Senate Commerce Committee Moves on Age Verification

The Senate Commerce Committee held a markup this week that pushed forward the Kids Online Safety Act (KOSA) alongside two other bills aimed at protecting young people online. The legislation, as described in Engine's Startup News Digest, would require platforms to verify the age of all users, not just the ones lawmakers are trying to protect, in order to limit minors' access to certain features and types of content.

That detail matters more than it might first appear. Age verification sounds like a narrow, child-safety-focused requirement, but the mechanics of actually implementing it touch every person who uses an affected platform, regardless of age. To know who is a minor, a service first has to determine who is not, which typically means collecting some form of identifying information from adults too.

The Privacy Trade-Off Behind Age Verification

This is the tension that privacy advocates, startups, and civil liberties groups have raised repeatedly as KOSA and similar bills have moved through Congress over the past few years. Verifying age at scale generally requires one of a few approaches: uploading a government ID, submitting to facial age estimation, or relying on third-party data brokers who infer age from browsing and purchase history. Each of these methods creates a new pool of sensitive personal data that has to be collected, stored, and secured somewhere.

For startups and smaller platforms in particular, this raises practical questions. Building or licensing verification infrastructure is not free, and every additional store of identity data is a potential liability if it is ever breached, subpoenaed, or misused. Larger platforms may be able to absorb these costs, but smaller companies, including the kind Engine's newsletter is written for, could face a disproportionate burden just to comply with a rule meant to target a narrow slice of harmful content aimed at minors.

Supporters of KOSA and the accompanying bills argue that the risks minors face online, from targeted advertising to harmful content recommendations, justify these tradeoffs. Critics counter that mandatory verification effectively ends anonymous or pseudonymous use of the internet for everyone, a change with implications well beyond the youth safety debate the bills are meant to address.

A Broader Pattern of Data Collection Mandates

The Senate markup is part of a wider trend of governments around the world tightening rules around how personal data is collected and handled online. Regulators are increasingly willing to require platforms to gather more identifying information as a condition of doing business, even when the stated goal is protective rather than commercial. Zimbabwe's telecoms regulator, for instance, recently announced it will begin actively enforcing data protection law starting in September 2026, a reminder that data collection obligations and data protection obligations are increasingly moving in tandem across different regulatory systems, not just in the United States.

That pairing is worth watching. Any law that expands the amount of personal data platforms must collect, whether for age verification or another purpose, only reduces risk to users if it is matched by equally strong rules about how that data is stored, secured, and eventually deleted. Age verification mandates that lack clear data minimization and retention limits risk creating exactly the kind of large, centralized identity databases that are attractive targets for attackers.

What This Means For You

If KOSA or similar age verification requirements become law, expect more platforms to ask for some form of identity confirmation before you can access certain content or features, even if you are well past the age these rules are meant to protect. That could mean uploading an ID, submitting to a selfie scan, or having your account cross-checked against third-party data.

Before that happens, it is worth thinking now about how much identifying information you are comfortable sharing with any given platform, and whether that platform has published a clear policy on how long it retains verification data and who it shares it with. Read the privacy policy of any service that asks for age verification, and be skeptical of apps or sites that request more information than seems necessary for the stated purpose.

Key Takeaways

  • The Senate Commerce Committee advanced KOSA and two related bills this week that would require broad age verification across affected platforms.
  • Verifying minors' ages in practice means verifying everyone's age, raising privacy questions for adult users too.
  • Smaller platforms and startups may face real compliance costs, which is why groups like Engine are tracking the legislation closely.
  • Watch for how any final law handles data retention and security, since that will determine whether age verification actually reduces risk or simply creates a new one.

This legislation is still moving through Congress, and its final shape, including how verification will actually be implemented, remains unsettled. Readers who care about both child safety and personal privacy online should keep an eye on how the bill evolves before it reaches a full Senate vote.