Three hundred and seventy-one security and privacy academics from 29 countries signed an open letter this week calling on governments to halt age verification rollouts until the privacy and security implications are properly understood.
The letter arrives as lawmakers across the world race to ban children from social media, pushing platforms to implement age checks before anyone has settled on what those checks should actually look like.
The signatories are unambiguous. Deploying large-scale identity verification systems without a clear grasp of what they do to user security, autonomy, and freedom is, in their words, “dangerous and socially unacceptable.”
Among those signing: Ronald Rivest, Turing Award winner, and Bart Preneel, president of the International Association for Cryptologic Research. These voices represent the core of the global security research community.
Reclaim Your Digital Freedom.
Get unfiltered coverage of surveillance, censorship, and the technology threatening your civil liberties.
What governments are building, the letter argues, is surveillance infrastructure masquerading as child protection. A real age verification system, the academics explain, would require “government-issued IDs with strong cryptographic protection for every single interaction with the service.”
That means every search query, every message to a friend, every news article read online would require identity confirmation. Nothing in offline life demands that. The parallel doesn’t exist.
Companies are already moving. OpenAI, Roblox, and Discord have all begun implementing age checks in anticipation of legal mandates.
The academics aren’t dismissing the underlying concern. “We share the concerns about the negative effects that exposure to harmful content online has on children,” the letter states. What they’re rejecting is the proposed solution, which turns every adult into a suspect who must prove their identity before accessing the open web.
The technical problems compound the political ones. Building and maintaining identity verification at a global scale is genuinely hard. Many service providers, faced with the friction and cost, would simply refuse to comply.
And the platforms that can deploy these systems at scale are a handful of large corporations, meaning age verification becomes another mechanism for centralizing internet infrastructure in the hands of the few companies already dominant enough to afford it.
There’s another risk the academics name directly: governments banning VPNs. Age checks are trivially circumvented with a VPN, and the predictable policy response is to ban them outright. VPNs are currently one of the few tools available to people living under authoritarian regimes trying to protect their communications and identities.
Banning VPNs to enforce age checks on teenagers would strip that protection from dissidents, journalists, and activists worldwide. The collateral damage would be severe and global.
The academics are asking for a pause until scientific consensus forms around “the benefits and harms that age-assurance technologies can bring, and on the technical feasibility.”
What’s unreasonable is building mass identity verification systems first and studying the consequences after.
