Thanks for the love! And that we shall 🫡 🫡

Even folks who aren’t worried about kids online should be worried about what age-verification laws mean for them. These laws push us towards a world where you have to prove your age with a government ID—or a face scan—just to access ordinary websites. 

Getting people to think critically can mean asking a simple question: are you comfortable having your identity logged every time you watch or read something online? 

Showing ID online is not like flashing it to the bartender. Online, your ID or biometric data is likely to be copied, transmitted, and stored by websites and third-party vendors. Once that data is out there, it can be breached, misused, or repurposed. You lose control over it. People need to understand that these systems will create permanent records of where we all go online. 

At scale, age verification becomes a de facto ID check for everyday internet use. It becomes a general-purpose system for tracking access to speech. 

Good intentions don’t eliminate risk. Age verification will cause real harms to privacy, security, and free expression that will fall on kids and adults alike. 

In terms of re-directing the energy of policymakers—we’ve always said, and still do, that comprehensive privacy regulation is the best way to protect kids and adults online.

As you identified, the cry to “protect the children” is quite powerful right now—it has broad bipartisan support, it’s something we can all ostensibly agree on (who doesn’t want to keep young people safe?), and it’s even beloved by tech companies. Perhaps most importantly, it’s really tough to be the one lawmaker (or advocacy org, or parent in the pickup line, etc.) who comes out *against* anything that’s called a kids’ online safety measure. It’s a rather smart advocacy move because it puts our backs against the wall as opponents of age verification.

But! There are a few things to know that make it easier to push back on this kind of messaging. 

1. The science undergirding these claims is mixed at best. There’s a lot of pseudoscience and spicy headlines out there linking social media use to mental health issues, but in fact, as with most things, the actual data is much more complex than that. Young people can encounter harm online, absolutely—just as they can encounter harms in real life! But if we’re going to be legislating solutions, we have to remember that there will not be one solution that fits all young people. And for every young person who’s been through the sort of horrors we hear from parents’ lobbies in Congress, there’s another young person whose life is improved or even saved by online community, connection, and resources. Think of those who are disabled, homeschooled, or live in rural environments, whose ability to form social connections IRL might be limited. Or LGBTQ+ youth in homophobic households. Or young people who suffer from abuse, neglect, substance issues at home—anyone whose parents or guardians don’t have their best interests in mind. For these folks, online connection is vital. That’s what we’re fighting for. 
2. Though there are several other forces at play behind this messaging, one of the biggest and main groups is parents! Parents are understandably concerned and often at a loss as to how to keep their loved ones safe online. So it’s often in good faith that they support age verification mandates and blanket bans for minors. That means that a big part of the fight right now is just to reach out to parents and families in your life and have these conversations. Help them understand that: (A) Age verification is not just going to keep young people offline. It requires all of us—adults too!—to submit our most sensitive and most valuable information to platforms, who will share that data with their third-party vendors and any other number of unseen intermediaries, creating massive honeypots of valuable personal data for bad actors to target; (B) The best thing parents can do to keep their kids safe on the internet is to keep open lines of communication with them and be an active part of their experience. See this blog post by our Director of Engineering Alexis Hancock for more on that; and (C) There are tools available for parents to tailor their kids’ online experiences at nearly every level of the UX: platform, device, ISP, browser—the list goes on. But studies show that parental controls are underutilized, so we have to bridge the gap to help make the broad array of options less confusing and more intuitive to use. Stay tuned for EFF’s upcoming resources and guides to using parental controls safely and effectively! They’ll be up on EFF.org/Age sometime in the new year.

<3 <3 <3

We definitely sympathize—it can indeed sometimes feel like a lost cause, or at best a game of whack-a-mole. But please don’t give up hope! Take a look at this piece, which always gives me a good pep talk: “Privacy isn’t dead. Far from it.” It can be helpful to remember some of the major privacy wins we’ve won over the years by continuing to push back against censorship and surveillance *together*. 

On this issue in particular, we’ve made so many strides against authoritarian age-gating mandates! 

First, in legal challenge after legal challenge, U.S. courts have found age-verification laws to be unconstitutional violations of users’ and platforms’ First Amendment rights. Just this week, as we were here answering questions, a federal district court in Louisiana issued a permanent injunction against Louisiana’s age-gating bill—sending yet another clear message to federal and state lawmakers that we will not stand for this censorship! 

