Zero-Knowledge Proofs Won’t Save Age Verification—They’ll Just Build a Bigger Panopticon
Age verification is everywhere, and it’s getting worse. At the time of writing, roughly half of US states have some flavor of internet age verification law on the books, while federal proposals like the KIDS Act and the Kids Online Safety Act (KOSA) keep crawling through Congress. source↗ The European Union is barreling toward centralized age verification inside a single government app by the end of this year, and Australia has already imposed one of the broadest online age-restriction regimes on the planet. source↗
Every one of these laws tends to fail at its stated goal—keeping kids out of designated corners of the internet—while quietly building the scaffolding for a surveillance state that touches every adult user too. The latest escape hatch being sold to nervous lawmakers is the Zero-Knowledge Proof, or ZKP. The pitch sounds clean: prove you’re old enough without giving away anything else. It’s the kind of line that makes policy consultants light up and civil liberties groups reach for the antacid.
The Electronic Frontier Foundation recently took a hard look at how ZKP-based age verification is actually performing in the wild, and the answer is: not well. source↗ The theory is elegant. source↗ The practice is a mess. source↗
What ZKPs Actually Do
Zero-Knowledge Proofs are a genuinely impressive piece of cryptography. They were not, however, designed with age-gating the internet in mind. The basic idea is that one computer can prove to another that a statement is true without revealing the underlying data. Computer A locks in a commitment. Computer B fires off mathematical challenges that can only be answered correctly if the commitment is true. Repeat the challenges enough times and there’s no room for doubt. source↗
Because that back-and-forth would be painfully slow online, the modern preferred form is the non-interactive variant known as zk-SNARK. The answer is hashed into a fixed, shorter string that’s theoretically unpredictable and tamper-resistant, and verification happens instantly. In the idealized version of events, this means a person can attest to being an adult without handing over their driver’s license, birthdate, face scan, or browsing history to every site they visit. Only the issuing entity collects the underlying data, and everyone else just gets the proof.
That’s the sales pitch. Here’s the catch: the issuer becomes a god.
The Centralization Problem No One Wants to Talk About
Under a ZKP age-verification scheme, you’re issued a token that vouches for your age every time you log in to a participating service. That creates a persistent link back to the entity that verified you in the first place. The issuer of those tokens can, in principle, track every single time that credential is used. That’s not a hypothetical privacy leak—it’s a metadata trail by design, and metadata is exactly what intelligence agencies and authoritarian governments salivate over. source↗
It gets worse. That same issuer can be pressured by any government—democratic today, authoritarian tomorrow—to revoke a user’s credential. Pull the token, and the user effectively loses access to every service that relies on it. In a world where banking, healthcare, education, employment, and political speech all flow through the same digital identity wallet, that’s not a deactivation. That’s digital exile. source↗
This is the core contradiction that ZKP cheerleaders refuse to confront. You cannot build a single point of failure for internet access and still claim to support a free and open internet. The architecture itself is the threat. It doesn’t matter how clever the math is if the political structure sitting on top of it is a chokepoint.
The EU’s Broken Rollout
If you want to see what this looks like in practice, look at the European Union. By the end of 2026, all 27 EU member states are expected to have infrastructure in place to perform age verification inside a “mini-wallet” app that lives within the EUDI Wallet—the European Digital Identity framework. source↗ Digital rights experts have been raising alarms about this for a while, and the rollout is already proving them right.
The “mini-wallet” version is being pushed out to users with the promise that ZKPs are working. They’re not. The ZKP features aren’t actually turned on in the version ordinary people use out of the box. They’re only live in a closed demo and prototype build that the vast majority of users can’t access. source↗ So the public is being sold a privacy-protective system that, in practice, isn’t even switched on for them.
Then there’s the hack. A security researcher found they could bypass the app’s age-assurance system using a quickly thrown-together Chrome extension that tricked the app into repeatedly accepting the same “over-18” token without ever asking for fresh verification. source↗ This wasn’t some elaborate nation-state exploit requiring months of work. It was a browser extension. If that’s the security posture of a flagship government identity system, the phrase “silver bullet” should be retired on the spot.
More than 400 security researchers signed an open letter arguing that age-assurance checkpoints—even ones built with privacy in mind—would cause more harm than good. Their central concern, shared by EFF and by anyone who’s spent more than five minutes thinking about the architecture, is that a centralized identity verification system creates a single point of failure that’s extremely vulnerable to both cyberattack and authoritarian overreach. source↗
And this is before the mini-wallet is fully integrated into the EUDI Wallet, which will hold passports, driver’s licenses, travel records, financial information, and who knows what else. When the failures come at that scale, they won’t just leak whether someone is over 18. They’ll leak the contents of people’s lives. source↗
Why the “Privacy-Preserving” Framing Is a Trap
The appeal of ZKPs to well-meaning privacy advocates is understandable. If you’re going to do age verification at all, wouldn’t you rather do it in a way that minimizes data sharing? Sure. But that question assumes the premise. The real question is whether mandatory age verification should exist at all, and the answer to that is a resounding no.
