EFF: Zero-Knowledge Proofs Won't Fix Age Verification

A Cryptographic Fix for a Legal Problem

Age verification laws have spread rapidly across the United States, with roughly half of all states now enforcing some form of online age-check requirement. As lawmakers push platforms to confirm how old their users are before granting access to content, a technical solution has gained traction among policymakers and industry groups: zero-knowledge proofs, or ZKPs.

The Electronic Frontier Foundation (EFF) has published a detailed rebuttal to the growing narrative that ZKPs solve the privacy problems baked into age verification mandates. According to EFF, the technology is being oversold as a silver bullet when it actually addresses only part of the privacy equation, and in some cases introduces new tracking risks that advocates rarely mention.

How Zero-Knowledge Proofs Actually Work

Zero-knowledge proofs are a cryptographic method that lets someone prove a fact, such as being over 18, without revealing the underlying data that proves it, like a birth date or government ID number. In theory, a user could be issued a digital token that vouches for their age, and that token could be presented to a website without exposing any other personal information.

This sounds like a meaningful privacy upgrade over current age verification methods, many of which require uploading a driver's license or scanning a face. EFF acknowledges that ZKPs can indeed reduce the amount of explicit personal data shared during a single verification event. The problem, according to the organization, is what happens after that token is issued and used repeatedly.

EFF's core criticism centers on the reusability of these tokens. If a user logs into a platform with the same ZKP-backed credential every time, that token can create a consistent, trackable link back to the individual, even if the token itself doesn't contain a name or birth date. A persistent identifier that follows a user across sessions and services undermines the anonymity that ZKPs are supposed to provide. In other words, the cryptography can hide what you are proving, but it doesn't necessarily hide who is doing the proving, especially over time and across multiple sites.

This distinction matters because much of the political and industry messaging around ZKPs treats them as an automatic privacy guarantee. EFF's analysis pushes back on that framing, arguing that the technology needs to be evaluated in the context of the entire verification system, including how tokens are issued, how often they're reused, and who controls the infrastructure behind them.

Age Verification's Bigger Privacy Problem

EFF's pushback fits into a broader pattern of skepticism from privacy researchers and digital rights advocates about age verification mandates generally. Critics have long argued that these laws, regardless of the technical method used to enforce them, create new categories of sensitive data collection, whether that's ID scans, biometric estimates, or behavioral tracking tied to age assurance.

This skepticism isn't limited to EFF. As covered in our reporting on how an EDRi advisor says age verification privacy claims don't add up, European privacy experts have raised similar concerns that the privacy protections promised by age verification vendors often don't hold up under scrutiny. Industry pushback has come from an unexpected direction too: in Pornhub's letter to lawmakers slamming ID age checks, the company argued that current verification methods being written into state law create real security and privacy risks for users, regardless of the underlying technology.

What ties these critiques together is a shared concern that age verification, however it's implemented, tends to trade one privacy risk for another. Uploading an ID card creates a breach risk. Biometric estimation creates a surveillance risk. And now, according to EFF, even privacy-preserving cryptography like ZKPs can create a tracking risk if it's deployed without careful attention to token reuse and issuer control.

What This Means For You

If you live in a state with an age verification law, you may encounter ZKP-based systems being marketed as a privacy-friendly alternative to ID uploads or facial scans. It's worth understanding that this framing is only partially accurate. The technology can genuinely reduce the amount of raw personal data exposed in a single transaction, but it doesn't automatically prevent platforms or issuers from building a profile of your activity over time if the same credential is reused across sessions.

Before trusting any age verification system, whether it uses ZKPs or another method, look for information about how the credential is issued, whether it expires or rotates, and who controls the verification infrastructure. A system that reissues fresh, unlinkable tokens for every use offers meaningfully stronger privacy than one that hands you a single reusable credential.

Takeaways

Zero-knowledge proofs represent a genuine cryptographic improvement over some existing age verification methods, but EFF's analysis makes clear they aren't a complete privacy solution on their own. The underlying legal mandate to verify age still creates data collection points that didn't exist before, and the specific implementation details of any ZKP system determine whether it actually protects your identity or simply obscures it. As more states adopt age verification requirements, readers should stay informed about how these systems work in practice, ask platforms direct questions about token reuse and data retention, and treat marketing claims about privacy-preserving technology with the same scrutiny applied to any other data collection practice.