Second, as we’ve always said, the internet always routes around censorship. And it’s clear from politicians’ recent scramble to expand the bans from adult content and social media to include privacy-protecting tools like VPNs that they’re well aware of the mass opposition to these policies. 

So amongst all of this success, it’s important that we don’t give up this fight. Let’s keep the momentum alive by being loud and clear about our opposition—both by reaching out to your own representatives and by having conversations with your community to make sure everyone knows the danger of these mandates.

There’s no way to build an age verification system that fully protects speech and privacy rights for everyone, which is why we oppose age gating and age verification mandates in general. That being said, for a particular person in a particular situation who knows their own needs, there might be ways to minimize your own risk. We wrote this page in our guide to age verification to help people navigate those decisions, but I’ll explain a bit of why that is here.

There’s no universal answer to the question of safe age verification—it’s always going to depend on your threat model. What might be safe for one person isn’t going to be safe for every person. And, methods that might be safe right now aren’t always going to be possible to use.

To make it more concrete—a good example is Google’s facial age estimation, which uses an implementation provided by a company called Private ID. That age estimation happens on your device, so your photo isn’t going anywhere. You might be tempted to think that this is a perfectly safe age estimation method, and it might be, for some people! Except…if a government really wanted an image of your face for some reason, they could tell the company that they need to wait for you to download the javascript, and then send you a backdoored version of the code that does in fact upload and save that photo. That’s obviously unlikely to happen to most people, and we hope the company would fight back, but you certainly couldn’t say that that’s 100% safe for everyone.

But even more likely is that this method isn’t likely to be available for everyone. Even the best facial age estimation systems have an error range of about 1-2 years, so companies trying to keep out everyone under 18 will often set the minimum estimated age to 19 or 20 to compensate. It’s like when bars card everyone who looks under 25. So if you’re actually 18, you might not be able to use this system to prove your age at all, because the system will just say sorry 🤷, we can’t be sure, gonna need you to use some other form of verification.

And every possible system has something like this, whether it’s some tradeoff of privacy, accuracy, or availability. And they’re all going to infringe on your speech and privacy rights in some way. Hopefully our guide will help you figure out for yourself what’s safest out of the available options, but if none of these is good enough for your needs, that’s totally understandable.

There is absolutely still hope! EFF is fighting back by challenging these unconstitutional laws in court, pushing lawmakers to reject them before they pass, and helping communities protect their rights to privacy, anonymity, and free expression online. 

If you're ready to join us, you can urge your state lawmakers to reject harmful age-verification laws. Call or email your representatives to oppose KOSA and any other proposed federal age-checking mandates.

Beyond that, the most important thing you can do right now is to educate yourself on the risks and harms of these bills, and make sure your community does the same. Make your voice heard by talking to your friends and family about what we all stand to lose if the age-gated internet becomes a global reality. And get loud in your opposition to these oppressive digital regimes. Because the fight for a free internet starts with us.

If you’re looking for one small action you can take today that will make a meaningful difference, we recommend checking out our tool for contacting Congress about KOSA: Don't let congress censor the internet!

Thanks for your support! We agree—that's exactly why we made the resource hub at EFF.org/Age. Our goal is to help everyone understand the ins and outs (including the more wonky technical and legal details) of this issue so we all feel comfortable speaking out to oppose these bills. The more visible our opposition to mandatory age-gates is, the more effective we can be to stop them from ruining our internet.

And re: Reddit, they actually just challenged Australia's first-of-its-kind social media ban for users under 16! More info on that here: https://gizmodo.com/reddit-sues-australia-over-teen-social-media-ban-as-other-nations-consider-similar-laws-2000699275

We mention the concept of “privacy nihilism” in this response and in our blog post titled “Privacy isn’t dead. Far from it,” which is what it sounds like you’re hinting at — people’s apathy and sense that “oh, I don’t have anything to hide, so why should I care about privacy.” But this year alone has given us plenty of real life examples of just how much the boundaries are shifting and how even the average person can be targeted or surveilled. Complaining about your love life online? Attending a protest? Seeking healthcare? Have a premium PornHub account? What about, um, checks notes… ever use your home's electric utilities? Privacy is your fight too. Whether we’re fighting laws that require you to provide personal identification to access information, data brokers, or government surveillance—this is an issue that impacts us all.

