Thomas Trachell | Phototech | Getty Images
A new U.S. law aimed at protecting minors is forcing millions of adult Americans through mandatory age-verification gates to access online content, leading to a backlash from users and criticism from privacy advocates who say the free and open internet is at risk. About half of U.S. states have enacted or are pursuing laws that require platforms like adult content sites, online gaming services, and social media apps to block underage users, and companies must screen everyone who approaches these digital gates.
“There’s a broad spectrum,” said Joe Kaufman, global head of privacy at Jumio, one of the largest digital identity verification and authentication platforms. He explained that a patchwork of state laws has varying technical requirements and compliance expectations. “Regulation is moving in many different directions at once,” he said.
In February, social media company Discord announced plans to roll out mandatory age verification globally, which the company said would rely on authentication methods designed to perform facial analysis on the user’s device and immediately delete the data submitted. The proposal quickly sparked backlash from users concerned about having to submit a selfie or government ID to access certain features, prompting Discord to delay the release until the second half of this year.
“To be frank, we knew this development would be controversial. Whenever you introduce something that involves identity verification and authentication, people have strong emotions,” Discord chief technology officer and co-founder Stanislav Vishnevsky wrote in a Feb. 24 blog post.
Websites offering adult content, gambling, or financial services often rely on full identity verification, which requires government IDs to be scanned and matched against live images. However, most of the authentication systems that power these checkpoints are often run by specialized identity verification vendors on behalf of websites and rely on artificial intelligence, such as facial recognition or age estimation models, to analyze selfies and videos to determine in seconds whether a person is old enough to access the content. Social media and low-risk services may use lightweight estimation tools designed to verify age without permanently storing detailed identity records.
Vendors say the challenge is balancing safety with how much friction users can tolerate. “Our job is to keep minors completely safe and allow adults to enter with as little friction as possible,” said Rybka Gerwitz Little, chief growth officer at identity verification platform Socure. Excessive data collection creates friction that users resist, she added.
Still, many users find mandatory ID checks to be a nuisance. “It’s bothersome for people to be forced to provide that information in a different way,” said Heidi Howard Tandy, a partner at Berger Singerman who specializes in intellectual property and internet law. Some users may attempt workarounds such as prepaid cards, alternative credentials, or utilize unauthorized distribution channels. “That would create a copyright infringement situation,” she added.
Where does adult data go?
In many implementations, the validation vendor, rather than the website itself, processes and maintains the identity information and returns only pass/fail signals to the platform.
Gerwitz-Little said Socure does not sell verification data, and in lightweight age estimation scenarios where the platform uses rapid facial analysis or other signals rather than government documents, the company may store little or no information. However, in more complete identity verification contexts, such as gaming or fraud prevention where ID scanning is required, certain adult verification records may be kept to document compliance. She said Socure can store some adult verification data for up to three years, subject to applicable privacy and erasure regulations.
Freedom advocates have warned that the concentration of large amounts of identity data in a small number of verification vendors could make them attractive targets for hackers and government demands. Earlier this year, Discord disclosed a data breach that exposed ID images belonging to approximately 70,000 users through a compromised third-party service, highlighting the security risks associated with storing sensitive ID information.
Furthermore, they warn that the expansion of age verification systems is not just a usability challenge, but represents a structural shift in how identity is tied to online behavior. Molly Buckley, a legislative analyst at the Electronic Frontier Foundation, said age verification risks tying a user’s “most sensitive and immutable data” (name, face, birthday, home address) to their online activities. “Age verification undermines the foundations of a free and open internet,” she said.
Even if vendors promise to protect personal information, users end up relying on contractual terms that they rarely read or fully understand. “Our terms of service policy says that we will turn over information if law enforcement requests it,” Tandy said. “Law enforcement cannot always and forever be the sole entity that owns all this information. Everyone needs to understand that basic information is not under their control.”
As more platforms rely on third-party vendors to perform age verification, the concentration of personal information data is also creating new legal exposure for companies that rely on the platforms. “Companies are going to have some of that information going through their own servers,” Tandy said. “And such liability cannot be passed on to third parties.”
Companies can spread risk through contracts and insurance, but are still responsible for how their identity systems interact with their infrastructure, he said. “What you can do is get really good insurance and demand really good insurance from the companies you contract with,” she said.
