Age Verification Laws: How Big Tech Is Building Surveillance Infrastructure While Avoiding Accountability

="">

 

Across the United States, policymakers have embraced age verification as a solution to protect children online. Yet behind the rhetoric of child safety lies a more complicated reality: major technology companies are actively shaping legislation to shift compliance burdens elsewhere while simultaneously expanding their data collection capabilities. New York’s proposed regulations exemplify this troubling trend, creating an unprecedented surveillance regime that threatens the privacy rights of all internet users.

The proliferation of age verification mandates represents one of the most significant threats to digital privacy in recent years. More than half of all U.S. states have now passed laws imposing age-verification requirements on online platforms, with Congress considering nineteen distinct proposals at the federal level. Yet these laws deserve far closer scrutiny than they have received, particularly regarding who truly benefits from their implementation.

The New York Problem: Invasive Mandates Without Guardrails

New York’s approach to age verification stands out for its particular invasiveness. The state’s proposed rules for the SAFE for Kids Act require social media companies to determine users’ ages through methods that fundamentally compromise privacy. These methods include requesting uploaded images or videos, verifying email addresses and phone numbers to cross-check age information, and potentially other invasive techniques to be determined by the state attorney general.

What makes New York’s proposal especially alarming is the lack of specificity combined with broad enforcement power. The law explicitly forbids self-reporting—meaning companies cannot accept a simple declaration of age—and leaves the approved verification methods to regulations written by the Attorney General. This creates a framework where the government maintains total discretion over what invasive technologies companies must deploy. A parent teaching their child to use a computer, or a teenager creating their own account for legitimate purposes, could trigger mandatory age verification systems that collect sensitive biometric data or government-issued identification documents.

The Device-Level Mandate: A Chilling Expansion

Even more troubling is New York’s proposed Senate Bill S8102A, which extends age verification requirements beyond apps and websites to internet-enabled devices themselves. This legislation would require adults to prove their age to use computers, exercise bikes, smartwatches, or internet-connected cars. Such breadth represents an unprecedented government intrusion into device use.

The bill’s vague language creates particular concerns for open-source communities. Under its current wording, a Linux distribution downloaded from the internet could technically make the downloader the device manufacturer—the entity responsible for providing the freely distributed operating system. While such language is rarely enforced in practice, it highlights how laws written for centralized platforms like iOS and Android struggle when applied to open computing systems where anyone can install or distribute software. This regulatory overreach threatens the foundation of decentralized technology development.

Following the Money: Big Tech’s Strategic Positioning

A closer examination of which companies support specific age verification frameworks reveals a strategic pattern. Meta, X, and Snap have publicly praised legislation that shifts verification responsibility to app stores like Google Play and Apple’s App Store, rather than requiring the platforms themselves to verify users. This seemingly technical distinction masks a profound accountability shift.

By advocating for app-store-level verification, social media giants can claim they are supporting child protection while actually distancing themselves from direct compliance costs and legal liability. If verification fails or data breaches occur at the app store level, Meta and its peers can argue they fulfilled their obligations by providing the necessary information to app stores. The companies pushing hardest for these laws—precisely those with the most sophisticated data collection capabilities—benefit most from frameworks that don’t require them to invest in privacy-preserving verification technologies.

The Data Collection Imperative Driving Legislation

System76’s CEO Carl Richell raised a critical point often overlooked in age verification debates: these laws inevitably create systems for data collection that extend far beyond their stated purpose. Operating system providers and covered application stores must not only verify age but signal that information to third-party developers. This creates a centralized age-data infrastructure that applications can query in real time.

The structure of California’s Digital Age Assurance Act illustrates this perfectly. Operating systems must collect users’ age information at account setup and provide age-range signals to developers through application programming interfaces. Once a developer receives this signal, they are legally deemed to have actual knowledge of the user’s age. This framework normalizes the collection and distribution of age data across the entire software ecosystem.

