The end of digital anonymity? The global push for mandatory age verification

Governments from the United States and the European Union to Australia are drafting laws that require digital platforms, and in some cases the underlying operating systems, to verify the age of their users. The stated goal, protecting children online, is hard to argue with. But beneath that framing sit corporate lobbying, technical hurdles for open-source software, and real privacy risks.

The legislative landscape: from apps to operating systems

In the United States, several states have led the charge. California’s Digital Age Assurance Act (and the earlier Age-Appropriate Design Code Act) seeks to mandate that online services likely to be accessed by children implement age-estimation or verification. Newer proposals suggest moving this requirement from individual apps to the Operating System (OS) level.

In late 2024, Australia passed legislation, the Online Safety Amendment (Social Media Minimum Age) Act 2024, which bans children under 16 from social media platforms. Meanwhile, the European Union is rolling out the EUDI Wallet (European Digital Identity Wallet) under the eIDAS 2.0 regulation. While presented as a tool for convenience, the SPD (Social Democratic Party) in Germany has already proposed using this wallet for mandatory age verification across social media platforms.

The corporate battle: Meta vs. the gatekeepers

Much of the push for OS-level verification comes from Meta (formerly Facebook), which has lobbied hard to shift the burden of age verification away from social media platforms and onto “gatekeepers” like Apple and Google.

The Motive: Meta’s Head of Safety, Antigone Davis, has publicly advocated for federal legislation requiring app stores to verify ages.
Liability: Under laws like the U.S. Children’s Online Privacy Protection Act (COPPA), platforms face massive fines if they have “actual knowledge” of underage users. If the App Store handles verification and passes a simple “signal” to the app, Meta can argue it lacks that “actual knowledge,” which would keep it clear of liability.
Retaliation: Critics view this as a strategic move against Apple, whose “App Tracking Transparency” feature cost Meta an estimated $10 billion in advertising revenue in 2022.

The threat to open source and Linux

For the open-source community, particularly Linux distributions, these laws pose an existential threat. Linux is built on the principles of decentralization, privacy, and user sovereignty. Most distributions function without requiring a central user account or the collection of personal data.

If a law requires an operating system to verify a user’s age during setup, decentralized systems face a technical impossibility. There is no central authority in a standard Linux installation to hold or verify a government ID. Forcing such a requirement would effectively make “anonymous” or “sovereign” computing illegal, or force developers to integrate third-party identity providers. That breaks the core philosophy of open source.

Privacy risks and the security paradox

Mandatory age verification often requires users to upload government IDs or submit to biometric face scans. This creates massive honeypots of highly sensitive data.

Data Leaks: In 2023, a third-party service provider for Discord suffered a data breach that exposed the support tickets and, potentially, the ID documents of users. Centralizing identity data increases the “blast radius” of any hack.
The VPN Bypass: As seen in Australia, age bans are easily bypassed using Virtual Private Networks (VPNs). This has led some politicians to suggest the regulation or banning of VPNs, a move critics compare to the internet censorship models of China or Russia.

The push for these laws is often built on the premise of a “scientific consensus” regarding the harm of social media. However, the academic community is divided. While the U.S. Surgeon General has issued warnings, major studies (such as those published in Nature) often find that the link between social media use and mental health issues is correlational rather than clearly causal.

Broad bans can also isolate marginalized groups. For LGBTQ+ youth or children with disabilities, online communities often provide the only safe space for social interaction and support. Mandatory verification, especially when linked to government IDs, can deter these vulnerable populations from seeking community.

Conclusion

Protecting children is a goal worth taking seriously, but the current trend toward mandatory, centralized age verification risks creating a permanent surveillance infrastructure. By shifting the focus from manipulative algorithms to user identity, these laws may fail to solve the actual problems of the digital age while also undermining digital sovereignty and the future of open-source software.

Sources

California AB-2273 (Age-Appropriate Design Code Act): California Legislative Information
Australia’s Under-16 Social Media Ban: Parliament of Australia - Online Safety Amendment 2024
EU Digital Identity Wallet (eIDAS 2.0): European Commission - European Digital Identity
Apple’s Privacy Impact on Meta: CNBC - Facebook says Apple privacy change will result in $10 billion revenue hit
Discord Data Breach (2023): BleepingComputer - Discord notifies users of data breach
Scientific Debate on Social Media Harm: Social-media influence on teen mental health goes beyond just cause and effect