More than 400 specialists demand the end of online age verification

The rise of regulations aiming to impose online age verification raises many controversies among cybersecurity and data protection experts. In 2026, more than 400 experts from 30 countries issued an open letter warning of the potential dangers related to these measures. They point to a rush by legislators, who are moving faster than the available technological solutions, and call for a moratorium to reassess these systems. This debate, far from being purely technical, confronts fundamental issues such as internet security, the privacy of internet users, especially younger ones, and free access to information on the web.

At the heart of the criticism is notably the reliability of age verification methods, considered easily bypassable. Concrete cases, such as facial recognition fraud or the massive use of virtual private networks (VPNs), demonstrate the limits of these protections. Moreover, the desire of some governments to regulate or restrict VPNs, considered essential by the IT community to ensure security and privacy, adds a complex political dimension to the issue. Finally, the creation of databases gathering sensitive documents, such as passport scans or biometric data, exposes an increased risk of hacking and abuse, thus raising the question of the right balance between protecting minors and respecting individual freedoms.

The technical limitations of online age verification and their consequences in 2026

Current online age verification systems, although ambitious, struggle to guarantee robust security. The experience of the United Kingdom, a pioneer in implementing these systems, offers a revealing insight into the difficulties encountered. By using technologies such as facial recognition or document verification, platforms seek to limit minors’ access to inappropriate content.

However, these mechanisms face major flaws. For example, facial recognition can be deceived, as illustrated by an innovative bypass involving the video game “Death Stranding” which allowed surmounting age controls on Discord. Similarly, VPNs provide users with a simple and effective way to mask their real age or location. These tools, by changing the IP address, easily circumvent the restrictions imposed by regulations.

This situation leads to a paradox: the stricter the regulation becomes, the more motivated users find sophisticated ways to evade it. The direct consequence is a decrease in the real effectiveness of age verification and a strengthened sense of impunity for some minors, who still gain access to protected content. Furthermore, this race between legislation and technology creates an administrative and technical overload for operators, often to the detriment of user privacy.

Another often overlooked side effect is the impact on user trust. Faced with an obligation to provide sensitive data — identity cards, financial proofs, or biometric data — many internet users express fear that this information might be exploited for other purposes. This mistrust can lead some to abandon the service, thus restricting free and fair access to information.

In light of these limitations, experts recommend a temporary halt to laws imposing age verification. This moratorium would allow a thorough assessment of risks, and development of more reliable and respectful methods before continuing their generalization.

Why VPNs are at the heart of a debate around internet security and age verification

Virtual private networks (VPNs) play a paradoxical role in the age verification dossier. On the one hand, they are an essential means for a significant part of internet users to protect their privacy and ensure the security of their online communications. On the other hand, they are used to circumvent restrictions put in place to protect minors, which leads some legislators to consider limiting their use.

Privacy advocates insist that VPNs are not intrinsically tools for fraud. On the contrary, they serve to avoid mass surveillance, cyberattacks, and digital censorship, major concerns in a context where internet security is becoming an absolute priority. Restricting these technologies would pose a risk to the entire digital society, by exposing users more directly to abusive data collection and the dangers linked to malicious intrusions.

From a political standpoint, the situation is more complex. In the United Kingdom, France, and various American states, bills have already been proposed to limit VPN use within the framework of age verification. These measures, motivated by the desire to strengthen the protection of minors, worry experts who denounce a possible circumvention of fundamental rights in the name of security objectives.

The debates thus highlight a major dilemma: how to reconcile, on the one hand, the need to protect young users from inappropriate content and, on the other, the right to privacy and secure browsing? This paradox reveals that the issue of age verification now goes beyond the simple technical framework to involve much broader ethical, political, and social debates.

In summary, the place of VPNs in the age verification ecosystem remains a hot topic, with crucial stakes for privacy and freedom of expression on the internet that will be decisive for the future of internet security in the coming years.