If you’re looking for one small action you can take today that will make a meaningful difference, we recommend checking out our tool for contacting Congress about KOSA: Don't let congress censor the internet 

And check out our answer here for more info! https://www.reddit.com/r/privacy/comments/1pk5n1y/comment/nu8bg44/

We’re not gonna give our opponents a heads up like that 👍 (Or as our lawyers would say, we don’t discuss legal strategy publicly!)

But seriously, we are always looking for opportunities to challenge these laws. Though our legal fight got harder this past summer with the Supreme Court decision in Free Speech Coalition v. Paxton, we’re nowhere near knocked out of the fight. Paxton wrongly weakened First Amendment protections for adults' access to online speech, but it did not end the legal debate over age-verification mandates. At EFF, we continue to fight age-verification mandates in the many other contexts in which we see them throughout the country and the world. 

Importantly, the Supreme Court’s decision in Paxton does not approve of age gates when they are imposed on speech that is legal for minors and adults.

Minors and adults have coextensive rights to both speak and access the speech of other users on these sites because the vast majority of the speech is not sexual material that would be obscene to minors. Lawmakers should be careful not to interpret Paxton to mean that broader restrictions on minors’ First Amendment rights, like those included in the Kids Online Safety Act, would be deemed constitutional.  

Free Speech Coalition v. Paxton will have an effect on nearly every U.S. adult internet user for the foreseeable future. It marks a worrying shift in the ways that governments can restrict access to speech online. But that only means we must work harder than ever to protect privacy, security, and free speech as central tenets of the internet. 

Edit: P.S. Have you seen our new Let’s Sue the Government! tees?

1. The thing about end-to-end encryption is that it is a great tool for making sure no one but the person you’re talking to knows what you’re saying. In the age verification systems I assume you’re talking about, that wouldn’t do much more than TLS (the transport encryption used to visit HTTPS websites) already does because you’re still sending sensitive message contents to someone else’s system. You might be interested to learn about zero-knowledge proofs, which we discussed over in this comment.

But at the end of the day, there’s just not going to be a technical solution to the issue at hand. There’s no way to implement age gates in a way that’s available to everyone and fully protects speech and privacy rights. Age verification fundamentally burdens everyone’s right to speak and access information online, and structurally excludes the very people who rely on the internet most.

1. What’s most important to consider about governments is that they have the power of the military and law enforcement behind them, which is why there are protections against how much governments should be able to know, and what governments should be able to restrict.

So there’s a few different cases here. In one, we have the danger that age verification will lead to information becoming available to governments that they wouldn’t otherwise have had access to. Think about internet usage patterns tied to government identities—like law enforcement finding out who’s searched for information on abortion or gender affirming care in a state where it’s criminalized, or ICE getting lists of which users avoided providing valid U.S. government ID, or a protest organizer being targeted due to their social media activity. Anonymity is a pillar of our First Amendment rights (in the US) and of online safety in general. Destroying it with mandatory age verification will bring immense harm to those who rely on it.

In the other case, we’re talking about how governments can use age verification mandates to restrict access to free speech and information. These laws are a way for governments to give themselves the authority to decide what topics are deemed “safe” for young people to access, and force online services to remove and block anything that may be deemed “unsafe.” Banning pornography is one of Project 2025’s goals, which is why The Heritage Foundation is a staunch supporter of age verification laws. They even said it was a “back door starting with the kids” to ban porn altogether. Age verification mandates undermine the fundamental speech rights of adults and young people alike; create new barriers to accessing vibrant, lawful, even life-saving content; and needlessly jeopardize all internet users’ privacy, anonymity, and security.

We feel you, bud. We answered this question here, and here, but will never let an opportunity to say this go by: education and outreach. Our only chance of stopping these laws before they become the norm is by speaking up and educating ourselves and loved ones.

We have (a few!) EFF staff in the EU who are focused on pushing back against bad age verification and digital ID bills in that region. 

We also work together and coordinate with EDRi and other European groups on digital rights matters, including age verification. Because the debate really differs from country to country, we rely on local people and organizations to guide our work in Europe. 

Here’s an example of some of our recent work in the U.K. fighting that nation’s “Digital ID” proposal; we’re working with U.K.-based partners and encouraging residents there to contact their MPs.

