Why I Emphatically Oppose Online Age Verification Mandates

April 14, 2025 · by · in Content Regulation, Internet History, Privacy/Security

I’ve posted a new paper, “The “Segregate-and-Suppress” Approach to Regulating Child Safety Online.” If that phrase sounds familiar, it’s because I’ve been referencing this paper on the blog for months. The paper details my extensive and multi-dimensional criticisms of mandatory online age authentication laws, which I consider one of the greatest threats to a free and functional Internet today.

(Caveat: the Trump Administration’s authoritarian and fascist moves in areas beyond Internet Law pose an even greater and more immediate threat to our society and the Internet. But if you oppose the Trump administration’s lawless authoritarianism and blatant disregard for due process and Constitutional rights, I urge you to reflect upon how mandatory online age authentication will give him and other authoritarian governments even more power to target and suppress dissent and critics. Freedom Protip: don’t give authoritarian fascists more legal or technical ways to control Internet speech).

I hope you’ll take a look at the paper, but I caution that it’s probably not a fun read. Like many of my papers nowadays, readers are likely to come away angry about the legal system’s dysfunction–and especially how little policymakers seem to care about making good policy that actually protects children.

* * *

Mandatory online age authentication isn’t a new policy idea. It dates back at least to 1996 when Congress passed the Communications Decency Act (CDA), which imposed an implicit age authentication requirement on virtually every website. The Supreme Court struck down the CDA in 1997 in Reno v. ACLU. Following the judicial flameout of the CDA’s successor, the Child Online Protection Act (COPA), mandatory online age authentication as a policy initiative largely went dormant for over a decade.

In the wake of minors’ heightened Internet use due to the COVID pandemic shutdown, mandatory online age authentication roared back as a policy priority in a big way. I don’t have a complete census of U.S. laws that now mandate online age authentication, but it’s in the dozens. The laws are hard to inventory or track because they are multitudinous and have heterogeneous structures and definitions.

In my view, any law that requires online age authentication is unambiguously unconstitutional per the still-governing CDA and COPA precedents. Legislatures don’t care about that obvious problem. For example, Texas passed a law extremely similar to the CDA and essentially dared the courts to strike it down. The Fifth Circuit, being the Fifth Circuit, thought the law was swell; I expect the Supreme Court will reverse that, at least in part.

Because of this rapidly changing and chaotic legal situation, I decided to sidestep the constitutionality questions in the paper. Instead, my paper focuses on the policy problems with the law. That way, no matter what the Supreme Court does in the Free Speech Coalition v. Paxton case, my paper will still have value to the policy discussions.

I hold uncompromising views on this topic. For reasons I explain in 63 anguished and tear-stained pages, I am a categorical “no” on all online age authentication mandates. To me, it doesn’t matter what the laws are called, how the authentication duties are styled, what sales hooks the vendors use to obfuscate their solutions’ deficiencies, or what hypothetical fantasy outcomes policymakers think will materialize if the technologists just “nerd harder”–I oppose them all. As the EFF explained:

[Authentication] methods don’t each fit somewhere on a spectrum of “more safe” and “less safe,” or “more accurate” and “less accurate.” Rather, they each fall on a spectrum of “dangerous in one way” to “dangerous in a different way.”… every solution has serious privacy, accuracy, or security problems

Due to this obvious fact, I’m baffled by the near-universal belief that mandatory online age authentication is a legitimate tool in policymakers’ child safety toolkits. I wonder if the advocates don’t understand the consequences, in which case their ignorance should disqualify them from working on child safety policy altogether. Worse, perhaps the advocates do understand the terrible policy consequences and nevertheless are using “the kids” as a “get-out-of-critical-scrutiny” card. The paper calls out and condemns both categories of policy advocates. The paper ends with a request: stop characterizing pro-authentication advocates as “well-meaning” or “well-intentioned.” Anyone who proceeds blindly with respect to child welfare or uses kids as political props is neither.

* * *

I’ll close this post with a special request to privacy advocates. I am also baffled by the privacy community’s response to laws imposing online age authentication mandates. Many privacy advocates simply note the developments dispassionately and without any criticism, and a small but vocal segment cheers for the laws “because kids.”

If you care about privacy and aren’t resisting these laws with everything you’ve got, then (as Alexander Hamilton says in Cabinet Battle #2) “You must be out of your goddamn mind.” Age authentication mandates pose one of the greatest threats to consumer privacy we’ve ever seen. (If that’s not obvious, my paper explains why). If we lose the battle against these mandates, then every other privacy policy win will be overshadowed by this loss. If there is any hope for online privacy in the future, we must make a stand here.

* * *

Blog Posts on Segregate-and-Suppress Obligations