A recent episode from the American Enterprise Institute (AEI) puts a pointed question on the table: can we verify age without giving up our privacy? Host Shane is joined by Scott Vien, Harry Oppenheimer, and Paul Lekas to discuss international age verification laws, cybersecurity challenges, and related topics. The published summary is brief, so this post does not attempt to report what each guest said. Instead, it uses the episode's question as a starting point to explain the main approaches to age verification and privacy, and what readers can do about it.

Why Age Verification Is a Privacy Problem

Age-gating laws ask a simple question: is this visitor old enough? Answering it reliably, however, usually means collecting something sensitive. A checkbox that says "I am over 18" is easy to bypass, so lawmakers in many places want stronger proof. That proof can take the form of a government ID, a face scan, or data from another trusted source.

Each option creates a trade-off. The more certain a service is about your age, the more it tends to learn about you. And once identity documents or biometric data are collected, they become something that can be stored, leaked, or misused. That is the cybersecurity challenge at the heart of this debate.

Three Approaches Compared

There is no single standard for how to check age online. The most commonly discussed methods differ in how much they reveal.

ID uploads. The user submits a photo of a driver's license or passport, sometimes with a selfie. This is straightforward for a site to implement, but it concentrates highly sensitive documents with whoever processes them. Users must trust both the site and any vendor it uses to handle and delete that data.

Third-party tokens. A separate provider confirms your age once and then issues a token or credential that sites can accept. The site learns only that you passed the check. The risk shifts to the token issuer, which may know a lot about you, and to how well the system prevents tracking across sites.

Zero-knowledge proofs. This cryptographic technique lets you prove a statement (such as "I am over 18") without revealing the underlying data, like your birthdate or name. In theory it offers the strongest privacy. In practice, it depends on trusted credentials being issued in the first place and on wide adoption by sites and devices.

None of these is perfect. Privacy-friendly designs tend to be harder to deploy, while easy-to-deploy designs tend to collect more data.

Laws Are Multiplying, and Responsibility Is Contested

The policy picture is moving quickly. In the United States, the spread of state laws has been significant: our coverage of 27 states that have passed age verification laws shows how widely the trend has reached, and how some creators are pushing back. In Florida, adult sites must verify visitors under HB 3, and we have explained how Florida's age verification law treats VPN use.

Internationally, the EU is also looking at the issue. The European Commission is reportedly preparing an EU Kids Act that could force age verification on online games. Meanwhile, who bears responsibility for these checks is itself disputed: Apple and Google have reportedly lobbied to strip liability from age check bills. Where liability lands will shape which technical approach companies choose.

The AEI episode's focus on international laws fits this pattern. Different jurisdictions are reaching for different tools, and the privacy outcomes depend heavily on the details.

What This Means For You

For most people, the practical effect is more prompts asking for proof of age, and more uncertainty about what happens to the data you provide. A few points are worth keeping in mind:

  • Ask what is collected and kept. Look for statements on whether ID images or face scans are deleted after the check.
  • Prefer methods that reveal less. If a service offers a choice, an option that confirms only "over 18" is generally preferable to one that stores a full document.
  • Expect VPNs to be part of the conversation. Age-gating laws are tied to location, so VPN use can interact with them. A VPN changes your apparent location, but it does not change the legal obligations of a site, and rules differ by jurisdiction. Check the specific law that applies to you rather than assuming.
  • Be wary of lookalike checks. Fake verification pages can imitate real ones to harvest documents. Make sure you reached the site through a link you trust.

Takeaways

The AEI discussion asks the right question, and the honest answer is that it depends on design. Age verification and privacy can coexist only if systems minimize the data they collect, limit retention, and avoid tracking users across sites. Until such designs are common, treat every request for ID or biometrics as a decision worth pausing over.

To protect yourself: share the minimum required, use strong and unique passwords for any accounts created during verification, and follow how laws in your region evolve. Staying informed is the best defense while the rules and the technology continue to settle.