A New EU Proposal With Old Privacy Problems
The European Commission has introduced a draft law aimed at restricting young people's access to the internet, and privacy advocates are already sounding the alarm. The proposal, known as the EU Kids Act, was presented last week with the stated goal of protecting minors online. But according to critics, the cost of that protection could be steep: mandatory age verification systems that apply to everyone, not just children.
At its core, the draft law would make internet access contingent on age. That sounds straightforward in theory, but in practice it means platforms and services would need a reliable way to determine how old every user is before granting access. That requirement doesn't stay confined to minors. It inevitably sweeps in adults too, since there's no way to verify a child's age without also verifying everyone else's.
Why Age Verification Is a Privacy Trade-Off
Age verification systems typically require users to submit some form of identification, whether that's a government-issued ID, a credit card, biometric data like a facial scan, or a third-party verification service. Each of these methods creates a new record tying a real-world identity to online activity. That's a significant shift from how most people currently browse the internet, often with a reasonable degree of anonymity.
The EU Kids Act would expand the use of these intrusive verification tools across a much wider range of online services than currently required. Critics argue that this undermines the privacy of all internet users, not just the young people the law is meant to protect. Once age-verification infrastructure becomes standard, it creates a permanent layer of identity checks that didn't previously exist, and that infrastructure can be difficult to unwind once it's built into how platforms operate.
This isn't the first time an age-verification proposal has drawn scrutiny for reaching further than intended. A related draft under the same EU Kids Act framework could force age checks on Steam games, extending verification requirements into single-player gaming experiences that many wouldn't expect to be affected by child-safety legislation. That example illustrates how age-verification mandates tend to expand well beyond their original scope, touching services and use cases that have little direct connection to protecting minors from online harm.
How Other Regions Have Handled Similar Debates
The EU isn't alone in wrestling with how to balance child safety and online privacy. In the UK, officials recently addressed a related question under the Online Safety Act: whether to restrict VPN use as a way of preventing minors from bypassing age-verification checks. The UK ultimately rejected VPN restrictions under the Online Safety Act, a decision that acknowledged VPNs serve legitimate privacy and security purposes for millions of users, and that blocking them wholesale would be a disproportionate response.
That outcome offers a useful point of comparison for the EU's current proposal. It shows that lawmakers can choose narrower, more targeted approaches to child safety without imposing sweeping identity checks on the entire user base. Whether the EU Commission will take a similar path as the Kids Act moves through further negotiation remains to be seen.
What This Means For You
If the EU Kids Act moves forward in its current form, users across the EU, and potentially beyond, could face new identity checks simply to access websites, apps, or games they already use. That could mean submitting ID documents, undergoing facial recognition scans, or relying on third-party age-verification services just to prove you're old enough to browse normally.
Even if you're not a minor, you could still be affected. Age gates typically don't distinguish between users until after verification, meaning adults would need to go through the same process as everyone else. This raises legitimate questions about data collection, storage, and the risk of that sensitive identity information being mishandled or exposed down the line.
Staying Informed and Prepared
The EU Kids Act is still a draft, and its final form will likely change as it moves through the legislative process. That makes this an important moment for internet users to pay attention rather than assume the current version is set in stone.
A few practical steps worth considering: stay updated on how the legislation evolves, review the privacy policies of any service that introduces new age-verification requirements, and be cautious about which identity documents or biometric data you're willing to share with third-party verification providers. Supporting organizations that track these developments can also help ensure that child-safety goals don't come at the expense of privacy for everyone else. The debate over the EU Kids Act is far from over, and how it's resolved will shape the balance between safety and privacy online for years to come.
