The Internet Is About to Demand Your Papers — And Age Verification Is Just the Cover Story
Something happened in Australia last December that barely made a dent in American tech media, but every privacy engineer I know has been quietly alarmed about it for months. Australia’s under-16 social media ban went into effect — and with it came a mandate that platforms verify users’ ages using biometrics, government ID scans, or data from third-party companies most users have never heard of.
The ban isn’t working. Seven out of ten kids are still using social media, according to the Australian government’s own research. A study in the British Medical Journal published this month found “little evidence of immediate substantive reductions in reported social media use by adolescents under 16.” The technology failed the policy goal it was designed to serve, almost immediately.
What the law did accomplish, though, was create the regulatory infrastructure for mandatory identity verification at scale on the open internet — and that infrastructure is spreading. The UK, France, Spain, the UAE, Indonesia, Malaysia, Greece, Denmark, Norway, and the EU are all following Australia’s template. UK Prime Minister Keir Starmer (before his resignation) pledged an “Australia-plus” version that goes further. The EU’s Digital Services Act imposes age verification obligations across the bloc. The US is watching closely, with multiple states already passing age verification laws of their own.
I want to be precise about what engineers and security practitioners should actually be thinking about here. The political debate focuses on children. The privacy and infrastructure debate is about everyone else.
What Age Verification Actually Builds
Let’s be specific about the technical components involved, because abstract debates about “privacy” often miss what’s really being constructed.
When Australia mandated age verification, platforms scrambled to comply. Snapchat chose k-ID, a Singapore-based company. The verification process accepts a banking connection, a government ID scan, or a selfie that k-ID uses to estimate an age range. The user uploads a photo of their passport or their face to a company incorporated in Singapore, governed by Singaporean privacy law, operating under a contract with Snapchat, to prove to the Australian government that they’re old enough to post about their favorite sports team.
Ask yourself: what is this company’s threat model? Who audits their data retention? What happens when a hostile government issues a legal demand to k-ID’s Singapore entity? What is the breach notification requirement if their database is compromised? How long does the biometric template persist after the age check resolves?
We already have a data point. Weeks before Australia’s under-16 ban went into effect, a third-party customer service app Discord used specifically to handle age assurance complaints was breached. Government ID images, names, usernames, email addresses, and billing information were exposed for approximately 70,000 users. The breach wasn’t at the main platform — it was at one of the verification-adjacent services that didn’t exist until the regulatory mandate created demand for it.
This is a systemic risk that scales nonlinearly. One government mandate creates dozens of new third-party verification vendors. Each vendor is a new attack surface. Each vendor aggregates government ID data from millions of users across multiple platforms. The breach at any single vendor exposes not just their own data but the identity infrastructure of every platform that outsourced to them.
The Real Problem: Profiling Is the Point
Australia’s eSafety Commissioner guidance contains a phrase that privacy practitioners should read carefully: “No, not every account holder will go through an age check process if the platform has other accurate data.”
The Australian Human Rights Commission decoded what this actually means: “It just means that platforms will use what they already know about you to make the call. That’s the real shift that is happening here. We’re moving to a world where the law requires you to be profiled in order to participate.”
This is the mechanism. Age verification doesn’t require every user to submit ID. It requires platforms to know enough about every user to make an age determination without ID. That means platforms that don’t already have robust demographic profiles have a regulatory incentive to build them. The law doesn’t mandate surveillance — it creates strong incentives for platforms to surveil more aggressively, so that fewer users trigger the ID submission flow that creates compliance friction.
In production systems, this plays out predictably. A platform with rich behavioral data — location history, typing patterns, browsing habits, social graph analysis — can make confident age inferences on most users without asking for ID. A platform that hasn’t been building that profile has to ask more users to submit documents. The regulatory pressure optimizes toward deeper continuous surveillance as a substitute for discrete identity events.
