Age verification does not verify age

The KIDS Act says age verification is not required, while repeatedly imposing obligations that depend on whether a user is under 17. According to the Electronic Frontier Foundation, that combination would push online services to identify the ages of users even without an explicit verification mandate.

Congress is preparing to consider the package through an expedited process. It combines a revised Kids Online Safety Act, known as KOSA, with several other internet bills, studies, reporting requirements, and regulations. The provisions use different age thresholds and standards for different services, creating a complicated compliance problem with significant legal exposure.

Under the KOSA portion, platforms must provide particular protections, controls, messaging settings, and parental tools when they “know or should have known” that a user is a child or teenager. The bill defines a child as someone under 13 and a teenager as someone from 13 through 16. The standard reaches beyond information a service actually possesses. Courts or regulators could later decide that a platform should have recognized a user as a minor.

That uncertainty changes the engineering requirement. A service trying to limit liability needs some mechanism for sorting users into age categories. Self-declared birth dates may offer little protection under a standard based on what the service should have known. Operators may instead request passports or driver’s licenses, analyze account activity, or use facial scans to estimate age.

Each approach produces sensitive data while still leaving room for error. EFF says existing estimation systems make mistakes when assessing children and fail more frequently for people of color, people with disabilities, and trans and nonbinary people. A system can therefore collect identity documents or biometric information without reliably producing the classification that the law expects.

Other sections add their own pressure. The SAFE BOTS Act would restrict certain chatbot features when a service knows or should have known that a user is a minor. The SCREEN Act would require services hosting sexually explicit content to determine whether a user is more likely than not below the applicable age limit before granting access. Adults would consequently face age checks as services attempt to establish that they are outside protected groups.

The operational burden extends beyond account creation. Revised KOSA language would require covered platforms to establish and enforce policies addressing categories including narcotics, tobacco, cannabis, gambling, alcohol, and financial fraud. Those categories include lawful discussions about addiction, recovery, harm reduction, treatment, family problems, and scams. Services facing uncertain liability have an incentive to restrict those discussions or reserve them for users classified as adults.

Private messaging creates a harder systems problem. The package includes rules concerning direct messages, disappearing messages, and AI chat services. Some language preserves strong encryption for certain features and messaging controls, but EFF says that protection does not cover KOSA’s separate requirement for platforms to address listed harms to minors. Providers cannot inspect end-to-end encrypted content without changing the security properties of the service. The remaining options include limiting features, excluding users classified as minors, or weakening private communications.

For teams operating affected services, age assurance becomes another high-value identity system. Its data should be minimized, isolated, access-controlled, retained for the shortest defensible period, and excluded from unrelated analytics. Vendors should be evaluated for classification errors across relevant user groups, data retention, document handling, biometric processing, and appeal mechanisms. False classifications need a correction path that does not demand progressively more sensitive evidence.

The larger architectural problem remains: legal duties attached to uncertain age categories encourage platforms to collect enough information to defend their classifications later. The KIDS Act’s disclaimer does not remove that incentive. It leaves services to implement age surveillance under several different standards while accepting the privacy, security, and moderation consequences.