Age verification is the surveillance nobody voted for

Opinion Age verification is the surveillance nobody voted for KOSA and Chat Control both retreated on their most-criticized measures this week, but both kept mandatory age verification, the quiet mechanism that turns anonymous browsing into identified browsing for all of us, argues Billions CEO Evin McMullen. By Evin McMullen | Edited by Cheyenne Ligon Jul 9, 2026, 1:00 p.m. 5 min read Make preferred on Share Share this article Copy link X icon X (Twitter) LinkedIn Facebook Email Make preferred on On June 29, two of the most consequential internet bills in the democratic world moved at once. In Washington, the House passed the Kids Internet and Digital Safety Act , a package built around a revised Kids Online Safety Act, by 267 to 117. In Brussels, negotiators sat down for what was billed as the final trilogue on Chat Control 2.0 , the EU's long-running child-protection regulation. Both had spent months under fire. Both, notably, retreated. The US bill's authors dropped KOSA's controversial “duty of care,” the standard critics warned would turn platforms into speech police. EU negotiators dropped the mandatory client-side scanning of private messages, the provision that would have broken encryption for everyone. Civil liberties groups are, rightly, claiming partial victories. But look at what survived in both. Age verification. Quietly, on both sides of the Atlantic, the measure nobody is fighting over is the one that reshapes the internet for adults as much as for children. Evin McMullen is co-founder and CEO of Billions Network , which builds privacy-preserving verifiable identity for humans and AI agents. Underneath the whole debate sits a false choice that some of technology's most powerful figures have spent years normalizing: that a safe, functioning digital society is something you buy with your privacy. Oracle's Larry Ellison has openly welcomed a future of constant AI surveillance in which, he says, "citizens will be on their best behavior." Bill Gates has become the most prominent champion of universal digital ID as essential modern infrastructure — a privacy-by-design promise that critics note keeps hardening, in practice, into the very surveillance it was meant to avoid. Both, in their way, treat identification as the price of admission to modern life. It isn't. Here is the problem the child-safety framing obscures. To confirm that a user is old enough, a platform has to check the age, and usually the identity, of everyone who arrives, including the adults. As the Electronic Frontier Foundation put it this month , that turns anonymous browsing into identified browsing, and it manufactures exactly what a privacy regime is supposed to prevent: large, centralized pools of sensitive identity data, sitting on servers, waiting to be breached, subpoenaed or sold. And for most of the platforms compelled to collect it, that trove is not an asset but a liability: a crushing new obligation to secure information their businesses were never built to hold, with a risk surface that grows every time another user logs in. This is not hypothetical. Britain is the preview. Under the Online Safety Act, the Office of Communications (Ofcom) has opened more than 90 investigations and started issuing fines, and users now hand over government IDs or submit to face scans to reach ordinary content. A single vendor reportedly powers age checks for around 60% of the sites that require them, a concentration of the world's identity documents that would make any security engineer wince. The stated goal is protecting children. The built artifact is an identity-surveillance layer for the entire population. What makes this avoidable, and what almost no one in the legislative debate is saying, is that “verify age” and “collect identity” are not the same requirement. We have known for years how to prove a fact about a person without revealing the person. Using a zero-knowledge proof, someone can demonstrate they are over 18, or over 13, to a website that learns nothing else: not their name, not their date of birth, not a document it has to store. The proof is checked and discarded. No honeypot is created, because no identity is collected. The EU, to its credit, has half-grasped this. Its own age-verification app is explicitly designed so a user can prove they are over 18 “without sharing any other personal information.” That is the right architecture. The trouble is that the laws mandating verification rarely mandate that architecture. They require the outcome, an age gate, and leave the method to whichever vendor is cheapest and most invasive. The US KIDS Act pushes platforms toward age checks without requiring that those checks be privacy-preserving at all. The result is predictable: the market reaches for the ID upload and the face scan, because they are easy, and the surveillance gets built by default rather than by design. This is the fork worth fighting over, and it is being missed