For the minority of users who do get flagged for ID submission, the result is a one-time biometric or document event that becomes part of a persistent record. For the majority who don’t, the result is normalization of the idea that platforms may infer private facts about you and act on those inferences without disclosure. Both outcomes damage privacy. The second one is harder to see and therefore more dangerous long-term.
The VPN Problem — and Why It’s Revealing
Every age verification scheme faces the same technical reality: VPNs exist. Users can trivially route traffic through a different jurisdiction, defeating geolocation-based enforcement. In Australia, VPN downloads surged after the ban. In the UK after the Online Safety Act, the same thing happened.
UK officials’ response to this problem is instructive. Technology Secretary Liz Kendall announced that the government “will make further statements in July about VPNs.” Children’s Minister Josh MacAlister said there are “options there about whether we could age-gate VPN use.” The government is openly considering mandatory age verification for VPN access.
Think about what this means in infrastructure terms. To enforce age-gated VPN access, you need ISP-level traffic inspection capable of identifying VPN connections. You need a registration mechanism for “compliant” VPN services. You need the ability to block or penalize non-compliant VPN services, which are by design operated from outside the jurisdiction. You need something that looks a lot like the Great Firewall.
The UK doesn’t currently have the technical or legal infrastructure to do this. But the fact that senior government officials are discussing it as a policy option — not as a hypothetical slippery slope, but as an explicit next step — tells you something important about where this trajectory leads when technical workarounds exist. The logic of enforcement always pushes toward closing the workarounds, and the workarounds are the same mechanisms that protect journalists, dissidents, domestic abuse victims, and ordinary citizens who have legitimate reasons to want network privacy.
The Third-Party Verification Market Is a Security Disaster Waiting to Happen
The market that age verification mandates create is structurally unsafe. Here’s why.
Government ID verification is a specialized security domain. Handling passport images, biometric data, and national ID numbers requires deep expertise in secure enclaves, cryptographic attestation, minimal data retention, and adversarial robustness against document forgery and injection attacks. The companies that do this well — the ones with actual security engineering depth — are expensive, slow to integrate, and often not accessible to small platforms.
Regulatory mandates don’t wait for the market to produce adequate security. They create compliance deadlines. Platforms facing fines comply with whatever is available and affordable by the deadline. This drives demand toward cheaper, faster verification vendors whose core competency is API surface area and sales cycles, not security architecture.
k-ID, the Snapchat vendor I mentioned earlier, is a Singapore startup. I don’t know their security posture — I’ve never audited them, and public information is sparse. My point is not that they’re insecure. My point is that I can’t know, Snapchat’s users can’t know, and the Australian government’s mandate created a situation where Snapchat had to pick a vendor before adequate information was available. When 70,000 users’ passport images leaked from an age verification-adjacent service weeks before the ban went into effect, it wasn’t a coincidence — it was a preview of the incentive structure the mandate created.
Australia’s own pre-implementation research found “some concerning evidence that in the absence of specific guidance, service providers were apparently over-anticipating the eventual needs of regulators about providing personal information for future investigation… which could lead to increased risk of privacy breaches due to unnecessary and disproportionate collection and retention of data.” Read that sentence slowly. Verification vendors were collecting more than they needed, speculatively, in case government investigators asked for it later.
What This Looks Like at Scale
Let me describe a scenario that isn’t speculative — it’s the logical extension of existing Australian law combined with the “Australia-plus” ambitions of the UK and EU.
A user signs up for a social media platform in 2027. The platform is required by law to verify that the user is over 16. The user hasn’t interacted with the platform before, so profiling data is insufficient for an age inference. The platform routes the user to a third-party verifier. The verifier requires either a government ID scan or a face photo with liveness detection.
The user provides a passport photo. The verifier runs it against a government database — this is the explicit goal of “interoperability” frameworks being discussed in the UK — and returns an age token to the platform. The user is granted access.