Thank you!! Yes, let's! EFF.org/Age 💪💪💪

We started writing about this in response to this comment, but there’s always more to say on this “protect the kids” point. Here are a few more thoughts:

First, there is no “kid exception” to the First Amendment. Full stop. Minors have long had the same First Amendment rights as adults: to talk about politics, create art, comment on the news, discuss or practice religion, and more. And the Supreme Court has repeatedly struck down laws that restrict minors’ speech or impose parental-permission requirements. So rather than imposing age verification requirements to force platforms to determine which users are minors, why not extend privacy protections to all of us—adults and young people alike? 

Second, much of the push to “protect the children” is really a push to fight back against the influence of “Big Tech." But, if we don’t trust those megacorporations with our private info and to know what’s best for our young people already, why would the solution to this problem be to hand them even *more* of our most private, most sensitive, most valuable data? It just doesn’t make sense. 

If we want to restrain big tech’s influence over our politics and our speech, we need to actually do something meaningful to increase consumer control over our own data, our own settings, our own online experiences! Pass comprehensive consumer privacy law, restrain data brokers, give us ALL more control over our own accounts, and teach parents how to use existing parental controls. That’s how we rein in the influence of big tech companies—not by empowering them with even more data.

The internet was more fun when it was less extractive. When it gave us more than it took. 

A lot of what we miss isn’t just vibes and nostalgia. It’s the fact that you could explore, create, and interact without being optimized for surveillance. When we’re monetized, tracked, ranked, and targeted, fun dies. 

Making the internet fun again means we must push against that trend. We need to protect privacy by default, defend anonymity for those who choose it, and support small, weird, user-driven spaces instead of a few giant platforms. And when it comes to data hoarding and the worst dark patterns, we need regulation, so companies can’t profit while making things more miserable. 

Fun comes from freedom, innovation, and experimentation. We need to defend those values and not accept an internet that treats every user like data to be monitored or a problem to be controlled.

Hey thanks, friend! Leaving this here in case anyone needs it: eff.org/donate/ 😇

This is a good example of the censorship that can be caused by these bills. Social media is in the fabric of our lives, sometimes whether we like it or not. Even the  Supreme Court recognizes its ubiquity as the “modern public square.”

Online age restrictions also impact far more people than in-person ID checks, as examples like this show. And millions of adults in the U.S. don’t have ID at all.  

In the real world, you can walk into a grocery store, select what you need, and only get asked for your ID if you put liquor in your cart. Online age verification is like asking everyone  at the door, before they even buy a loaf of bread. 

You’re right to feel weird about having to show ID, or submit to shady face-scanning companies, to access perfectly legal and mundane content like a restaurant menu. These laws are a violation of our First Amendment rights—even the courts agree!

We’ve written up a whole post about that, available here! tl;dr: ZKPs provide a cryptographic way to not give something away, like your exact date of birth and age from your ID. Instead, they offer a “yes-or-no” claim (like above or below 18) to a verifier requiring a legal age threshold. Zero-knowledge can be beneficial to the holder, because they don’t have to share explicit information like a birth date—just cryptographic proof that said information exists and is valid.

What ZKPs don’t do is mitigate verifier abuse or limit their requests, such as over-asking for information they don’t need or limiting the number of times they request your age over time. These requests could then be combined over time to discover more information than it might seem is being revealed at first glance. If a website asks if you’re over 18 and the answer is yes, and then asks if you’re over 19 and the answer is no, they’re going to know you’re exactly 18. If they ask this every day of the year, they could even figure out your exact birthday. They also don’t prevent websites or applications from collecting other kinds of observable personally identifiable information (PII) like your IP address or other device information while interacting with them. So while they’re called zero-knowledge proofs for historical technical reasons, in practice they’re at most less-knowledge proofs.

And this isn’t even getting into considerations of the system as a whole! To use a ZKP in the first place, you need some sort of information on the local device. We most commonly see ZKP mentioned in the context of having a local digital ID, which means you have to deal with all the problems of digital ID in the first place—are you even able to get one? What happens when you’re sharing a device with someone? Is every single site you interact with going to use ZKPs, or are you going to end up sharing more information than you wanted to because there’s so much less friction now? Will it end up being used for identity verification in addition to age verification? And if that age information isn’t coming from a digital ID, what other verification system is being used, and what are the limitations of that one? There’s so much more to consider than just the zero-knowledge information exchange itself.

First, parents groups have been working for years on Capitol Hill to push for these sorts of age verification mandates. Many of them have lost their children in tragic circumstances and are calling on Congress to intervene to enact measures like KOSA, the Kids Online Safety Act, that they believe will prevent similar harms from occurring in the future to other children. 

