Attributed metadata history

When No ID Means No Internet: Age Verification and the Right to Access Information

This post was co-authored by Sheila B. Lalwani, a doctorate student and recent COMPASS Fellow hosted by EFF. Age verification proposals are often presented as a simple tradeoff: sacrifice a little privacy to better safeguard children online. But that framing overlooks a more fundamental question. What happens to people who cannot verify their age at all? This is particularly a problem when users are required to prove their age with identity documents. Age-related restrictions are developing quickly around the world. While they differ radically across jurisdictions, in the past year, we’ve witnessed a sharp uptick toward mandatory age assurance for social media access but also for other high-risk digital services. For example: In late 2025, Australia became the first country to implement a minimum age requirement for prohibiting children under age 16 from creating or holding social media accounts.  India passed the Digital Personal Data Protection (DPDP) Act that includes mandatory verifiable parental consent and has undertaken ongoing discussions for social media restriction. The United Kingdom passed the Online Safety Act requiring age verification across a swath of services hosting content considered harmful to users under 18. More than half the states across the U.S. have enacted age verification laws.  An EU Commission’s expert report recommends a ban on social media access for users under 13. It also recommends mandatory age verification for platforms to ensure that users are ‘age appropriate.’  The Access Problem  Age verification laws that are predicated on the necessity of users possessing a current passport, driver’s license, credit card, or similar documents proving their identity exclude critical sections of populations.  And this problem is global in nature: Millions of people lack government-issued identification or encounter regular challenges to obtaining or updating it.  Roughly 15 million adult U.S. citizens lack a driver’s license, and a further 2.6 million lack any government photo ID; leaving large groups blocked from online content or services. The UK has a similar predicament: proof-of-age checks are often reliant on passports, driver’s licenses, or other recognized alternatives, which can pose unique challenges to people without these documents. Much of the advocacy around age verification discusses the privacy harms of age verification. Yet these measures also threaten something more fundamental: equal access to information and the ability to exercise the right to freedom of expression.  Unfortunately, age verification systems foster unequal access to information and provide an asymmetric solution to find essential information, build community, and weigh in on public discourse. As governments and companies increasingly require users to prove their age before accessing online services, these individuals risk being excluded from large parts of the internet altogether.  Effects on Global Majority Countries  Age verification laws reshape who can speak, who can access information, and who gets excluded from the digital public sphere. In other words, age verification is not a neutral safety measure: it presents a structural barrier to disproportionately exclude certain groups—particularly those in the global majority—and alters the architecture of global online expression. Some of these groups are already marginalized offline, and age verification extends that exclusion into digital spaces. For instance, 850 million people globally do not have ID. Most of these individuals exist in primarily low and middle income countries in Sub-Saharan Africa and South Asia. The World Bank points out that many are members of marginalized groups and more than half of those lacking access to identity documentation also have children whose births have not been registered. Women are particularly vulnerable and are 8% less likely than men to have an ID. Other vulnerable groups, such as adults in low

This record contains metadata and attribution only. It does not host, download, unpack, render, or execute malware samples.