Every method of online age verification that has ever been proposed—ID upload, facial age estimation, credit-card checks, behavioral inference, and now ZKPs—fails at least one of three tests: it’s not privacy-protective, it’s not accurate, or it can’t guarantee universal coverage without introducing severe security risks. source↗ ZKPs don’t break that pattern. They just move the failure point. Instead of every website hoovering up your ID, one entity hoovers up your ID and every website gets a token. The data collection is consolidated rather than eliminated, and consolidation is exactly what you don’t want when the threat model includes state actors, data breaches, and corporate mission creep.
The “zero-knowledge” part refers to what the verifying party learns. It does not refer to what the issuing party knows, and the issuing party is the one that matters. That’s the entity that collects the documents. That’s the entity that can be compelled. That’s the entity whose breach turns a privacy feature into a catastrophe.
Lawmakers Are Buying Magical Thinking
The political appeal of ZKP-based age verification is obvious. It lets lawmakers tell anxious parents that they’ve “done something” about kids online, while telling privacy advocates that the system is “privacy-preserving.” It’s a two-faced pitch that satisfies two constituencies without actually solving either problem. Kids still get online. Adults still lose privacy. The only winner is the infrastructure contractor selling the wallet.
This is the age verification paradox, and it doesn’t have a technical solution. You cannot simultaneously verify that every person on the internet is the age they claim to be and preserve the anonymity that makes the internet worth using. You can pick one. You cannot pick both. ZKPs don’t resolve the paradox; they paper over it with cryptographic hand-waving and hope nobody asks follow-up questions. source↗
The follow-up questions matter. Who issues the tokens? Who audits the issuer? What happens when the issuer is breached? What happens when a government orders the issuer to revoke tokens for political dissidents, journalists, protesters, or anyone else who falls out of favor? What happens when the “mini-wallet” becomes the only wallet, and every digital interaction requires a credential that one entity controls? These aren’t paranoid fantasies. They’re the logical consequences of the architecture being built right now in the EU and seriously discussed in the US.
The Disruptarian Take
Let’s be clear about where this goes. Age verification laws are not about protecting children. They’re about building the infrastructure to control who can speak, transact, and exist online. The “protect the kids” framing is the trojan horse. The horse is a digital ID system. Inside the horse is a panopticon.
The EFF is right: no method of online age verification is privacy-protective, fully accurate, and capable of guaranteeing universal coverage without introducing severe security risks. source↗ ZKPs don’t change that. They dress it up in math and hope nobody notices that the math only protects one side of the transaction while the other side—the issuer—becomes the most powerful gatekeeper on the internet.
Mandatory online age verification of any kind is a dangerously flawed idea. It doesn’t need a better implementation. It needs to be scrapped. The answer to kids encountering harmful content isn’t a government-issued digital ID wallet hooked into every website, app, and platform. The answer is parental involvement, platform-level tools that users opt into voluntarily, education, and a cultural willingness to accept that the internet, like every other public space, cannot be made perfectly safe without being made perfectly unfree.
The punk and reggae scenes have always understood this instinctively. The moment you let someone stamp your papers before you can enter the venue, the venue isn’t yours anymore. The door belongs to the stamper. The music belongs to the stamper. The list of who showed up belongs to the stamper. And when the stamper decides you’re not allowed in, no amount of cryptographic cleverness is going to get you back through the door.
Tell your lawmakers that ZKPs aren’t a silver bullet. Tell them that age verification is a broken idea dressed up in new clothes. Tell them that a free internet is worth more than a false sense of security. And tell them before the wallet they’re building becomes the only way to get online at all.
Source: Electronic Frontier Foundation, “ZKP’s Aren’t Age Verification Silver Bullets,” August 2026. source↗
Related Reading
Similar posts
Tue, 30 Ju · Digital Rights
Age Verification in the UK: What Data Do Companies Collect?
In the UK, age‑gating is now mandatory for a growing list of online services. But what data is actually being handed over when you tap “I’m 18+”? This deep dive pulls the facts straight from the EFF and breaks down the p
Fri, 19 Ju · Digital Rights
UK’s Under-16 Social Media Ban: A Recipe for Censorship and Collateral Damage
The UK’s upcoming ban on social media for users under 16 is sparking fierce debate, with critics warning it will erode privacy, free speech, and meaningful online participation for young people. This deep dive unpacks th
2026-07-29 · Culture