Tandy also warned that retention commitments can be more complicated than they appear. “If they say they’ll hold it for three years, that’s the minimum period they’ll hold it for,” she said. “I’m nervous about trusting a company that says, ‘One day in three years, we’re going to delete everything.’ That’s not going to happen,” she added.
The legal battle isn’t over yet.
Federal and state regulators argue that age verification laws are primarily a response to documented harm to minors, and that the rules must operate with strict privacy and security protections.
An FTC spokesperson told CNBC that companies must limit how the information they collect is used. Age verification technology helps parents protect their children online, but companies are still bound by existing consumer protection rules governing data minimization, retention and security, the agency said. The agency pointed to existing rules that require companies to retain personal information only for as long as reasonably necessary and to protect its confidentiality and integrity.
Ray Pickett, a spokesperson for Virginia’s Attorney General’s Office, one of the states aggressively enforcing age-verification laws, said the agency believes strong authentication and data-handling standards are an integral part of protecting youth users and ensuring an age-appropriate online experience. she pointed to the lawsuit against meta TikTok is cited as evidence that insufficient safety measures can expose young users to harmful content and experiences. Under Virginia law, companies that collect verification data cannot use it for any purpose other than age determination, and must maintain security practices commensurate with the sensitivity of the information under the state’s Consumer Data Protection Act.
But the Virginia effort suffered a legal setback last week when a federal court upheld a First Amendment challenge filed by a trade group representing major social media companies and blocked enforcement of the law, at least temporarily. In a statement to CNBC following the court’s ruling, Virginia Attorney General Jay Jones said the Department of Justice “will utilize every tool available to us to ensure that Virginia’s children are protected from the proven harms of unrestricted access to these addictive feeds. We look forward to fully enforcing the law to keep families safe.”
Buckley said that to make the internet safer and address many of the harms these proposals seek to alleviate, lawmakers don’t have to sacrifice voters’ First Amendment rights and privacy. In fact, many lawmakers are aware of these approaches, such as data minimization, in existing age verification proposals, according to EFF analysts. But if lawmakers want to meaningfully improve online safety, rather than create new systems of surveillance, censorship and exclusion, she said they should pass strong, comprehensive federal privacy laws that protect all internet users and give them the power to control how their data is collected.
“A permanent feature of online life”
Age verification laws in some countries, such as the UK, Australia and soon Brazil, already require platforms to use methods such as facial age estimation and ID checks.
Major U.S.-based platforms have taken positions on how age verification should be implemented, although they are not without controversy, as Discord’s example shows, and their participation comes after years of litigation alleging weak efforts to keep sites safe for children.
Discord said in an explanation of its delayed global rollout that more than 90% of its users do not need to verify their age outside of existing internal security systems that require no user action, except in countries where national laws require a specific verification method. In a recent blog post, the company’s CTO said, “We know that many of you believe that the right answer is not to do this at all.”
Discord said it has used the additional time this year to add authentication options including credit cards, improve vendor transparency, add technical details about how age verification works, and once the system goes into effect, it plans to publish details on the percentage of users asked to verify age in existing transparency reports.
snapThe company behind Snapchat said its platform supports alternative approaches that reduce the need to collect identity information directly. “We believe there are better, more privacy-friendly solutions, such as requiring age verification at key entry points (device, operating system, app store level, etc.),” a Snap spokesperson told CNBC.
Meta and Google did not respond to requests for comment.
As more states introduce age-verification requirements and companies compete to comply, the infrastructure behind these systems is likely to become permanently entrenched in online life, Tandy said. Taken together, industry leaders say the rapid adoption of age verification laws could prompt platforms to move to systems that verify age once and reuse those credentials across services.
“The way the trend is definitely moving toward some kind of continued validation of the age of the user,” Kaufman said. In other words, a digital proof of age that can travel with users across platforms.
Over time, Tandy said, once the system verifies your age, you may not need to ask it again. She likened the model to an ecosystem: disney Once a user’s age is established, it is recognized throughout the service, rather than being re-verified every time they log in, even after years.
For adults, that means an Internet where identity verification becomes a built-in layer of everyday access, rather than an occasional friction.