Online child safety is a complex issue. But bills like KOSA that implicitly mandate age verification will not make kids safer. It will, however, introduce new privacy and speech issues to the internet. We wrote about this more in another comment, so check that out for more thoughts on the “online safety” point.

Beyond that, we’re also seeing supporters of these bills tout their ability to rein in big tech companies’ influence over our feeds, our politics, and even our well-being. This too is misguided. In reality, age verification mandates concentrate and consolidate power in the hands of the largest companies—the only entities with the resources to build costly compliance systems and absorb potentially massive fines. 

We saw this happen in the UK when the Online Safety Act came into force. Platforms like Reddit, YouTube, and Spotify implemented broad (and extremely clunky) age verification measures while smaller sites were forced to shutter.

This perfectly illustrates the market impact of online age verification laws. When smaller platforms inevitably cave under the financial pressure of these mandates, users will be pushed back to the social media giants. These huge companies—those that can afford expensive age verification systems and aren’t afraid of a few $10,000 fines while they figure out compliance—will end up getting more business, more traffic, and more power to censor users and violate their privacy.

Apple has actually been lobbying in support of KOSA—this is their support letter to Senate sponsors of KOSA back in May of this year. KOSA is written so that big tech companies like Apple will be able to handle the regulatory burden that KOSA will demand, while smaller platforms will struggle to comply. 

While big companies like Apple are not with us, there is still a large coalition of voices opposing KOSA, and there remains substantial differences between the House version and the Senate version of the bill. 

Apple is opposed, however, to the App Store Accountability Act, a bill that would age gate the app stores. Apple's global head of privacy wrote to the Energy and Commerce Committee in a statement that “Some well-intended proposals for age verification at the app marketplace level ... would require the collection of sensitive information about anyone who wants to download an app, even if it’s an app that simply provides weather updates or sports scores.” 

Not only would this bill run into the same privacy and speech concerns as other age verification measures, it also raises a competition issue. It entrenches Apple and Google as the dominant app stores. As one Congresswoman put it during the subcommittee markup last week, the committee needs to “get to the heart of breaking through the monopoly/duopoly on our kids’ phones.”

Fear is definitely driving a lot of this, and the only way to counter it is with broad, public pushback, like we saw during the SOPA/PIPA fight years ago. That’s exactly why we built the Age Verification Resource Hub and why we’re working to grow a large coalition of advocates, parents, technologists, and everyday internet users who understand what’s really at stake. 

We’re also trying to do our part by pushing back on multiple fronts: challenging these unconstitutional laws in court, urging lawmakers to reject these bills before they pass, and helping communities understand how age verification threatens privacy, anonymity, and free expression for everyone. But we also can’t do it alone, and that’s why education is key. As you say, even the most “tech illiterate” need to push back. Talk about this with your friends, family, and local community. Nearly every state has considered one of these bills, so watch what’s happening locally and tell your lawmakers to oppose harmful age-verification mandates. And at the federal level, call or email your representatives to oppose KOSA and any other age-checking proposals.

This only works if people speak up, and the earlier we do that, the better our chances are of stopping these laws before they become the norm.

It’s easy to miss wins in privacy because sometimes they look like “nothing bad happened.” But there have been some real, concrete impacts. 

Defending encryption: some of the biggest threats in the last decade have been legislative efforts to weaken encryption. We’ve defeated those at almost every turn. In defeating the EARN IT bill, we moved hundreds of thousands of messages to legislators. The bill didn’t advance. Just as important, the understanding of encryption’s importance among the public, and among lawmakers, has improved dramatically. Ten years ago, end-to-end encryption was an obscure talking point; today, it’s widely understood to be essential to our personal data and our basic rights. 

Making web encryption the default: EFF’s HTTPS Everywhere and early support for Let’s Encrypt and Certbot helped change the baseline of the internet. Once a minority of sites used HTTPS. We have pushed it toward ubiquity: today about 90% of web traffic is encrypted, and browsers offer built-in HTTPS preference settings. That means the web browsing of ordinary people is far harder to spy on than it used to be. 

Shaping real privacy law: We were involved in shaping and strengthening the California Consumer Privacy Act, which set a national benchmark for data rights. We also helped pass follow-on state laws like the DELETE Act (2023), giving Californians real control over data brokers’ sale and collection of personal information. 

