Age verification for social media – the beginning of the end for a free internet?

So-called age verification for social media is spreading across the world, framed as an effort to create a safer internet for children. In reality, age verification lays the foundation for a fully government controlled internet. Countries around the world are moving to introduce online age verification. Part of this involves age verification for harmful content (most often pornography, sometimes video games), but above all it focuses on banning social media for children. The big tech social media companies are bad. Their business model is bad; it is based on mass surveillance and manipulation, and they cooperate with governments in mapping entire populations. But age verification is fundamentally the wrong approach to preventing children from using big tech social media platforms. Introducing age verification is based on the state being able to force social media companies to verify their users’ identities. But the big tech social media platforms already know which of their users are children. Their business model depends on knowing this. They know how old users are, who their friends are and what ice cream they like. As age verification is based on coercion of the social media platforms, politicians could instead force them to stop doing the things politicians consider harmful to children, or force them to block children (again, they know who they are) from using their services. But instead, politicians seek to massively invade everyone’s privacy and undermine democratic rights on a global scale. In other words, the latter is the real objective – they do not want to protect children; they want to impose control. And impose it they do. Australia has already introduced a social media age restriction for users under 16. The same applies to Indonesia and Brazil. Age restrictions have been approved but not yet implemented in Denmark, Portugal, and Malaysia. In France, an agreement has been reached, though details are still being discussed. Proposals are on the table in Spain and Turkey. In Germany, the major parties agree on introducing age restrictions, and in Sweden the issue is under investigation. The topic is also being discussed in countries such as the Czech Republic, Greece, Austria, Poland, Canada, Slovenia, and the Netherlands. In April 2026, the European Commission launched an EU age verification app, and one month later Ursula von der Leyen presented plans for EU-wide age restrictions. In the United States, half of all states either have pending legislation or have already introduced laws imposing age restrictions for inappropriate content and/or social media. The number of countries preparing age verification measures is growing rapidly.

Updates can be followed on Techpolicy.press. Most age verification is identity verification As age verification is currently being rolled out, it is up to individual websites and services to implement it as they see fit. As a result, the quality of age verification measures varies greatly. This became clear in the autumn of 2025, when Discord was hacked, exposing the ID documents of 70,000 users. However, there is one common factor in most age verification systems (Zero-Knowledge Proof being an exception, more on that below): if age verification is introduced, everyone will have to identify themselves either to the service/website they want to use or to a third party capable of linking them to their activity on that service/website. The correct term for age verification as it is implemented today is therefore identity verification. Given today’s internet infrastructure, it is unreasonable to assume that this information will not be shared through commercial agreements or with governments. The consequence of introducing identity verification is therefore that freedom of information is restricted (you can no longer visit regulated websites anonymously) and that you can no longer post anonymously on social media. You cannot be certain that your criticism of the government will not be followed up by the authorities. You can no longer start a digital initiative on a social media platform aimed at gathering people to criticize an authority without facing a significant risk of consequences. Depending on the country you live in, this could even endanger your life. In its current form, social media identity verification removes important tools for activists in countries where criticizing those in power is dangerous. Freedom of expression is threatened not only in a direct sense (you post something and then the police knock on your door), identity verification also creates a chilling effect. It becomes a cornerstone of censorship machinery in the sense that people begin to self-censor if they know that expressing opinions may have personal consequences. This is also something that changes over time. What is considered acceptable to post online is determined by whoever currently holds power. Different sides of politics often have different views on what constitutes harmful content. Just because what you post today is not considered inappropriate does not mean it will remain acceptable in the future. Broad and arbitrary legislation, along with mandatory ID tagging for every post, hardly provides a strong foundation for freedom of expression. Today, 30 people are arrested every day in the United Kingdom for posting something online that authorities classify as “grossly offensive.”

In Germany, police conduct raids on people’s homes for insulting politicians online. One infamous example is the so-called “Pimmelgate,” where a person was subject to a police search after calling a German politician a term for male genitalia. In the United States, authorities are trying to pressure tech companies into revealing the identities behind accounts protesting ICE. Another example is when Canada introduced emergency acts during the 2022 trucker protests and then used social media to identify demonstrators and freeze the bank accounts of people who financially supported the protest. The slippery slope of age verification. VPN next? Restrictions introduced at the national level can be bypassed by changing one’s geographic location digitally, using tools such as VPNs, virtual phone numbers, eSIM cards, Tor and dedicated services. This has already led politicians in several countries to consider introducing identity verification for VPN services (presumably because VPNs are the most common and accessible method of changing digital location). In the United Kingdom, the House of Lords sent an amendment in early 2026 (regarding the the Children’s Wellbeing and Schools Bill) to the House of Commons, proposing an 18-year age limit for using VPN services. The House of Commons rejected the House of Lords amendment four separate times. However, the House of Commons instead introduced its own proposal, which was passed and has now become law. This agreement grants the government the power to introduce restrictions through secondary legislation, with only limited parliamentary scrutiny. The government has confirmed that it intends to act on this and introduce some form of social media restriction for children under 16. The government has also hinted that it may consider introducing identity verification for VPN usage, effectively joining countries such as China and Russia in opposing VPN services. The issue has also been raised in France. As Minister for AI and Digital Affairs Anne Le Hénanff put it: “If [this legislation] allows us to protect a very large majority of children, we will continue. And VPNs are the next topic on my list.” Discussions about VPN restrictions have also occurred in the United States. Utah has gone the furthest by introducing a law making it illegal to circumvent restrictions using a VPN. Within the EU, VPN restrictions have been discussed both under the Going Dark initiative and in discussions related to age verification.

In response to a direct question about VPNs as a tool for bypassing age verification, EU Commissioner Henna Virkkunen said in April: “Of course, it's an important part of the next steps also to look at that it [age verification] shouldn't be circumvented.” If VPN services were to implement identity verification, this would mean collecting data that could be abused through either malice or incompetence. It would, for example, make such services risky for whistleblowers and activists, make it harder for journalists to work with sensitive information, and create a chilling effect on online debate (VPNs can help people post anonymously on social media). If VPN providers were to impose an age limit on their service, this would also mean that underage users would effectively lose their right to online privacy. Ironically, one consequence would be that social media companies mapping people’s lives through third-party trackers on websites could continue monitoring young people’s online behavior via their IP addresses without any interference. In other words, politicians would remove one of the protections children have against the very companies they claim to want to protect children from. Identity verification in app stores and at the operating system level As identity verification is now being introduced globally, different parts of the world are implementing it in different ways. Some countries believe the best solution is to impose controls through major app stores such as Apple’s App Store and Google Play. In Australia, Brazil, South Korea, Singapore, and several US states, Apple has already begun introducing identity verification at the App Store level to restrict access to apps containing adult content. Identity verification in app stores only regulates access to apps. Therefore, several countries have also begun demanding identity verification at the operating system level itself in order to block access to certain websites directly through the OS. In the United Kingdom, Apple has already introduced this – despite there being no law requiring it (Apple is, however, under general pressure from British authorities). Without warning, Apple implemented identity verification on British iPhones through its system update on March 24, 2026. Suddenly, 35 million British users had to identify themselves using either a credit card or a government-issued ID card in order to avoid restrictions on their phones.