The privacy paradox of protecting kids online

The article discusses the growing concerns around privacy risks posed by online age verification systems designed to protect minors. It recalls data breaches at identity verification providers AU10TIX in 2024 and Discord’s age-verification system in 2025, which exposed thousands of users’ government IDs. These breaches underline a critical issue: relying on vendors and centralized storage of identity data to verify age can create significant security vulnerabilities, especially as AI-driven attacks become faster and more damaging.

Against this backdrop, the U.S. House recently passed the Kids Internet and Digital Safety (KIDS) Act, largely based on the Kids Online Safety Act (KOSA), to regulate online platforms’ responsibilities toward minor users. Although the bill does not explicitly mandate age verification, it holds companies legally liable if they fail to prevent minors’ exposure to harm, effectively incentivizing them to verify users’ ages. This creates a potential privacy paradox, where efforts to safeguard children may instead lead to the buildup of extensive surveillance and identity data, increasing the risk of future breaches.

Frederik Gregaard, CEO of the Cardano Foundation, highlights that verification systems need not collect full identity profiles to confirm a user’s age. The example of Utah’s State-Endorsed Digital Identity (SEDI) project, which uses privacy-preserving digital credentials to prove age without exposing additional personal information, illustrates how responsible verification can be achieved without unnecessary data disclosure or retention. This approach contrasts with the broad mandates that push platforms to gather and store excessive identity data merely to avoid legal exposure.

The article argues that legislation like KIDS should prioritize data minimization and privacy by design, ensuring that tools to protect children online are narrowly tailored and minimally invasive. Instead of transforming online spaces into identity checkpoints, regulations should favor verification methods that establish trust without revealing personal details. The core challenge is to protect minors without amplifying surveillance risks or making everyone more visible online, which would create a host of unintended privacy and security problems.

In sum, while protecting children online is crucial, lawmakers must carefully balance safety with privacy to avoid perpetuating vulnerabilities. Privacy-preserving verification models, like those supported by the Cardano Foundation, provide a potential roadmap suggesting that online safety need not come at the expense of digital privacy. The outcome of ongoing Senate discussions on the KIDS Act will likely influence the future standards for identity verification and data protection in the digital economy.