The ‘papers, please’ era of the internet will decimate your privacy

Imagine your favorite team just scored an incredible, last-second goal at the World Cup. So you log online to celebrate with other fans. But, using data it’s already collected on you, the social media platform you like to post on wrongly guesses that you’re under 16 so it forces you to go to a third-party verification app and provide images of your face or your government-issued ID. You don’t really know much about the verification app, what country it’s based out of, what happens with your information, and whether you’re protected from hackers or data breaches. You’re not happy about it, but you hand over a photo of your passport and hope it doesn’t come back to haunt you.

Now imagine that instead of posting about sports, you’re criticizing a powerful politician, or talking about your experiences with abuse or addiction, or discussing embarrassing medical issues you’re facing. Suddenly this “papers, please” approach to the internet sounds even more invasive, right? Unfortunately, that’s the direction we’re all headed — even here in the United States — and we have good reason to be wary of the global rush to sacrifice user privacy on the altar of age verification.

How has this worked (or not) in Australia?

Australia’s social media ban for under-16s went into effect in December 2025 and set a landmark standard many other nations now look to when crafting their own such regulations. As a preliminary matter: This law is not working as intended. The government’s own research found that months after the institution of the ban, roughly seven out of 10 kids still were using social media. And a study just released in the British Medical Journal found “little evidence was found of immediate substantive reductions in reported social media use by adolescents under 16 years.” Secondly, phones are already banned in Australian schools, so this ban is intended to address what kids do on the internet in their own free time, not during class time. 

So, what exactly does this law — one that is rendered irrelevant during the school day, and isn’t even working properly outside it anyway — actually mandate? Well, pretty much what was in the hypothetical described earlier in this piece, except it’s not at all a hypothetical anymore. 

Australia’s law mandates that social media companies, at risk of massive fines, collect either biometric info, government-issued IDs, or other data from users because they now have a duty to take sufficient steps to ensure users under 16 are kept logged out. In some cases, platforms can use existing data they have on users to verify age, like if an account has been open for a sufficient number of years, but will in many scenarios need to verify independently by gathering more user data. This is where third-party verification tools come in. 

Look at Snapchat, for example. Snapchat uses k-ID, a company based in Singapore, and allows verification through a banking connection, government ID scan, or selfie the company uses to provide an age range. This requires quite an investment of trust on the user’s end. How do third-party companies like this retain and protect data? What kind of laws govern these companies abroad? Is such a company in another country more susceptible to censorial requests from local or foreign governments?

Australia does order that personal information collected for age verification “must be destroyed once all purposes have been met.” But those purposes include challenges and complaints, so it’s unclear exactly how long data will be retained on users who object to wrong age classifications. Worryingly, in research conducted before the ban went into effect, Australia’s Age Assurance Technology Trial “found some concerning evidence that in the absence of specific guidance, service providers were apparently over-anticipating the eventual needs of regulators about providing personal information for future investigation…which could lead to increased risk of privacy breaches due to unnecessary and disproportionate collection and retention of data.”

The longer that information is retained, and the more that is collected for verification, increases the risk of breaches or hacks that threaten a user’s privacy. Now multiply that individual risk by millions. 

We don’t even need to imagine the hypothetical here, because it happened to nearly 70,000 Australians just weeks before the under-16 ban went into effect. A breach of a third-party customer service app Discord used “mainly to deal with” — guess what — “complaints relating to the platform’s age assurance processes” was hacked, leading to the release of “government ID images, names, usernames, email addresses, and some limited billing information.” 

Expect more such attacks in the future.

In addition to introducing new risks from data breaches and hacks, the Australian government admits that mandated age verification introduces new risks for phishing attempts by scammers seeking to take advantage of confusion surrounding the ban. But the government puts much of the onus on social media platforms to ensure users understand the verification process and on users to read up to make sure they aren’t being scammed.

We have, quite reasonably, spent much of the 21st century debating what should be our relationship to tech companies and what amount of our personal lives and details we are comfortable handing over, knowingly or not. Governments have even been hauling tech CEOs in to question them about their intake of individuals’ data. Yet now countries like Australia are mandating that they collect it or face consequences. 

As the Australian Human Rights Commission explains, even if some user accounts ultimately evade age checks, this signals a broader shift in how people use the internet: 

The eSafety Commissioner’s guidance tries to reassure us: ‘No, not every account holder will go through an age check process if the platform has other accurate data.’ But that doesn’t actually mean you escape scrutiny. It just means that platforms will use what they already know about you to make the call. That’s the real shift that is happening here. We’re moving to a world where the law requires you to be profiled in order to participate.

