1. After a World Cup Goal
Your team scores the winning goal in the last second of a World Cup match. You excitedly log into social media, ready to celebrate with the entire internet. But the platform, based on data it has already collected, misidentifies you as under 16. It forces you into a third-party verification app — upload a facial photo, or scan a government-issued ID. You don’t know what country this verification company is registered in, how long the data will be stored, or whether it can survive the next breach. Reluctantly, you hand over your passport photo, then pray this doesn’t come back to haunt you someday.
Now replace celebrating a goal with criticizing a powerful politician. With discussing abuse or addiction you’re currently experiencing. With seeking help for a sensitive medical issue. A “papers, please” internet becomes even more unsettling. And this is exactly where we’re headed. After reading through analyses from FIRE (the Foundation for Individual Rights and Expression) and the Electronic Frontier Foundation (EFF), I’ve tried to trace this trajectory: where it began, how it’s being implemented, and where it’s ultimately taking the internet.
2. A Globally Synchronized Legislative Wave
2025 was described by the EFF as “the year age verification went from fringe policy experiment to full-blown reality.”
Australia led the charge, landing the world’s first under-16 social media ban in December 2025, requiring ten major platforms including Instagram, Snapchat, and TikTok to block underage users, with fines of up to A$49.5 million. But the government’s own research showed that months later, roughly 70% of children were still using social media. A study in the British Medical Journal also found “little evidence of a material, immediate reduction in adolescent social media use.”
The UK chose a more aggressive route. In July 2025, new rules under the Online Safety Act came into force, requiring all online services operating in the UK to assess whether they host content “harmful to children” and to introduce age checks. Former Prime Minister Starmer promised the UK version would be “Australia-plus” — “making it harder for kids to circumvent the protections.” The Technology Secretary announced a further statement on VPNs was forthcoming; the Children’s Commissioner proposed that “age-limiting VPN use” could be considered.
The US and EU followed in step. Over 20 US states enacted age verification laws, at least 19 states passed minor social media legislation, and the federal Kids Online Safety Act is being negotiated between the Senate and the White House. The EU rushed out a “mini age verification” app, directly binding national ID cards to age verification as a precursor to the EU digital identity wallet. France, Germany, Spain, Denmark, Norway, Indonesia, and others are advancing their own legislation.
3. The Technical Routes: Identity Binding Is the Only Common Denominator
Age verification technology follows three main paths. Document upload — scan a passport or driver’s license, verify authenticity, extract date of birth. Facial age estimation — take a selfie, let AI estimate age from facial features. Third-party credential verification — prove age indirectly through a bank account or digital identity service (like Singapore’s k-ID, which Snapchat is using).
All three paths share one underlying logic: to verify “whether you meet a certain age,” the system must first link back to “who you are.” Document upload directly exposes name, address, and ID number. Facial estimation requires collecting biometric data, and error rates are significantly higher for people of color, transgender individuals, and people with facial differences — AI algorithms have lower accuracy on Black, Asian, and Indigenous backgrounds, frequently misclassifying adults as minors.
FIRE’s analysis highlights a crucial insight: even if platforms claim “not every user needs to be checked, as long as the platform has other accurate data,” this doesn’t mean you’ve escaped scrutiny — it only means the platform will use data it already holds to make a judgment. As the Australian Human Rights Commission described it: “We are moving towards a world where you are legally required to be profiled in order to participate.”
4. Privacy Loss Is the Design, Not an Accident
The privacy cost of age verification is a necessary condition for the system to function. Every technical path requires collecting and retaining identity-binding data; otherwise, the act of “verification” cannot be completed.
Data breaches are therefore baked into this architecture from the start. In November 2025, just weeks before Australia’s ban took effect, a third-party customer service app for Discord was breached, exposing roughly 70,000 users’ government ID images, names, emails, and billing information — the app’s primary use was processing platform age verification complaints. Identity verification providers like AU10TIX have experienced similar incidents.
