Are Age-Verification Laws Protecting Children...or Just Arming Hackers?

Age verification laws have transformed from regional experiments to widespread policy. Following the global precedent set by Louisiana’s State Bill 162 and the UK’s Online Safety Act , more than half of US states have implemented aggressive laws that restrict free internet access. These laws are aimed at protecting children from accessing adult content. However, such measures have yet to prove effective, come at the cost of your data and privacy, and may have side effects that harm marginalized groups. With frequent breaches and data leaks, the move to require even more personal information to browse the web is questionable at best.

The High Price of "Protecting the Kids"

Proponents justify age-verification laws by claiming that the measures are intended to protect children from viewing harmful content online. In many ways, those in favor of these laws have a point. The internet is a dangerous place for minors, and it’s never been more rife with harmful content. Deepfakes can be used to make illicit content of non-consenting parties, revenge porn can lead to real-life harm, and dubious NSFW AI chatbots and image generators lurk around every corner. The impact of this kind of complex environment on the mental well-being of minors is a valid concern.

As of September 2026, the UK and the US have passed laws requiring certain sites to restrict access to adult content. Australia has gone as far as to ban access to social media platforms for users under 16 years of age. Age verification laws require users to submit identifying documents, such as a government ID, a face scan, or a selfie, to access content deemed explicit. According to the UK government, the stated intent of the Online Safety Act (OSA) is that:

“... platforms have a legal duty to protect children online. Platforms are now required to use highly effective age assurance to prevent children from accessing pornography, or content which encourages self-harm, suicide or eating disorder content.”

The US introduced a similar bill in March 2025 called the Kids Online Safety Act (KOSA). While a nationwide law has not been passed, 25 states have already enacted age-verification laws requiring users to verify their identity to access sensitive content.

It’s been over a year since these laws really started gaining traction, and there’s still very little clarity regarding the complete scope of these restrictions. The threshold for requesting verification is that a site contains 33.3% or more adult or explicit content, but these terms are ill-defined by law. Porn sites are undoubtedly impacted. However, the exact nature of what constitutes harmful content is open to interpretation.

Free speech advocates like the Electronic Frontier Foundation (EFF) argue that such murky waters can lead to minors being restricted from accessing important information regarding reproductive health, sexually transmitted diseases, mental health, and resources for LGBTQ+ youth. Depending on who you ask, all of these topics can be considered “harmful to minors.” There are too many ways these laws can be interpreted, especially given the substantial variation across states, since each state implements age verification differently.

Social platforms like Discord, , Instagram, and have content that caters to multiple audiences. While all three of these sites have their own protective measures in place, there’s no telling yet whether those will be enough to comply with the new laws. Discord has moved to implement its own age-verification measures and immediately experienced a data leak involving over 70,000 government IDs used for verification.

This risk extends beyond social media. Forums, image boards, and creative-focused websites could potentially fall under the purview of these acts. In practice, there is a future in which you could be required to submit identifying information to access most websites. Even worse, some states are pushing to implement age verification measures on the operating system level , which would mean you’d have to submit identifying information just to log on to your computer.

I’m wary of the implications these restrictions carry for online privacy. Just last year, Tea suffered a breach that resulted in thousands of users having their full government IDs leaked. When a site is forced to take in personal data without protections in place, there could be disastrous consequences.

The Hidden Data Trap in Your Browser

If you’re lucky, your data will be validated and properly wiped after use. However, age verification laws do not require businesses or websites to handle personal identifying information (PII) securely. While some states and regions have laws in place to protect consumer data, you’re still left placing your trust in the website to adhere to them. Unless a site has been independently verified by a trusted security firm, you’re going off of little more than the site’s word. Countless data breaches have shown how flimsy those assurances are.

For the same reasons that I don’t trust VPNs that haven’t undergone similar audits , I wouldn’t place my faith in a site being forced to hold sensitive data.

Many of these sites will implement the least expensive option that still meets the letter of the law. This will equate to long-term storage of your personal information in unsecured, unencrypted storage. Data breaches happen frequently, and these laws make the stakes even higher. Having your email and the name you used on a site made public is bad enough. Your government ID, address, and payment information being leaked could be devastating.

From Identity Theft to Real-World Violence

No data breach will be exactly the same. Sometimes, user data is sent out to the masses without any use or alteration. Other times, it is used in more nefarious manners like identity theft, impersonation, credit card fraud, and even blackmail. Advertisers and data brokers are likely to harvest that information for analytics. Spam agencies could buy that data and inundate you with ceaseless, annoying emails and phone calls. Such leaks also pose threats to at-risk people, such as those with restraining orders against stalkers and abusive partners. There’s a chance that someone could take advantage of a data leak to enact violence on another person for their beliefs or identity.

While admirable in aim, the execution of these laws poses significant threats to everyone’s online privacy. It’s not simply a matter of hiding your porn habits from prying eyes. Allowing sites to collect PII with few to no restrictions is a direct threat to the safety of many users and a big win for businesses that deal in this data.

Given that these restrictions are often trivial to bypass with a VPN or proxy , I question whether these laws will truly improve children's safety. What I can say for certain is that there will be lasting consequences to user privacy if countries and states continue down this path of censorship.

Defense Strategies for an Unsecure Web

The best way to prevent your data from being leaked is to not provide it in the first place. Granted, that is easier said than done. Most sites want your email and phone number just to make a purchase. Then there are cookies and trackers that every site tries to get you to accept whenever you land on the homepage. Rejecting as many of those as you can is a good first step. Paired with an ad blocker and private browser , you can mitigate some of the fingerprinting that advertisers use to identify you. Lying is another good tactic. Don’t give your real information. I recommend using burner emails, phone numbers, and one-time-use payment cards when possible.

A VPN can offer another layer of security by obfuscating your location and encrypting the data that does get sent out. That said, even the best VPNs out there won’t stop you from filling out forms or making payments with your real information. I also recommend investing in a good password manager to safeguard your logins and an antivirus to stop any malicious files from compromising your identity.

Why Banning VPNs Won't Save These Broken Laws

In some instances, it is illegal to bypass age-verification laws. Utah has cracked down on people using VPNs to skirt censorship by passing Senate Bill 73 , which makes it illegal to use location spoofing to circumvent age-verification measures. It’s unclear how this law will be enforced, but its passage has set the stage for other states to follow suit, as we saw with Louisiana's basic age-verification laws.

This isn’t likely to change anytime soon, even if sites make a concerted effort to block VPNs. After all, streaming services have tried and failed for years to prevent VPN and proxy users from accessing regional catalogs. Without a massive leap forward in blocking technology, I don’t see these laws resulting in more than a minor inconvenience to bypass, even by children, who are more informed and immersed in technology than ever before.

Ultimately, these laws do little to protect our youth and instead pose a significant threat to our online privacy by placing sensitive data directly into the hands of companies and, potentially, hackers who can and will use it for financial gain.