Winning in courts: We’ve long said that location data should get strong protection. In 2018, the Supreme Court agreed with us, finding in Carpenter v. US that accessing detailed phone location data should require a warrant. 

No single tactic wins alone, but coordinated pressure on the technical, legal, and policy fronts does move the needle.

It appears that reddit has shadow-banned you. This means that no one will see your posts or comments unless a mod or admin happens upon them and manually approves them, as I have done here.

You can appeal this via https://reddit.com/appeal

You’re not wrong! Basically every time we provide our ID or biometric data to a platform to verify our age, we are also sharing it with the third-party companies that provide age verifying services to that platform, and any number of unseen intermediaries too. So by mandating age-verification, we’re creating irresistible targets for hackers and governments alike. 

We all saw the fallout of the Ashley Madison breach. Now imagine what happens if law enforcement gets their hands on a database linking government names to the accounts of people who searched for information on abortion in a state where it’s criminalized? If ICE gets access to a list of folks who avoided providing valid U.S. government ID? Anonymity is a pillar of our First Amendment rights (in the US) and of online safety in general. Destroying it with mandatory age verification will bring immense harm to those who rely on it.

Online, there’s no way for users to verify that their private information has been deleted, or to ensure that it won’t be copied, sold, or stolen. Companies that claim to delete personal data such as IDs—including age verification companies—have already experienced data breaches, and the more data a company collects, the more likely the chance of a data breach. 

Here are a few recent examples of age-verifying companies getting hacked:

1. Discord routed users' ID data through its general customer service workflow so that a third-party vendor could perform manual review of verification appeals. No one involved ever deleted users' data, so when the system was breached, Discord had to apologize for the catastrophic disclosure of nearly 70,000 photos of users' ID documents. 
2. Major identity verification company, AU10TIX, left login credentials exposed online for more than a year, allowing access to very sensitive user data. 
3. The Tea App, which was meant to protect women’s safety, was also breached, causing a massive database of users’ personal information—including photos of their IDs!—to be publicly leaked and picked apart on 4chan.

This is scary stuff! There is no fully safe, fully accurate, fully secure system of age verification. Full stop. As individual users, we have to stay alert and try our best to make wise decisions as to which systems we opt in and out of.

Most age-gating laws do not make it a crime for users to evade age gates, but instead punish companies and app stores that fail to comply. (For example, many laws threaten platforms with steep fines per infraction—that is, per each individual user under X age that slips past verification.)

So, two things:

First, this is a red-meat issue for many state AGs, so we absolutely are seeing states aggressively enforcing these laws against online services. We’ve already seen this in Florida, and just today the Indiana Attorney General sued Aylo (Pornhub’s parent company) for violating its age gate on adult sites even though Aylo tried to geoblock Indiana users.

Second, while the enforcement of these laws happens against the services (not individual users), that doesn’t mean lawmakers aren’t trying their best to keep users from finding ways around their age-gates. There’s been a wave of proposals across the US and the world to ban VPNs, for example. Read more here: https://eff.org/deeplinks/2025/11/lawmakers-want-ban-vpns-and-they-have-no-idea-what-theyre-doing

You’re absolutely right, age verification is just one piece of a much bigger problem. We’re seeing the same surveillance-first approach show up with tools like Flock cameras, drone regulations, and more. That’s why we’re constantly pushing back, including suing the government when necessary. We’ve covered Flock and drones a lot and aren’t planning to stop. The fight against surveillance has a lot of fronts, and we’re in it for the long haul.

Reach out to your elected representatives, both at the state and national level—early and often! It does make a difference. Even lawmakers who aren’t sponsoring these bills are being briefed on them, and silence is too often interpreted as consent. Our Action Center is a good place to start, but you can do this on your own too.

If you’ve reached out, tell others that you did so, and why. Social proof matters more than people realize, especially on issues like this that aren’t already politically polarized. 

It also doesn’t take huge numbers. We’ve seen bills stall or lose momentum after just a few thousand well-placed emails or calls, especially early in the process. Being aware—which you are, by virtue of being here—and showing up early are some of the most effective things you can do.

EFF is more than just lawyers, and we don’t just write blog posts. Our teams include litigators, technologists, activists, and policy advocates, and we use all of those tools. 

On the legal side, we’ve filed briefs in court cases about age verification in cases around the country, including California (twice), Florida, Georgia, Mississippi, Ohio, Utah, Texas, and Tennessee, and the Supreme Court. Across these cases we argued the same point: these laws burden the First Amendment rights of both young people and adults.  

