Governments across the world are tired of the chaos online. In the UK, lawmakers believe they’ve found the solution: verify everyone. Know who’s behind the screen, and you can finally make the internet safer, or so the thinking goes.
This push is gaining traction globally, and it is centred on data and identity verification laws. The idea is to force platforms to confirm users are who they say they are, or at least how old they are.
On paper, it makes sense. No more kids stumbling onto adult content. No more anonymous trolls hiding behind burner accounts. And no more shady accounts scamming the vulnerable.
But the people who understand how the internet works, engineers and security experts, are not impressed. In fact, many say this is how you break the internet, thinking you’re saving it.
The UK’s taking us down a dark road
Let’s start where the trend is loudest: the UK. The Online Safety Act, passed in 2023, says platforms should put serious guardrails in place to protect users, especially children.
One of those guardrails is age verification. Social media companies, adult content sites, and messaging apps all have to find a way to confirm users’ ages.
Not just that, in some cases, even identity verification could become mandatory if it’s deemed necessary to meet safety standards.
That goes beyond just confirming someone’s age, the sites would be forced to ask for ID.
The UK isn’t alone. The EU has its Digital Services Act, and countries like Australia and the US are watching closely.
It’s only a matter of time before others follow suit, especially in countries where child protection and national security are politically in style at the moment.
Why techies are worried
At a glance, these measures sound like good parenting: keep kids away from harmful stuff, hold abusers accountable, reduce scams. But as always, there are layers not often considered by politicians.
First, verification means lots of data. Whether it’s ID numbers, facial scans, phone numbers, or biometric info, platforms will need to collect and store sensitive data to meet compliance.
Hackers are just drooling over themselves at the thought of such pots full of juicy honey.
“The more platforms are forced to verify identities, the more they’ll collect data they were never designed to protect, and history tells us that data will leak,” is how I would put the concern of many security guys I have heard speak on this.
Even worse, verification doesn’t always mean central storage. Some solutions outsource verification to third parties. That spreads the risk. When such sensitive data is passed on from one place to another, that increases the risk of failure.
Then there’s the loss of anonymity. It’s been argued and I think it’s true, anonymity is the feature, not the bug, that made the internet what it is.
Whistleblowers, opposition politicians, and abuse survivors rely on anonymity to speak freely. Critics argue these laws risk criminalising privacy in the name of safety.
But isn’t safety worth the cost?
That’s the question regulators are betting on. They’re hoping voters will see the tradeoff as worth it. And for parents concerned about online grooming or exposure to harmful content, they just might.
I guess that’s the power of shows like ‘Adolescence’ on Netflix. Right when parents are terrified of the stuff their kids could be exposed to, these well-intentioned-but-likely-flawed laws gain traction.
But experts say the security burden these rules introduce will backfire, not just on platforms, but on users too.
There are lots of examples, and one of the most current ones is pretty juicy.
The Tea app tried to implement stronger data checks and ended up exposing sensitive user data. We’ll unpack that mess in our next story, but it perfectly illustrates what the security experts are warning us about. Intentions don’t matter if your systems are weak.
The debate goes on
This isn’t to say we shouldn’t protect children or tackle online abuse. But many in tech are saying this isn’t the way. Alternatives exist, like on-device age estimation, sandboxed experiences for minors, or less invasive parental controls.
The governments are saying, “Nah, it will be fine.” I don’t know who to believe, the security experts or the politicians.
What’s clear is that the internet is changing. Governments want accountability. Users want privacy. Platforms are stuck in the middle, and so are we.
Stay tuned, next we dig into the Tea app’s data spill and how it became a textbook example of good intentions gone wrong.
Leave a Reply