What happened in that transaction: the user’s passport data is now held by the verifier (for an undefined retention period), linked to the platform account, associated with an IP address and device fingerprint, and potentially accessible to the verifier’s home government under local law. The platform knows the user’s real identity is verified, which changes the legal risk calculus for any content they post. The government has established a precedent that internet access is conditioned on identity verification, not pseudonymous participation.
Three years later, the same verification infrastructure processes a user in a country that has adopted the same framework but is led by a government with different values. The passports are the same. The vendors are the same. The APIs are the same. The data is the same. What changed is who controls what happens with it.
The Children’s Safety Argument Doesn’t Survive Contact With Data
I want to address the strongest version of the case for these laws, because dismissing it as pure pretext isn’t accurate. Real harms happen to children online. Platforms have failed badly at protecting them. The impulse to do something is understandable.
But the empirical case for age verification as a solution to those harms is weak. Australia’s ban has been in effect since December 2025. It is not working. The BMJ study is recent, methodologically careful, and finds “little evidence of immediate substantive reductions in reported social media use by adolescents under 16.” The government’s own data shows 70% bypass rates. The children most at risk — those with abusive home situations, isolation, mental health crises — are arguably the most motivated to find workarounds, and the least protected by barriers that technically sophisticated users can trivially defeat.
Meanwhile, the surveillance infrastructure being built to enforce the law has demonstrably harmed adults. A breach exposed 70,000 Australians’ government ID data. The government acknowledged that phishing attempts increased because users were confused about legitimate versus fraudulent verification requests. Adults who post about addiction recovery, medical conditions, political dissent, or personal relationships now know that their platform accounts are linked to verified identity, even if they haven’t personally submitted ID.
The harm calculus isn’t “imperfect child protection versus perfect privacy.” It’s “ineffective child protection at the cost of documented, ongoing adult privacy harms.” That’s a bad trade, and the engineering community that builds and maintains this infrastructure should be saying so clearly.
What Comes Next — and What Engineers Can Do About It
This trajectory isn’t inevitable. There are technical alternatives that haven’t gotten serious regulatory consideration because they’re less tractable as political solutions, even though they’re better engineering.
Zero-knowledge age proofs are the obvious one. A user proves to a platform that they’re over 16 without revealing their identity, using a credential issued by a trusted authority (government, bank, telecom) that the verifier cannot link back to the issuing event. The platform learns only “over 16: yes/no.” No government ID image, no biometric template, no persistent record. The cryptography for this has existed for years. The EFF, Privacy International, and several academic research groups have published working implementations. The reason ZK proofs haven’t been adopted in age verification legislation is that they don’t serve the secondary goals — the ones about establishing verified-identity infrastructure for future uses — that government mandates implicitly include.
Device-level age verification, where the OS or device manufacturer handles the verification event and provides an attested credential to apps without exposing underlying identity, is a second option Apple and Google have prototype implementations of that haven’t been formalized into API standards. This keeps sensitive data off the platform and the third-party verifier entirely.
Neither of these solutions will be proposed by the governments currently rolling out age verification mandates, because they don’t build the same infrastructure. That tells you something about what the infrastructure is for.
For engineers building systems that will need to comply with these mandates: push back on maximum data retention. Implement minimal collection as a design constraint, not an afterthought. Use verified-identity claims rather than verified-identity documents wherever possible. Demand your vendor’s security audit results. Ask your legal team whether the mandate actually requires document storage or whether a discarded-after-processing architecture is compliant. In most cases, the mandate requires a verification outcome, not an indefinite document archive — the default toward retention is an industry habit, not a legal necessity.
For engineers at platforms considering verification vendor selection: apply the same due diligence to a verification vendor that you’d apply to a payment processor. SOC 2 Type II, penetration test results, breach notification SLA, subprocessor list, government access policy, data residency. A vendor that can’t answer these questions on a sales call is a vendor that won’t answer them when regulators ask after a breach.
