Across the internet, a quiet shift is under way. The old promise of protecting children online is turning into a new demand at the door: prove how old you are before you may come in. One European regulation dropped its age verification rules this summer, while almost everywhere else the idea keeps gaining speed. This seems like the right moment to ask whether we noticed the line moving.
This is the third piece in our Who Decides? series.
The claim
What is supposedly being solved: children reach pornography and other material that was never meant for them, and the familiar “I am 18” button is, in practice, a joke. That argument deserves to be taken seriously. The United Kingdom has required “highly effective” age checks on adult content since 25 July 2025, and its regulator counted an estimated 69 million age checks in the second half of 2025, with the share of protected encounters rising from 25 to 43 percent. If we mean the protection seriously, a barrier stronger than a checkbox makes sense. For me the question begins somewhere else entirely: what price are we willing to pay for that protection?
Who decides?
At first sight, the state decides. Look closer and the picture shifts. The state writes the rule, the platform translates it into its service, and a third company you have never heard of may end up judging whether your face or your document means “old enough”. You may feel you are simply proving your age. In reality you are handing pieces of the decision to several institutions you can barely see. The parent, in whose name all of this is done, often stands at the very end of the chain.
The chain keeps growing new links. Australia has formally designated ten platforms that must keep under-16s out. In North Dakota, from August 2026, the decision moves into the phone itself: device makers and app stores must send websites a “digital age signal”. And somewhere behind every check sits a verification vendor whose name appears in no law at all.
By what rule?
For me, the how matters almost more than the yes or no. There is a world of difference between an anonymous token confirming “this person is over 18” and a system that stores your identity document, scans your face, or lets an algorithm guess your age from your behaviour. Today’s laws cover that whole spectrum. American states, twenty-five of them by now, typically ask for a government document or “commercially reasonable” checks built on records about your mortgage or your job. Australia went the other way and does not let platforms make a government document the price of entry, expecting layered methods instead, including age estimates made by AI. The European Commission is building a white label app meant to confirm a threshold without revealing who you are, and it urges member states to roll it out by the end of 2026. The debate must not end at the sentence “we will verify age”. I want to know who sees what, who stores it, for how long, and whether a check of age quietly becomes a check of identity.
Who pays the price?
This is the easiest part of the whole debate to overlook. When the system works, we see a protected child. When it fails, the cost lands on one specific person. In October 2025 Discord confirmed that an attacker had reached files held by a customer service contractor, including government ID photos of roughly 70,000 people. Those users did exactly what the rules asked of them, and a company they had never chosen failed them. In Australia, more than 4.7 million accounts judged to belong to children had been deactivated or restricted by mid-January 2026. An algorithm that judges age will also misjudge it. Some people have no suitable document. Others simply refuse to show an identity card to visit a website. A system’s failure rarely looks dramatic. The door just closes in front of you.
What does it mean for you?
If you are an adult, things you open today with one tap will increasingly ask for proof about you first. In Britain that is already daily life. In the United States it depends on which state you live in, which means the same website behaves differently across a border you cannot see. If you are fifteen, it can mean a real barrier where none existed, and that may be exactly the intended effect. It also hands young people the next internet lesson early: how to route around a wall. When the British checks arrived, sign-ups for one VPN service jumped by 1,400 percent in a day and a VPN briefly became the most downloaded free app in the country. The British government has since said it will not ban VPNs and expects platforms to detect circumvention instead. So next to the question “does the check work?” I would always ask a second one: what will people do the day after we switch it on?
Is there another way?
I refuse the false choice between age verification and refusing to protect children. The space between those poles is wide: safer default settings for minors, parental tools, limits on recommendation systems that actively push unsuitable material at children, age signals handled inside the device so that documents never travel across the internet, and technologies able to confirm an age threshold without revealing identity, which is what the EU’s own blueprint promises. There is even a precedent from the heart of the debate: negotiators on the EU’s child sexual abuse regulation dropped mandatory age verification from the text this summer. A milder path is clearly something real legislation can choose. Perhaps we will conclude in the end that some form of age assurance has its place. Before we do, I want an answer to a simpler question. Can we protect a child without having to identify everyone else?
Related, tracked live: the same autumn decides the EU’s message-scanning rules. Follow what is in force and what is being negotiated on our EU Chat Control Tracker.