The risks related to the accumulation of personal data in age verification systems

A major alert point raised by specialists concerns the accumulation of extremely sensitive data in the databases used for online age verification. These systems often require personal information such as scans of identity documents, passport copies, bank card numbers, or even biometric data like facial recognition.

This concentration of data creates a prime target for cybercriminals, especially in a context where cyberattacks are becoming increasingly sophisticated. The internet security of these databases is therefore crucial, but past breaches — such as the recent leak exposing 70,000 ID photos linked to a Discord service provider — illustrate the possible dramatic consequences.

Beyond the risks of hacking, this massive collection also raises questions about confidentiality and personal data protection. The fact that some of these documents are linked to minors adds an extra layer of caution, since consent and rights management become more delicate.

Here is a summary of the main risks related to this accumulation:

• Massive data theft: the concentration of highly sensitive information attracts hackers, which can lead to large-scale leaks.
• Commercial or malicious exploitation: collected data could be used for advertising purposes or, worse, for fake profiles or phishing.
• Loss of control by users: once data is transmitted, it is difficult to guarantee its deletion or compliant use.
• Emotional and social impact: minors whose data is exposed may be particularly vulnerable to consequences such as harassment.

Type of data	Main risk	Possible consequence
Scans of identity documents	Identity theft	Impersonation, fraudulent access to services
Biometric data (facial recognition)	Irreversible leak	Impossible to replace or modify, illegal exploitation
Financial information (bank cards)	Financial fraud	Fraudulent debits, economic losses

These internet security and confidentiality issues require governments and platforms to implement advanced technical guarantees, and that transparency be total in the processing of these data. Specialists therefore call for a thorough review of collection methods before any generalization of age verification.

Current online age verification methods and their privacy-respecting alternatives

To estimate or confirm users’ age, online platforms currently rely on several technologies, each presenting significant advantages and disadvantages from the perspective of protecting minors and privacy.

The most classic method consists of asking internet users for official identity documents or financial proofs. This approach raises many concerns, particularly about internet security, as it involves transmitting highly sensitive documents. Incidents like the leak of ID photos of thousands of Discord users illustrate the associated risks.

Biometrics, notably facial recognition, is also among the solutions considered. While it often allows faster identification, it raises heavy ethical and practical questions. A face cannot be replaced like a password, making any biometric data leak irreparable. Controversies are developing around certain associated tech players, notably the Founders Fund linked to Peter Thiel, fueling concerns over potentially broader use for unintended purposes.

However, alternatives are emerging to minimize the amount of sensitive information shared. Among them:

• Attribute verification: confirms only the age without revealing full identity.
• Digital identity wallets: cryptographic solutions that allow proving an attribute (such as majority) without exposing other personal data.
• Anonymous or pseudonymous solutions: combine privacy protection with regulatory compliance but require a clear legal framework.

These technologies are promising but still in development and require additional guarantees, both technically and legally, before being widely adopted.

A global fight for online age verification that respects privacy and minor protection

In several countries, the temptation to impose online age verification is becoming a legislative reality. Australia now prohibits access to social networks for those under sixteen, while the United Kingdom, the United States, and the European Union are working on similar systems. This trend reflects a universal desire to protect minors but also international issues regarding digital regulation.

However, the more than 400 cybersecurity specialists who signed the open letter call for a strategic pause. According to them, moving too quickly could infringe on fundamental principles, notably confidentiality and the general internet security of all users. They therefore urge governments to establish a moratorium to finely evaluate the concrete impacts of these measures.

This global debate is far from over. It raises complex questions about platform responsibilities, the need for democratic data control, and the digital rights of minors. Protecting young people remains imperative, but care must be taken not to sacrifice fundamental user freedoms in the process.

Thus, it appears crucial that online regulation evolve in concert with technological advances and societal expectations, ensuring enhanced internet security while preserving privacy and free access to appropriate content.