The Papers We Actually Need to See
The “papers, please” metaphor from the original article that sparked this wave of HN discussion is right, but it understates the technical situation. A border checkpoint demands papers and then lets you pass. Internet age verification demands papers, retains them, links them to behavioral data across the duration of your account, potentially shares them with third parties operating under foreign law, and contributes to a market of competing verification vendors each holding their own copy of government ID data from millions of users.
What we need — and what the engineering community specifically should be demanding from policymakers — is not “no age verification” but “verifiable, auditable, privacy-preserving age verification that actually serves the stated goal.” The gap between what’s being built and what the stated goal requires is not a technical limitation. It’s a policy choice that engineers are being asked to implement.
Australia’s law mandated verification and left the method to the market. The market produced k-ID and a 70,000-person breach. “Australia-plus” will produce more of the same, faster. The UK and EU discussing VPN restrictions will produce infrastructure that looks like censorship apparatus in any government’s hands, regardless of which government currently holds the keys.
The people who understand this are largely the people in our industry. We are often not in the rooms where these decisions are made. We are in the rooms where the implementations get built. That’s where the resistance, the friction, the preference for privacy-preserving alternatives, and the refusal to architect unnecessary data retention has to come from.
Papers, please. But let’s make sure we understand which papers, held by whom, for how long, accessible under what legal frameworks, before we normalize handing them over.
The Identity Verification Stack Is Being Built for More Than Age
There’s a context that makes the age verification mandates legible in a way that “child safety” framing obscures. We’re in the middle of a decade-long project by multiple governments to create reliable digital identity infrastructure. Age verification is one entry point. Fraud prevention is another. Counter-terrorism and anti-money-laundering compliance created the banking-side of digital identity. AI-generated content attribution is emerging as a third pressure vector — several EU proposals and US state bills mention identity verification as a mechanism for flagging AI-generated political speech.
These different policy goals share a common infrastructure requirement: a reliable mapping between online accounts and real-world verified identities. The investment in building that mapping is enormous. Once it exists at scale, the uses it gets put to are no longer controlled by the original mandate that funded its construction.
I’ve worked on systems adjacent to this problem for long enough to know how infrastructure gets repurposed. You build a data store to satisfy one compliance requirement. Then a different regulation requires retention of a related dataset. Then a government investigation subpoenas both. Then a breach exposes both simultaneously. Then a contract renegotiation transfers both to an acquirer operating under different jurisdiction. None of these steps required malice. All of them followed naturally from the fact that the infrastructure existed and could be pointed at new requirements.
The age verification vendors being created by Australia’s mandate are not building products for age verification. They’re building digital identity infrastructure that happens to be deployed first for age verification because that’s where the immediate regulatory demand is. Their investor pitches, their product roadmaps, their API designs — they’re all optimized for the broader digital identity market, not the narrow age check use case. When you buy k-ID’s age verification product, you’re funding a company that is planning to sell your users’ verified identity infrastructure for other purposes as their market develops.
This isn’t a conspiracy theory. It’s the normal trajectory of identity infrastructure companies, and it’s knowable from their public materials.
The Compelled Disclosure Problem
One aspect of this issue that doesn’t get sufficient engineering attention: what does a government access request to a verification vendor actually look like, legally?
k-ID is incorporated in Singapore. Singapore’s Personal Data Protection Act has government access exceptions. The UK’s Investigatory Powers Act 2016 compels disclosure from companies operating in the UK. Australia’s Assistance and Access Act 2018 can compel technical assistance including data disclosure. The EU’s Digital Markets Act doesn’t directly mandate government access, but national security carveouts in EU member states create pathways for it.
When a user verifies their age with a Singapore-based vendor to access a US-based social media platform operating under Australian law, the legal jurisdiction for their government ID image is genuinely unclear. At least three different governments have plausible legal theories for compelling disclosure. The verification vendor almost certainly doesn’t have the legal budget to contest all three simultaneously, which means in practice they respond to whoever asks loudly enough.
