A few wrinkles and some silver hair may prevent you from reaching for your ID at the liquor store but, online, we’re all back in high school.
Calls to protect children online are growing louder as 19 states require users to reveal their age before accessing social media or downloading an app. But verifying minors online inevitably means verifying everyone. Unlike a bartender who cards only youthful-looking patrons, digital platforms have no visual cues. Every citizen—whether 17 or 70—must submit sensitive personal data, government-issued IDs, or facial recognition scans simply to access routine websites.
Advocates claim that age verification can avoid collecting sensitive information through self-reporting or facial scanning tools. Yet, any mechanism robust enough to verify age accurately necessarily identifies individuals, creating vulnerable repositories of personal data amidst an epidemic of catastrophic breaches. Consequently, parents eager to protect their children online might not realize they’re also surrendering their own privacy in the process.
History provides stark warnings against this. In 2014, hackers stole 56 million payment card records from Home Depot. Three years later, 143 million Social Security numbers were exposed in the Equifax breach. Even recently, Florida’s unemployment benefits system suffered a breach, exposing nearly 58,000 accounts, including Social Security numbers and banking details. These breaches demonstrate a clear pattern: data exploitation follows data collection.
Cybersecurity expert Dr. Sarah Scheffler warns, “A stored collection of government-issued photo IDs and face biometrics is a glaring target for hackers and identity thieves.” Last May, her warning became a reality when Outabox, an Australian facial recognition provider, suffered a breach, exposing the driver’s licenses and facial scans of over a million individuals. Unlike passwords, biometric data cannot be changed if compromised, making such exposures among the most serious privacy violations possible.
The UK learned this lesson firsthand, abandoning its national age-verification database in 2017 due to security concerns. Critics rightly feared the creation of a “honeypot” of sensitive user information, vulnerable to breaches and blackmail.
As verification systems repeatedly fail, adults face an impossible choice between surrendering their privacy or losing access to online speech platforms entirely. Judge Timothy L. Brooks, in his review of Mississippi’s Social Media Act, highlighted this fundamental issue. Brooks cautioned that requiring age verification for teenagers imposes “significant burdens on adult access to constitutionally protected speech,” discouraging users from accessing lawful content. These requirements don’t merely inconvenience users—they fundamentally undermine First Amendment protections by establishing government-mandated gateways to legal content. As such, they are unconstitutional.
But there is a better path. Many families already utilize parental controls and personalizable device-level filtering tools that effectively tailor content to their child’s age and unique needs. Additionally, digital literacy education equips families to navigate the online world without putting everyone through a TSA-style checkpoint.
Florida has already led the way in this regard. Since the passage of House Bill 379 in 2023, public schools in Florida are now required to equip students and their parents with the skills needed to navigate social media and the overarching digital environment safely. Educating teens about how to stay safe online “demonstrates that protecting teens online doesn’t require sacrificing either parental rights or digital freedoms.”
Protecting children online is essential, but current age verification methods are not the solution. They expose private data, create unnecessary security vulnerabilities, and carry unsurmountable First Amendment questions. While new innovations may one day offer a way to verify age without sacrificing privacy, today’s solutions fall short. Until then, policymakers and parents should focus on practical, privacy-preserving alternatives—tools that already exist and empower families without turning the internet into an ID checkpoint for everyone.