More unsettling is a finding from Australia’s “Age Verification Technology Trial”: service providers were “over-anticipating future information needs by regulators… potentially leading to unnecessary and disproportionate data collection and retention.” The system has a natural tendency to collect more data than anyone imagined and retain it longer than anyone expected.
5. From “Protecting Children” to Citizen Surveillance: Path Dependency
The most significant feature of age verification legislation is its expansion mechanism. Once the legal infrastructure for identity verification is in place, the marginal cost of expansion is extremely low.
The EU digital identity wallet provides a clear case study. The official positioning is “enabling users to prove they are old enough to access restricted websites.” But once the infrastructure is deployed, a single administrative order can extend it to other verification purposes. The UK’s trajectory is even more direct — when officials openly discuss age-restricting VPNs, the UK is approaching the territory of China, Russia, and Iran’s approach to VPN regulation. FIRE author McLaughlin commented: “This is not good company.”
The US is no different. The interweaving of state and federal legislation means that every step on the internet — from downloading an app to creating an account, from posting to browsing content — could embed age verification. FIRE warns: “Once we create this legislative infrastructure of surveillance, we may find it exceedingly difficult to dismantle.”
6. Who Gets Shut Out
The costs of this “papers, please” movement are not evenly distributed. An estimated 15 million adult US citizens don’t have a driver’s license, and 2.6 million lack any form of government-issued photo ID. 18% of Black adults do not have a driver’s license; Hispanic license-holding rates are also significantly lower. 43% of transgender people lack identity documents that accurately reflect their name or gender. AI facial age estimation has higher error rates on people of color, and facial recognition systems fail at significantly higher rates on people with facial differences — roughly 100 million people globally live with facial differences.
This is a structural filtering mechanism: age verification technology embeds inequality along existing fault lines of race, gender identity, disability status, immigration status, and socioeconomic class into a new stratum.
7. The End of Anonymity and the Collision with Internet Architecture
The internet’s original architecture was built on premises of openness and anonymity. TCP/IP does not require identity credentials. End-to-end encryption is designed on the principle that the content between you and your communication partner is unreadable to any intermediary. The Tor network’s core promise is “you don’t need to tell us who you are.”
Age verification laws exist in fundamental tension with this architecture. If every layer demands identity binding — from IP addresses to account creation, from content access to content publishing — encryption and anonymity tools cease to be options and become “circumvention tools” to be regulated or even banned.
British officials have begun collecting data on VPN usage. Australia’s ban has already reclassified VPNs from privacy tools to “potential threats to the Act’s effectiveness.” When governments treat anonymous internet access itself as a security problem to be solved, the internet’s power structure is shifting from distributed user sovereignty toward centralized identity-authentication systems.
This is not a technical problem. It’s a collision between two visions of the internet: one sees internet access as an extension of citizenship, requiring state-issued credentials; the other sees internet access as an extension of being human, where anonymous expression is a prerequisite of freedom, not a vulnerability.
8. Coda: When Papers Become the Ticket
The stated motivation behind age verification laws — protecting children from online harm — addresses a genuinely real social concern. I have no interest in dismissing legislators’ good-faith motives. But a policy cannot be judged by motive alone; it must be scrutinized through its means and its consequences.
The global age verification systems currently being rolled out share one structural characteristic: they presume that every person must prove who they are before they are permitted to speak. Once this logic is written into law, embedded in code, and deployed across platforms used by billions worldwide, the fundamental nature of the internet undergoes an irreversible change. “Papers, please” is no longer the exclusive line of border checkpoints — it’s becoming the first prompt behind the login button.
This is a process that is unfolding right now. What I can do is describe, as accurately as possible, the technical mechanisms, legislative trajectory, and human impact of this process. Readers will form their own judgments.
This article is based on the FIRE (Foundation for Individual Rights and Expression) analysis published June 26, 2026; the EFF’s (Electronic Frontier Foundation) end-of-2025 global age verification tracker and “Top 10 Dangers” report; Hacker News community discussion; and multiple public policy documents and research reports. I have aimed to present established facts and various perspectives objectively; the analytical judgments in the text represent only the synthesis of publicly available information.