The privacy paradox of protecting kids online

In 2024, individuality verification supplier AU10TIX, which provided services to companies similar TikTok and Uber, was recovered to person exposed drivers' licenses to hackers for implicit a year. In 2025, the age-verification systems supplier for the societal media tract Discord was breached, exposing perchance 70,000 users' authorities IDs. In 2026, the acquisition should already beryllium wide that erstwhile property verification depends connected vendors and stored individuality data, a information strategy tin go a breach vector.

And the emergence of AI is lone accelerating these risks, making hacks faster and the resulting harm easier to inflict.

This is the backdrop against which the U.S. House passed the Kids Internet and Digital Safety (KIDS) Act connected June 29th, a sprawling bundle built astir the Kids Online Safety Act (KOSA), 267-117. The measure present sits successful the Senate, wherever KOSA's ain authors, Democrat Richard Blumenthal and Republican Marsha Blackburn, resoundingly rejected the House mentation and are pushing a tougher one, successful portion by tying it to national preemption of authorities AI laws. A Senate Commerce Committee markup is expected this month. Whatever emerges from that process volition signifier however individuality works online for years.

The intent is to support minors. The hazard is that the mechanics protecting them requires gathering a overmuch larger surveillance apparatus than anyone campaigning for it admits.

Frederik Gregaard is the CEO of the Cardano Foundation, the Swiss-based non-profit enactment that exists to guarantee the advancement of the Cardano protocol.

KIDS doesn't mandate property verification outright, due to the fact that it doesn't person to. Making platforms liable for harm to minors who entree their services gives companies a elemental hazard calculus. Either you verify age, oregon judge the ineligible vulnerability of not knowing who's a minor. Liability without a verification mandate inactive produces verification. That's the mechanism, and it's worthy naming explicitly, due to the fact that "there's nary explicit property cheque successful the bill" is simply a technically existent defence that misses however the inducement really works successful practice.

Once disclosure becomes the terms of access, the accusation dragnet tends to expand. A instrumentality built to corroborate idiosyncratic is aged capable becomes a instrumentality that confirms who they are, and a database built to forestall liability becomes conscionable a liability – 1 much repository of recognition information waiting for the adjacent AU10TIX-style breach.

But if a level lone needs to cognize that a idiosyncratic is aged enough, it should not necessitate a afloat individuality record oregon different information it whitethorn usage arsenic a proxy for age. If a work lone needs to trim vulnerability to harmful content, determination is nary request to physique a database that tin aboriginal beryllium repurposed. These distinctions, nevertheless small, matter.

In Utah, which passed State-Endorsed Digital Identity (SEDI) legislation, Cardano Foundation-built Veridian has already shown that integer individuality tin beryllium delivered successful a privacy-preserving way, allowing users to beryllium that they are implicit oregon nether a circumstantial property without exposing immoderate different data. It’s a moving exemplary of what liable verification tin look similar and shows spot does not necessitate unnecessary disclosure. Privacy tin beryllium designed into the strategy from the start.

That is the modular bills similar KIDS oregon KOSA should favor.

If the extremity is to support children, the tools should beryllium narrow, purposeful, and minimally invasive. Broad mandates that propulsion each level toward much data, much retention, and greater dependence connected individuality are excessively blunt and hazard creating a multitude of different problems alongside the ones they assertion to solve.

A amended attack is straightforward. Build for information minimization, bounds retention, and usage privacy-preserving verification wherever verification is genuinely needed. If integer spot tin beryllium established without exposing idiosyncratic data, lawmakers should similar that path. If information tin beryllium improved without turning the net into an individuality checkpoint, that should beryllium the lone option.

Children merit extortion online. But they bash not request a argumentation model that makes everyone much disposable successful bid to marque the internet, and the companies that thrive connected it, much accountable.

The close modular is simpler: support minors, bounds data, sphere privacy, and physique spot without unnecessary disclosure.

That should beryllium the trial for KIDS, due to the fact that you tin physique information without surveillance.