This is not a hypothetical for users in democratic, rule-of-law countries. It is an actual problem today, and it worsens as the same infrastructure gets deployed in countries with more aggressive surveillance appetites. Age verification mandates don’t currently require platforms to disclose to users which jurisdictions’ laws govern their identity data, or which governments have requested it. That’s a gap that should bother everyone designing systems that handle this data.
Chilling Effects on Speech — the Mechanism, Not the Theory
Privacy literature talks about “chilling effects” on speech and behavior when people know they’re being observed. This is often treated as a soft, psychological claim — people feel watched and therefore self-censor. I want to describe the engineering mechanism by which identity verification creates chilling effects, because it’s more concrete than the psychological framing suggests.
When a user’s platform account is linked to a verified identity, the legal risk calculus for anything they post changes. Before verification: a post about an employer, a political figure, a medical condition, or a personal relationship carries legal exposure roughly proportional to the effort required to unmask the poster. After verification: that post carries full legal exposure, because unmasking is already done. The platform knows who you are. They can be compelled to disclose it.
Users respond to this rationally. A study of China’s real-name internet registration requirement found measurable reductions in politically sensitive speech and increases in self-censorship even on ostensibly personal topics. Similar effects have been documented in South Korea’s now-struck-down real-name registration law. We have empirical data on how verified-identity internet affects speech behavior, because several countries have run the experiment before us.
The argument usually offered in response is that law-abiding citizens have nothing to fear from verified identity. This argument fails on two counts. First, “law-abiding” is not a fixed property — laws change, and speech that is legal today can be criminalized by a future government that now has access to a verified-identity archive of what you said. Second, the chilling effect doesn’t require illegality. Anonymous speech serves legitimate functions in any free society: whistleblowing, abuse disclosure, medical information sharing, minority community communication, political dissent. None of these require illegality to be valuable and none of them survive the transition to verified-identity internet intact.
Where the US Is Heading
The US tends to follow UK and Australian internet policy with a lag of two to five years. We saw this with GDPR-adjacent state privacy laws, with age-appropriate design codes, with platform liability debates. Age verification is following the same trajectory.
Louisiana was the first US state to pass a comprehensive age verification law for adult content, requiring government ID for pornography sites. That law has been legally challenged but has survived initial court review. Texas and Arkansas passed similar laws. More than a dozen states have passed some form of social media age restriction with verification components. The Kids Online Safety Act has been proposed at the federal level multiple times.
The federal privacy law that would create consistent standards for how age verification data is handled doesn’t exist. The result, if this trajectory continues, will be a patchwork of state laws creating dozens of different verification regimes, each with its own data handling requirements, each served by a slightly different set of verification vendors, each creating its own breach surface. This is worse security than a single national standard would produce, but it’s the politically plausible path.
The Supreme Court’s track record on internet age verification is mixed. In Ashcroft v. ACLU (2004), the Court struck down the Child Online Protection Act on First Amendment grounds. In NetChoice v. Paxton and related cases, the Court has been wrestling with how First Amendment protections apply to platform regulation. The outcomes are not predictable, and relying on courts to solve this problem is not an engineering strategy.
The Analogy to Credit Bureau Infrastructure
The closest analog in US history to what age verification mandates are building is the credit bureau system. In the 1960s and 1970s, the US allowed a private market to develop credit reporting infrastructure without meaningful oversight. By the time the Fair Credit Reporting Act was passed in 1970, Equifax, TransUnion, and Experian had already achieved oligopoly status and built infrastructure that was technically difficult to regulate away.
Equifax suffered a breach in 2017 that exposed the Social Security numbers, birth dates, addresses, and driver’s license numbers of approximately 147 million Americans — about 45% of the US population. The breach wasn’t discovered for 78 days after intrusion. Equifax’s response was widely criticized as inadequate. Their settlement with the FTC was a maximum of $425 million — roughly $2.88 per affected person, significantly less than the actual harm.
