As governments around the world race to pass online child safety laws, a new research paper from the Center for Growth and Opportunity (CGO) is asking a question that often gets lost in the rush to legislate: how should policymakers actually approach age verification without creating new privacy problems in the process?

The paper, published on CGO's research site, doesn't argue against protecting kids online. Instead, it lays out the practical and technical tradeoffs lawmakers face when they mandate age assurance systems, the tools websites and apps use to confirm whether a visitor is old enough to access certain content. That framing matters, because age verification has become one of the most contested privacy issues in tech policy, with dozens of state and national governments experimenting with different approaches over the past few years.

Why Age Verification Keeps Coming Up in Policy Debates

The push for age verification isn't new, but it has accelerated as lawmakers respond to public concern about children's exposure to harmful content, from adult material to addictive social media features. The instinct behind these laws is straightforward: if a platform can confirm a user's age, it can restrict access accordingly.

The problem, as the CGO paper highlights, is that confirming age reliably almost always means collecting more personal information than a typical login requires. Whether that's a government-issued ID, a facial scan, or third-party data verification, each method introduces new points where sensitive data could be mishandled, leaked, or repurposed. Policymakers drafting these rules often focus on the safety outcome they want without fully accounting for the privacy infrastructure needed to get there.

This tension isn't theoretical. It's already playing out in real jurisdictions. The UK's Online Safety Act, for example, has forced regulators to grapple with exactly these tradeoffs. Notably, UK officials rejected calls to restrict VPN use as a workaround for age checks, a decision that underscores how difficult it is to close every loophole without infringing on broader digital rights.

The Circumvention Problem Policymakers Can't Ignore

One of the more practical challenges the CGO paper touches on is enforcement in the real world, not just in theory. Age verification systems only work if they're difficult to bypass, and evidence from the UK suggests that's a tall order. Government research there found that roughly one in four children have used a VPN to get around age verification checks, effectively routing around the very systems designed to protect them.

That statistic matters for the broader policy conversation because it illustrates a core dilemma: strict age verification requirements can push platforms to collect more identifying data from adult users while still failing to reliably stop tech-savvy minors from accessing restricted content. If a law increases privacy exposure without proportionally increasing child safety, policymakers need to ask whether the tradeoff is worth it, or whether a different approach would serve both goals better.

Privacy Implications Policymakers Should Weigh

The CGO paper's core contribution is reframing age verification as a design problem, not just a policy mandate. That means lawmakers should be asking specific questions before finalizing legislation:

  • Does the verification method require collecting more data than necessary to confirm age?
  • Who holds that data, for how long, and under what security standards?
  • Can the system be implemented without creating a centralized database of users' identities and browsing habits?
  • Are there less invasive alternatives, such as device-level or parental controls, that could achieve similar safety outcomes?

These questions echo concerns raised by privacy advocates for years: that age verification systems, if poorly designed, can become exactly the kind of honeypot of sensitive personal data that bad actors would want to target.

What This Means For You

If you're a parent, this research is a reminder that age verification laws, however well-intentioned, are not a silver bullet. Kids who want to bypass restrictions often find ways to do so, including through VPNs, so technical mandates alone shouldn't replace conversations at home about online safety.

If you're a regular internet user, it's worth paying attention to how these laws are implemented in your region. Age verification requirements can affect anyone visiting a regulated site, not just minors, since platforms often need to confirm the age of all users to comply. That means your own personal data, potentially including ID scans or biometric information, could end up part of a verification system you never asked to be part of.

Key Takeaways

As more jurisdictions consider age verification mandates, the CGO paper's message is clear: good intentions aren't enough. Policymakers need to design systems that minimize data collection, avoid centralized identity databases, and account for how easily determined users can circumvent restrictions. For everyday readers, staying informed about how these laws work in practice, and being cautious about what personal information you're asked to hand over to access everyday websites, remains the best way to protect both your privacy and your family's safety online.