The online world we’re moving toward is a “papers, please” one, where vital venues of public discussion might now only be open to those who are willing to trust tech companies and the third party verification apps they use with information that can eliminate their anonymity online, and the governments responsible for mandating the collection of that information. 

Many users will very likely provide the information they need to log on and continue communicating with their friends and families. But maybe they’ll think twice about what they say and do. This new era of the internet is unlikely to be significantly safer for children. But it will be much less free for everyone.

Is the UK’s age verification plan worse?

You’ve likely heard by now that the UK (along with France, Spain, the United Arab Emirates, Indonesia, Malaysia, Greece, Denmark, Norway, and the European Union) is pursuing its own under-16 ban. 

The ban will happen even though the exact details for its enforcement and verification methods are not yet public — but the UK intends to avoid Australia’s failures. That’s why Prime Minister Keir Starmer promised this month that the British version will be “Australia-plus,” as the UK will “learn the lessons from Australia’s experience” and “make it far harder for children to bypass safeguards.” (Starmer has since resigned as prime minister but there is currently no indication that the government’s plans for the policy will change.)

UK citizens have reason to worry. Australia’s enforcement of its under-16 ban comes with a wealth of risks to user privacy, so to see government officials signal that they intend more severe enforcement suggests the potential for even greater privacy threats.

Perhaps even most alarming is officials’ open interest in targeting virtual private networks to crack down on verification evasion. VPN use rose last year after the rollout of the UK’s similarly messy Online Safety Act, when internet users sought to avoid roadblocks from the government against online “harms.” After the Online Safety Act was implemented, UK officials said they were “gather[ing] information on VPN usage.” And as I explained at Persuasion last week: 

One problem facing advocates of internet restrictions is the availability of virtual private networks (VPNs), which reroute traffic and allow users to access banned content or sites from behind firewalls or blocks. The UK government is well aware of the challenge VPNs may pose to its under-16 ban, and Technology Secretary Liz Kendall announced this week that the government “will make further statements in July about VPNs.” Children’s Minister Josh MacAlister has said there are “options there about whether we could age-gate VPN use, which would be really welcome.”

Many UK citizens no doubt have valid and reasonable concerns about the way their children experience the internet and social media. But they may be shocked and surprised by the amount of power and control UK officials claim they need to solve the problem. Should UK officials travel down the path of targeting VPN usage, they may find themselves more in line with countries like China, Iran, and Russia. It’s not good company.

Is the United States following the same path?

Alarmingly, yes. The home of the First Amendment is on course to embrace the “papers, please” era of the internet and has been slinking towards it for years now. 

A number of states have been developing and passing bills, many of which are facing challenges, that pose many of the same concerns we’ve raised in the international context. At least 19 states have passed legislation addressing minors’ access to social media or “addictive” feeds, but some are enforceable, some enjoined, and some not yet effective. And more than 20 states have enacted age-verification laws for adult-content websites, many of which became more secure after the Supreme Court’s decision in Free Speech Coalition v. Paxton in 2025. Separately, app-store age-assurance laws are being litigated in states such as Texas and Utah.

While this takes place among the states, at the federal level we’re seeing a number of proposals being considered, including the so-called “Kids Online Safety Act,” or KOSA, which was incorporated in the House’s broader KIDS Act package and has been the subject of negotiations between the Senate and the White House. The House and Senate have slightly different versions of the bill, but both would impose regulations that would effectively force social media websites and other platforms to conduct age verification of their users. And since it’s a federal bill, states that wanted to maintain a free and open internet would be overridden. The entire country would be forced to reveal their identity and data before they could speak online.

What this means for the American people is that both the state and federal government could be mandating collection of information about you at every step you engage with the internet. Soon, everything you do online could have an element of age assurance or verification, from downloading an app in the app store to making an account to posting a photo, whether you’re a 14-year-old trying to game or a 40-year-old posting about recipes. The debate is rapidly expanding to include video games and AI chatbots as well.

And that creates a lot of risks for data breaches, overly broad data collection and retention, censorial legal demands for collected data, corporate and governmental malfeasance, pressure to self-censor, and perhaps blatant First Amendment violations. Every new layer and every new mandate brings more potential for risk. As we’ve unfortunately seen many times over the years, people including high-level government officials will maliciously seek to root out the identities of their critics, so the more layers of anonymity we can preserve in online speech, the better. 

Americans can take seriously the need to protect kids online while still recognizing that many of the policy and legislative solutions offered today are creating intolerable burdens on our ability to speak freely and anonymously on the internet. The reality is that age verification to a large extent requires us to confirm identity, and we will come to regret so closely tying our expressive activity online to government-mandated age and identity verification. Once we create this legislative infrastructure of surveillance we may find it very difficult to tear down.