Age verification infrastructure being built in 2026 is going in the same direction. A small number of vendors will achieve market dominance because regulatory compliance creates winner-take-all dynamics. Those vendors will accumulate passport images and biometric data from hundreds of millions of users. When they breach — and they will breach — the harm will be diffuse, the victims will have limited recourse, and the fine will be calibrated to a legal regime that doesn’t have a good mechanism for pricing catastrophic privacy harms.
The difference is that credit bureau data is primarily financial. Age verification infrastructure handles biometric data and government identity documents. The harm from a biometric breach is unrecoverable in a way that a financial breach is not: you can issue a new credit card, but you can’t issue a new face or a new fingerprint. The age verification market is being built on a foundation that creates even worse permanent harms than the credit bureau market did, with the same lack of foresight about long-term risk concentration.
What Good Policy Would Actually Look Like
I’m not opposed to protecting children online, and I don’t think privacy advocates serve the debate by appearing to be. The question is whether specific policy mechanisms achieve their stated goals at acceptable cost. Age verification mandates, as currently designed, fail this test. Here’s what passing it might look like.
First, require zero-knowledge proofs as the mandatory mechanism for platforms over a user threshold. A government-issued credential scheme where the cryptographic proof can be generated from an existing identity document but carries no information about the document itself satisfies the verification goal without creating a new identity database. Several academic research groups and the nonprofit sector have published specifications. Mandate that any verification mechanism must be technically incapable of linking a verification event to an individual identity — not just required by policy to avoid linking, but incapable of it by design.
Second, prohibit third-party verification vendors from retaining any data beyond the duration of the verification transaction. The verification outcome — “over 16: yes” — should be the only artifact that persists. The document, biometric, or credential that produced it should be destroyed cryptographically within minutes of the verification event. This requires legislative specificity about “destroyed” that current mandates don’t include.
Third, require public disclosure of verification vendor security audits on an annual basis, with standardized reporting formats, as a condition of operating in the verification market. If k-ID wants to be Snapchat’s verification vendor, their SOC 2 report, their penetration test results, and their incident history should be publicly available. This creates market pressure for better security and gives users and regulators actual information about the vendors handling their most sensitive data.
Fourth, prohibit the secondary use of age verification infrastructure for any purpose other than age verification. A vendor’s contract, technical architecture, and legal structure should be required to make secondary use technically and legally impossible — not just forbidden. This won’t stop all misuse, but it creates liability and raises the cost of repurposing the infrastructure for surveillance applications.
None of these policy proposals are technically unreasonable. All of them are less politically tractable than “verify age with ID” because they require understanding cryptographic attestation, defining “destruction” in technically meaningful ways, and creating enforcement mechanisms for secondary use prohibition. These are hard problems for legislatures that struggled with basic questions about Facebook’s business model. But “hard for legislators” is not the same as “impossible to achieve.”
The Quiet Handoff
The framing of age verification as a children’s safety issue performs a quiet handoff. It takes a surveillance infrastructure question and recasts it as a parenting question. Parents who want to protect their children from social media harms are asked to weigh those concerns against abstract privacy interests. The framing makes the privacy concern seem selfish — you’re prioritizing adults’ anonymous internet use over kids’ safety.
But the empirical record doesn’t support the premise. Australia’s ban isn’t making children safer. The BMJ study says so. The government’s own bypass data says so. The ban is making adults less private, and creating verification infrastructure that will outlast the political moment that created it, serving uses that nobody in the December 2025 Australian parliament was thinking about.
The internet we’re building toward is one where participation requires identity disclosure, where the infrastructure recording that disclosure is controlled by private companies with weak security and complex jurisdictional exposure, and where the stated goal that justified building it manifestly isn’t being achieved. That’s not a privacy versus safety tradeoff. That’s a bad outcome for both values.
The papers, please era is being built right now, largely by engineers who would, if asked, prefer to build something that actually worked. Being asked — loudly, publicly, with specific technical alternatives — might actually change what gets built. That’s worth trying before the infrastructure is complete.
Discussion