Age verification for social media: the beginning of the end for a free internet?

Mullvad has published an analysis arguing that the wave of age-verification laws spreading across social media is becoming identity verification in practice. The company, which runs a VPN service and campaigns against digital ID schemes, writes that the measures are framed as child protection but lay the foundation for a state-controlled internet.

Where age checks are already in force

Australia has introduced a social media age restriction for users under 16, and Indonesia and Brazil have done the same. Restrictions are approved but not yet implemented in Denmark, Portugal and Malaysia, France has reached an agreement whose details are still under discussion, and proposals are on the table in Spain and Turkey. Germany's major parties agree on age limits and Sweden has opened an investigation.

At EU level, the European Commission launched an age-verification app in April 2026, and a month later Ursula von der Leyen presented plans for EU-wide age restrictions. In the United States, half of all states have pending legislation or laws imposing age limits, the post notes.

From app stores to the operating system

Apple has begun introducing identity checks at App Store level in Australia, Brazil, South Korea, Singapore and several US states to restrict access to apps with adult content. Several governments now want verification at operating-system level. In the UK, Apple enabled identity verification on British iPhones in a system update on 24 March 2026 — with no law requiring it — leaving 35 million users to identify themselves with a credit card or government ID.

Brazil's law, implemented in March 2026, requires verification in app stores and inside operating systems, including open-source ones, with fines of up to $10 million. California's AB 1043 will require OS-level checks from January 2027, and similar proposals exist in Colorado, New York and at federal level.

VPNs and the EU's zero-knowledge question

The post warns that VPN services are next. In the UK, the House of Lords proposed an 18-year age limit for VPN use in early 2026; the Commons rejected the amendment four times but passed its own proposal, now law, giving the government power to act through secondary legislation. French minister Anne Le Hénanff has said VPNs are "the next topic on my list", and Utah has made it illegal to circumvent restrictions with a VPN.

The EU app, presented by von der Leyen as "completely anonymous", issues single-use credentials from member-state issuers that platforms cannot link together. Mullvad points out that the issuer still knows who holds which credential, so a state could identify a poster. The app has no zero-knowledge-proof functionality today and falls back to a non-ZKP model when ZKP is unavailable.

The critique

The analysis cites the 2025 Discord breach that exposed the ID documents of 70,000 users, roughly 30 daily arrests in the UK over "grossly offensive" posts, German police raids over insults to politicians, and Canada's use of social media data to freeze bank accounts during the 2022 trucker protests. Its conclusion: the age-verification rush must be slowed down.