Age Verification Is A Bad Way To Solve The Problem of Children on Social Networks. What's The Alternative? - Bozho's tech blog

Age Verification Is A Bad Way To Solve The Problem of Children on Social Networks. What’s The Alternative?

Bozho August 16, 2026

Age verification for using social networks is an idea that is gaining traction in multiple countries around the world – it started in Australia, then the UK, and currently sees increasing support in France and other EU countries, as well as in the European Commission. The idea sounds simple – "social networks are proven to be detrimental to children’s mental health, and so they must not be allowed to use it. The way to do it is to add an age check before registration, so that only adults can use the service".

While simple to formulate, it’s much more difficult to implement, if not impossible.

First, let’s be clear that I agree 100% that social networks, with their addictive design, their lack of content curation and mediocre attempts to protect children, are bad for minors. And policy makers, such as myself, as a member of parliament of an EU country, need to address that.

But age verification is hardly the right solution, as it’s problematic in many ways which I’ll try to describe here.

Privacy – the obvious, but rarely state fact, is that age verification is for every online user, not just for children. In order to limit children, you have to check everyone, and let only people about 18 (or 16) to use a given service. That poses serious privacy concerns and so policy makers are trying to find privacy-preserving solutions that don’t require users to show their face and identity document on every registration.<br>"Age tokens" and "age attestations" have been discussed and even implemented. The EU even created a privacy-preserving app, with zero-knowledge prove, that proves the someone is above 18 without them disclosing any identity data (even their age) to the relying party (e.g. a social network). This, however, has problems with circumvention, which I’ll address in the 2nd point. The problem is that fully privacy-preserving solutions are going to be circumvented. If privacy is compromised – i.e. if the solution leaks identifiable information to service providers, age verification becomes "mandatory digital identity for everyone". I’m a proponent for digital identity for a long time, but strictly optional and mostly for government services, no as a permission to use the internet.

The French law was this weak blocked by the French Constitutional court based on privacy issues. And UK age verification examples have shown some disasters – e.g. one age verification company was found vulnerable and it became obvious that they don’t just check your age – they check you against multiple registers and lists, including for terrorism – which is logical if you want to use every opportunity to reduce risks, but that’s not "on the brochure".

Circumvention – even if age verification is properly implemented, it can easily be circumvented by good old VPNs. However, as we know, VPNs are a gateway to a darker internet, where other safeguards and protections are also off. The reality in Australia and the UK is such that VPN usage spiked and many children continue to use social networks – so while governments created a privacy nightmare, they didn’t achieve the initial goal.<br>But privacy-preserving age verification is possible and that’s why we have to address this very seriously. The EU has made a well-meaning attempt to design and implement a proper zero-knowledge proof of age. It’s a great tool, with proper cryptography, complex-yet-elegant. It has "just" one problem – it didn’t account for the actual "threat actor" in this scenario – the user, who would try many things to circumvent the age limitation. As security consultant Paul Moore has brilliantly shown, you don’t have to compromise the age verification app in order to circumvent the flow – by a simple relay attack, where you just present someone else’s verified age credentials in order to use a service. The proof of concept was implemented as a chrome extension which relays age checks to 3rd party service, backed by an over-18 person’s device, which sends the proof to the service. That way a single adult can verify the accounts of all minors, and because of the necessary privacy guarantees, the relying party (the social network) won’t even know.

This is very likely to happen, which "age verification as a service" providers pop-up to help minors get into social networks. What’s worse – some of these providers may collect children’s personal data, including phone number or social network account ID, in order to provide them with the much coveted proof of age. That data, purposefully or after an inevitable data breach, may be used by sex predators to target children. There are completely realistic nightmare scenarios, born from the good intention to limit the negative effects of social networks.

Even in a...