What we call “age verification” is actually mass surveillance

A strange coalition behind a simple slogan

Age verification is being adopted across the internet as a child-safety measure, and it has an unusual set of supporters. In a post published on June 23, the writer and activist Cory Doctorow describes a coalition of anti-Big Tech campaigners and Heritage Foundation-backed culture warriors who disagree about almost everything but share one demand: a minimum age for certain kinds of internet use.

Doctorow's argument is that the measure does not do what its name suggests. There is no such thing as age verification for the internet, he writes: what is called age verification is mass surveillance — fine-grained tracking and recording of everything people do online, more invasive than the commercial tracking of the advertising industry.

Verification means tracking everyone

Under such a mandate, avoiding that tracking would become legally impossible — Doctorow calls it the surveillance advertising industry's fondest dream, a world where refusing to be tracked is itself unlawful. He also argues that the campaigners pushing the rules are unwitting allies of the companies they oppose: industry insiders know a verification mandate teaches children to use VPNs, and expect the next step to be a ban on VPNs.

The technical side of the idea is thin as well. Doctorow points to facial age-estimation proposals that promise to tell a person who is 17 years and 364 days old from one who has just turned 18 by looking at a phone camera, and to research showing that the harms attributed to online platforms begin with surveillance: children cannot be targeted by recommendation algorithms, or funnelled toward pro-anorexia content and misogynist forums, without the data that commercial spying supplies.

Privacy, not ID checks

The policy record, in his account, explains why governments reach for verification instead. The United States has not updated its consumer privacy law since 1988, when Congress banned the disclosure of video-rental records; the European Union has the GDPR but also Ireland, where, he writes, cases against large technology companies stall. Countries that do regulate face pressure from US platforms.

Doctorow's conclusion is that data collected to check ages will be reused — to shape prices and wages, for example, or by immigration enforcement — and that spying on children cannot protect them from being spied on. Privacy rules would limit the data that makes those harms possible in the first place.