Open-Source Communities Bear the Burden

California’s law forces operating systems, including volunteer-run Linux distributions, to implement age-tracking APIs. Distributions like Fedora, Ubuntu, and Debian now face compliance decisions with deadlines approaching January 1, 2027. Unlike corporations with legal teams and engineers available for compliance work, these volunteer-driven projects must choose between implementing expensive age-verification systems or restricting access for California users.

The burden falls most heavily on those least able to bear it. Small developers, open-source maintainers, and community-driven projects lack the resources to implement the technical infrastructure required by these laws. Meanwhile, major technology companies can absorb compliance costs and integrate age verification into their existing data-collection infrastructure. This creates a regulatory moat that entrenches existing power structures in the technology industry.

Privacy Risks That Dwarf the Stated Benefits

Discord’s October 2025 data breach exemplifies the real-world dangers of age verification systems. A breach at a third-party vendor handling customer service exposed at least 70,000 government-issued identification documents. The breach occurred despite Discord’s attempts to delete photos after the age-estimation process completed—the system was hacked through the appeals process where users submitted ID copies to challenge age-restriction decisions.

This incident demonstrates a fundamental problem with age verification architecture: collecting sensitive data to prove age creates high-value targets for criminal actors. No matter how carefully companies design their systems, third-party vendors introduce additional security risks. When sensitive identification data passes through multiple processing steps and storage locations—which are common features of age-verification systems—the likelihood of breach increases substantially.

The Paradox of Protection Through Surveillance

Age verification laws create what experts call the age verification trap: attempting to protect children by collecting invasive data that simultaneously threatens their privacy and security. The methods proposed under New York’s framework would require either biometric scans that are inaccurate for marginalized groups or government ID submission that exposes users to identity theft and data breach risks.

Biometric age estimation using facial recognition has documented accuracy problems, particularly for women and people of color. These systems frequently misclassify adults as minors while failing to accurately estimate ages for younger teenagers. A technology with margin-of-error spanning several years cannot reliably enforce age restrictions at the thirteen or eighteen-year thresholds these laws require.

A Surveillance Architecture Built in the Name of Safety

What emerges from examining age verification laws across states and proposed federal legislation is a troubling pattern: major technology companies are successfully lobbying for regulatory frameworks that appear to protect children while actually expanding their ability to collect and distribute age data. By advocating for device-level and app-store-level verification rather than service-level age checks, these companies shift compliance burdens to less-resourced entities while maintaining control over the age data infrastructure itself.

New York’s approach represents the most aggressive version of this trend, with proposed regulations that grant the Attorney General nearly unlimited discretion to mandate invasive verification technologies. Combined with device-level age requirements and extensions beyond social media, the state has proposed an unprecedented surveillance regime that threatens privacy rights across the entire internet ecosystem.

Rather than implementing these invasive systems, policymakers should focus on comprehensive privacy protections and stronger regulation of algorithmic content distribution—approaches that address the actual harms social media poses to children without building permanent surveillance infrastructure that benefits the companies claiming to oppose such measures.

Richell’s Appeal

In his blog post, Richell elequolently outlined what’s at stake:

“Liberty has costs, but it’s worth it,” writes Richell.

“A centralized platform designed to control the activity of the user creates the environment where the centralized platform provider can themselves then be controlled by higher powers. Decentralized platforms and app stores, like Linux, are essential to the personal liberty of adults and children.

“This extends to the potential of humanity itself. The computer is the most powerful and versatile technology we’ve ever created. It is a foundational technology that affects the progress of all other innovations. A platform that controls the user’s activity, and can itself be controlled, limits the user’s ability to contribute to our shared future. Many of the world’s best programmers started experimenting with computers as children.

“In the case of Colorado’s and California’s bills, effectiveness is lost. In the case of New York’s bill, liberty is lost. In the case of centralized platforms, potential is lost.

“It’s cultural

“Continuing to tighten the screws on access to the world will fail…They’ll find a way.

“The challenges we face are neither technical nor legal. The only solution is to educate our children about life with digital abundance. Throwing them into the deep end when they’re 16 or 18 is too late. It’s a wonderful and weird world. Yes, there are dark corners. There always will be. We have to teach our children what to do when they encounter them and we have to trust them.”