On the policy side, we have dedicated lobbyists and advocates who meet directly with lawmakers and staff to explain, in practical terms, why age verification harms peoples’ privacy, chills speech, and creates security risks. We also run an Action Center that lets supporters contact their representatives directly, and we use that to mobilize opposition to the most threatening age-verification bills. That pressure matters—when tens of thousands of people take action, lawmakers do listen. 

Technologists at EFF analyze how age-verification systems actually work in practice—what data they collect, how they fail, and how they can be abused. That technical knowledge feeds directly into our litigation, lobbying, and public advocacy. 

We do publish research and analysis, but that’s part of the ecosystem, not the end goal. 

In short: we litigate, we lobby, we organize users, and we bring technical reality into rooms where it’s often missing.

Oh yes. You’re not some crazy conspiracy theorist—there is a well-funded, organized, and concerted effort to pass these laws around the country. Banning pornography is one of Project 2025’s goals, which is why The Heritage Foundation is a staunch supporter of age verification laws. They even said it was a “back door starting with the kids” to ban porn altogether. Plus, there’s a huge “age verification” industry that seeks to profit from these laws and is cheering on the legislators and feeding false promises about accuracy and safety. In the U.K., there have been political lobbying groups claiming credit for the idea since 2017, and stating the intent being to ban porn altogether. We don’t know what’s happening in every country, but wouldn’t be surprised to hear similar stories from around the globe.

This question comes up a lot, and we’ve answered it in a few different places in this AMA. But wanted to throw out a few more EFF resources that could be useful in these conversations: Privacy Harm is Harm and Privacy Loves Company

Thanks for raising this question! Yes, there are absolutely legislative alternatives to age verification that will actually make the internet safer (among many other benefits!).

Comprehensive federal privacy for all! EFF has long advocated for a strong federal privacy law. Protecting people's privacy is the first step we should take to create meaningful online regulation. Creating a federal privacy right that includes strong enforcement mechanisms, like a private right of action, and making sure Congress’s protections are a floor and not a ceiling will protect users without running into the free expression and privacy issues that age verification measures present.

You can also push for better enforcement of our antitrust laws and new legislation to address monopoly abuse by powerful tech companies. Privacy and competition work hand in hand to address monopoly harms.

Although most state laws only require online services to erect the age gates and do not make it unlawful for a user to bypass them, you should check your local law carefully before intentionally facilitating a minor’s access to a site for which the law aims to limit access. Even if there isn’t a law about that on the books right now, there’s a chance that could change.

As for new laws, we’re already seeing attempts to ban uses of Virtual Private Networks (VPNs), which have seen increased interest since age gate mandates started rolling out.

For example, in 2025, Wisconsin lawmakers escalated their war on privacy by targeting VPNs in the name of “protecting children” in A.B. 105/S.B. 130. It’s an age verification bill that requires all websites distributing material that could conceivably be deemed “sexual content” to both implement an age verification system and also to block the access of users connected via VPN. Another proposed Michigan bill requires “An internet service provider providing internet service in this state [to] actively monitor and block known circumvention tools.” Circumvention tools being: VPNs.

We wrote more here about why this is a terrible idea. In short: banning VPNs is a privacy and competition nightmare, and it won’t even work.

We’ve tried our best to answer this in the “User Guide to Navigating Age Assurance”! There’s a real sense of “privacy nihilism” that these laws hope to instill in us, and we can’t let that happen so easily. Privacy isn’t dead! Far from it!

We sure are trying! You can help us by spreading our blogs and actions opposing it. We expect there will be a renewed KOSA debate in January and we will be there. We have been fighting this bill in various forms for more than three years now, and it hasn’t passed yet—and that is thanks to organized opposition.

Yes, we are working with organisations in the European Union and the United Kingdom on a range of age gating measures. In the UK, we've been advocating against the Online Safety Act since 2019 and working with organisations like Open Rights Group, Big Brother Watch and Index on Censorship to call on politicians to first drop the legislative proposal and more recently reform or repeal it. We've also worked to mobilise public pressure through public petitions and media engagement. In the EU, we fight against a multitude of age gating proposals, such as the plans to introduce a Digital Identity Wallet and the mini AV app, and the Commission's general support for an EU digital minimum age of 16 for access to social media.

