Governments around the world have a new favourite tool: mandatory age verification online. The UK has it. Australia is pushing for it. Dozens of other countries are drafting similar laws. The pitch sounds simple — protect children from harmful content by making websites check users’ ages before letting them in. Who could argue with that?

More than 400 of them, actually. In March 2026, for example, over 400 security researchers, cryptographers, and privacy scientists — the very experts who helped design the technologies now being proposed for age verification signed an open letter warning that these systems are far more dangerous than governments are letting on. This is not a fringe group of tech libertarians. These are the people who built this stuff, and they’re alarmed.

In fact, way back in December of 2025, My Data Zero was among the first to report on Australia’s revolutionary new law to protect children online.

With other nations rushing to join Australia, here’s what has raised the hackles of privacy experts globally:

Your Face Is Not a Password

Age verification sounds harmless until you ask: how exactly does a website know how old you are? The answer is uncomfortable. Depending on how these systems are implemented, users may have to provide government identification documents, biometric data such as facial scans, phone numbers, or payment credentials.

Think about what that means in practice. To watch a film, read news behind an age gate, or use a social media platform, you hand over the equivalent of your passport or your literal face. And once that data exists somewhere on a server, it becomes a target.

The researchers aren’t being paranoid. In October 2025, Discord suffered an attack that resulted in the leak of age verification IDs of an estimated 70,000 users. In another major data breach, drivers’ licences, selfies, and other sensitive verification data were leaked by The Tea app, which boasts over 6.2 million users. These are not hypotheticals. They already happened, and mandatory age verification would create thousands more such databases across every major platform you use.

The Kids Will Still Get In

Here’s the quiet embarrassment at the heart of these laws: they probably won’t work. Experts say children already use a variety of methods to bypass online restrictions — purchasing verified accounts from online marketplaces, using VPNs to connect to regions without age-verification requirements, or even using AI and deepfake technology to trick biometric verification systems.

A determined teenager will get around an age gate. The people who won’t are ordinary adults — those without the right ID format, older users unfamiliar with verification apps, immigrants and asylum seekers whose documents aren’t integrated with the verification system, and people who simply don’t own a compatible smartphone. Introducing age verification systems will inevitably exclude some legitimate users from online services. The children stay; the inconvenienced adults get locked out.

The Workaround Problem

There is a cruel irony built into strict age verification: if large platforms begin enforcing strict verification requirements, some users may turn to alternative or unregulated services that do not require identity checks — platforms that may offer fewer safety protections and may be more likely to host scams, malware, or illegal content. adguard-vpn

This is already happening. When 18 US states adopted laws requiring websites displaying sexually oriented content to check IDs of all visitors, affected users simply switched to other adult platforms that were non-compliant with those laws. The content didn’t disappear. The users moved to darker corners of the internet with fewer protections. The law made things worse.

A New Playground for Scammers

Age verification also creates a perfect cover story for fraud. Scammers can impersonate verification providers and trick users into submitting their ID documents or face scans to fake websites. A system designed to make the internet safer hands criminals a brand new script: “Please verify your age to continue.”

The Bottom Line

The signatories to the petition and other experts are clear: age verification does not guarantee the protection policymakers hope for. Children may still bypass restrictions, while adults may find themselves repeatedly verifying their identity across multiple platforms — or failing verification altogether.

The intent behind these laws is understandable. But good intentions do not make bad systems safe. Poorly designed age-verification systems could create a situation where users lose privacy and security without actually improving child protection.

Before handing your face, your passport, and your browsing habits to every website with an age gate, ask a simple question: who is storing this, and what happens when they get hacked? Because they will.

The experts who built this technology are warning you. That’s worth listening to.