Requiring anyone to verify their identity before accessing lawful online content chills speech, both for the person being asked to verify and for the platforms that must comply. Historically, courts have been skeptical of laws that impose identity checks as a precondition for accessing protected expression, and the EFF's veto request leans on that precedent to argue California's bill would not survive serious legal scrutiny.

How Age-Gating Data Could Be Exposed, Sold, or Breached

Beyond the constitutional argument, there's a practical privacy problem baked into any age verification mandate: the data has to go somewhere. Once a platform collects a government ID scan, a selfie, or other identifying details to confirm a user's age, that information becomes a stored asset, subject to the same risks as any other database of sensitive personal data. It can be retained longer than necessary, shared with third-party verification vendors, monetized, or exposed in a breach.

This is the same concern that has followed similar laws in other states. As covered in our look at how Utah's age verification law targets VPNs, lawmakers have increasingly tried to close loopholes that let users bypass verification, which in turn increases the pressure on platforms to collect and retain more identifying data, not less. The more comprehensive the verification requirement, the larger the pool of sensitive records sitting on someone's server, waiting to become the next headline.

How This Fits the Wider State-by-State Age Verification Trend

California's bill is not an isolated case. Age verification legislation has become one of the fastest-moving trends in state tech policy, with lawmakers across the country introducing bills that vary widely in scope, mechanism, and privacy safeguards. Some proposals rely on document uploads, others on facial estimation, and a newer wave has floated cryptographic techniques like zero-knowledge proofs as a supposedly privacy-preserving alternative. Yet as we've reported, EFF has argued that zero-knowledge proofs won't fix age verification on their own, since the underlying identity data still has to be verified somewhere in the process.

At the federal level, the debate is playing out in parallel. Congress has weighed its own package of youth-focused internet bills, including votes on measures like KOSA, the SCREEN Act, and the CHATBOT Act, reflecting the same underlying tension: how to protect minors online without building a surveillance infrastructure that captures everyone else in the process. California's bill is simply the latest, and one of the most consequential, entries in this expanding patchwork.

What This Means For You

If California's governor signs this bill, residents could soon face age verification prompts on services that previously required none. For anyone concerned about handing over ID scans or biometric data to comply, the practical reality is that these laws are still being contested in courts and statehouses, and the rules can shift quickly depending on jurisdiction and legal challenges. In the meantime, a VPN can help limit some exposure by allowing users to route traffic through servers in other regions, though it's not a permanent workaround and doesn't resolve the underlying policy debate over California age verification law privacy protections.

The bigger issue is that once verification infrastructure exists, it tends to expand. A law written for one narrow purpose can become the template for broader mandates, which is exactly what happened as other states amended their own age verification statutes to close perceived gaps.

Key Takeaways

  • California's bill awaits the governor's decision after the EFF publicly requested a veto, citing overbreadth, weak scientific backing, and First Amendment concerns.
  • Age verification systems generally require collecting sensitive identifying data, which creates new privacy and breach risks regardless of the law's intent.
  • Watch how other states, including Utah, have expanded their own age verification rules, since California's outcome could influence similar efforts elsewhere.
  • Consider using privacy tools like a VPN as a short-term measure while these laws remain unsettled, and stay informed as courts weigh in on their constitutionality.