Age verification is surveillance the ad industry always wanted

The UK government publishes guidance on “facial age estimation,” and the vendors selling it claim a phone camera can tell a child who is 17 years and 364 days old apart from an adult who just turned 18. Cory Doctorow calls that claim farce in his Pluralistic post, and he argues the pitch is the friendly face on a system that means fine-grained tracking and recording of everything people do online. His argument is that “age verification” as written into law is mass surveillance wearing a child-safety label.

The design consequence matters most if you run these systems. On Doctorow’s reading the mandate amounts to fine-grained tracking and recording of everyone’s online activity. Doctorow’s point is that this is the surveillance advertising industry’s ideal outcome. Its business already depends on tracking people across sites, and a law that makes avoiding that tracking illegal hands it the thing it could never buy. He notes the bills carry the backing of the most controlling and data-hungry tech companies, which is a reasonable signal of who benefits.

Circumvention is the next problem, and it is familiar to anyone who has run a network. A VPN defeats a per-site or geographic age gate in one click, so a serious mandate mostly teaches a generation of kids to use VPNs. Doctorow points to the move already on the table, citing UK reporting that a VPN ban is under discussion.

The reuse risk is the one engineers should weigh hardest. Once that data exists, other parties come for it. Doctorow cites WIRED’s reporting that ICE has been asking companies about their ad-tech and big-data tools, and his claim is that the same data used to verify age today will be used by ICE tomorrow to decide who to round up.

None of this sits on top of a privacy floor, at least not in the US. Doctorow notes American consumer privacy law has not been meaningfully updated since 1988, when Congress banned the disclosure of VHS rental records. The EU has the GDPR, but he argues enforcement against Big Tech dies in Ireland, where the cases go and stall. He also describes a political backdrop in which the US government has fused with the large tech firms and threatens penalties against countries that try to regulate them.

The harms these laws invoke, Doctorow argues, start with the same surveillance. An algorithm cannot funnel a teenager toward pro-anorexia or extremist content without the tracking data that profiles them first. A mandatory identity layer adds to that profiling rather than reducing it.

If the task lands on your desk, treat an age gate as what it is: a surveillance dataset that governments will come to reuse.