Age-verification laws are being sold as a way to protect children, but the Electronic Frontier Foundation says the policy trend is turning into something much broader and more invasive. In a March 2025 post, the group argues that laws originally framed around porn access are now being used in ways that reach into skincare products, dating apps and even diet pills. The central warning is simple: systems built to verify age can also become systems that identify people.
The EFF says the problem is not limited to one policy area. Its concern is that age checks require people to hand over sensitive information just to browse or buy ordinary products. That can mean government ID, facial scans, credit card details, phone numbers or other data points that are then stored, processed or shared by third-party services. Once those systems exist, the group argues, they create a permanent incentive to keep expanding them. In its view, age verification is not a narrow safety tool but a template for surveillance.
The post also claims lawmakers are often treating porn-related bills as an easier first step toward wider identity rules. The EFF points to language from a sponsor in Alabama who described starting with pornography and then moving on to social media. That, the organization says, is evidence that the policy goal is broader than the stated justification. Instead of stopping at one category of content, the rules may be used to normalize identity checks across more of the internet.
A second concern is technical. The EFF says no method of age verification is both privacy-protective and fully accurate. Each option carries tradeoffs. Government IDs expose immutable personal details. Face scans add biometric data. Credit card or phone-based checks still create data trails that can be misused or stolen. The organization says these systems also burden adults who are simply trying to access lawful content or purchase legitimate products without giving up more information than necessary.
The post warns that the data collection risk is not theoretical. Age-verification companies can be hacked, just like any other data processor. That means the systems may create the very harms they claim to prevent, including identity theft and privacy breaches. The EFF also argues that the pressure to comply can chill speech, because platforms and services may choose stricter enforcement rather than risk penalties.
The group’s broader case is that lawmakers should focus on less invasive ways to protect minors online rather than building identity infrastructure that affects everyone. Its argument is not that child safety is unimportant, but that the current approach shifts too much risk onto users and too much power onto regulators and private vendors. In the EFF’s telling, the real result is a more monitored internet, not a safer one.