Winning a metric fuck ton of court cases: https://www.eff.org/legal-victories

They are probably the most effective beneficial advocacy organization in existence. Without them, tech illiterate boomer politicians would have severely damaged the global internet dozens of times.

EFF is more than just writing blog posts, though we do write some great blog posts and sell some mighty fine shirts. Our teams include litigators, technologists, activists, and policy advocates, and we use all of those tools.

In short: we litigate, we lobby, we organize users, and we bring technical reality into rooms where it’s often missing. We wrote a bit more about what our work includes over in this comment.

On a practical day-to-day basis, we’ve outlined a "User Guide to Navigating Age Assurance" in our hub that might have some of those practical measures you’re looking for. BUT we also happen to think civic engagement is, and should be, practical. Educate yourself on the risks and harms of these bills, and make sure your community does the same, then make your voice heard by talking to everyone about what we all stand to lose if the age-gated internet becomes a global reality. Almost every state has introduced or passed one of these laws, so keep an eye out and urge your state lawmakers to reject harmful age-verification laws. Also, call or email your representatives to oppose KOSA and all other proposed federal age-checking mandates. We wrote a bit more about what you can do in another comment as well.

We're already seeing EU policymakers push to introduce legislation that requires the verification of people's ages to access online content, or go further and ban under 16s from social media in line with Australia's model. At a Member State level, countries are exploring more specific initiatives, such as France where a top court ruled that porn websites must check users’ ages.

These steps towards mandatory age verification undermine privacy, expression—rights that have been fully enshrined in EU law, including rights for young people through EU Commission guidelines under Article 28 of the Digital Services Act.

For alternatives: The issue of online safety is complex and will not be solved by throwing content behind an age gate, or by banning young people from social media. As we've been saying for many years, the harms that politicians are looking to solve require individual and specific solutions, such as tackling the recommender systems and algorithmic targeting that drives certain content at specific user groups. Tackling online safety must also have an offline component to ensure young people are educated around the harms of the online world and as equipped as possible to navigate social media. These are not easy solutions, but politicians must start looking into what is best, and not what is easy.

Thanks for your question! We spoke a bit about how we think about this “privacy nihilism” argument in previous answers here and here. 

In terms of outreach, we often hear things like: “why should I care about privacy when I don’t do anything wrong?” I personally try to answer this question by encouraging the person to think bigger. Try to find what moves them, and point out how privacy supports that particular community, hobby, or idea. 

We also like to say that privacy is a team sport, so we should be thinking about our entire community when we put together a security plan. 

After all, (nearly) everyone uses the internet. And while we think everyone should want to protect those specific communities that will be deeply harmed by the annihilation of online anonymity (like abortion-seekers, political dissidents, whistleblowers, survivors of abuse, and so on), it can sometimes help to point out that anonymity and privacy are not just abstract issues that protect other people! They are fundamental freedoms that maintain the internet’s status as a free, open, expressive place, and allow all of us to use it for whatever purpose we want—to connect with friends, share our art, practice our religions, organize protests, you name it. 

In a world without privacy—where we have to pass over our IDs and biometrics in order to access online community—the internet will look a whole lot different. That affects every one of us, so we must keep fighting back.

We're here for another 50 minutes!

We speak up on everyone’s online freedoms every day, and that has always included people who make software. EFF was actually founded to support software developers in 1990. 

Here are a few pages you might be interested in: 

• Our Coders’ Rights Project is a team of EFF lawyers who offer direct, pro-bono counseling to security researchers who are faced with threats of legal liability. https://www.eff.org/issues/coders 
• Offline is our campaign on behalf of imprisoned technologists, whistleblowers, and journalists who have been detained or threatened with prison for their work protecting or enhancing free expression and privacy. https://www.eff.org/offline 
• We just completed a campaign asking supporters to weigh in on new proposed rules at the US Patent Office that would enable patent trolls. Thousands of people spoke up, including hundreds of software developers.   

And of course, all of our work to protect creativity and innovation online. We’ve long fought to defend digital creators and inventors, and to protect and strengthen fair use, innovation, open access, net neutrality, and your freedom to tinker. https://www.eff.org/issues/innovation

They were such a cool design! Our design team rocks. I’ve relayed the message, but for now, have you checked out our sick new green motherboard hoodie?

we’ll be here in r/privacy from 12-5pm PT on Monday (12/15), Tuesday (12/16), and Wednesday (12/17)

Did you read the part where it says they'll answer on 12/15?