This is the range worth fighting for, and it is missed because the debate is stuck on the wrong axis. Legislators define the choice between security and freedom; critics present it as a privacy protection. Both accept a false premise that keeping children out of adult spaces requires identifying adults. This is not the case. The real choice is between two age verification methods: one that minimizes data and forgets you the moment you pass, and one that maximizes data and remembers everyone forever. Only the second is surveillance, and only the second is currently the path of least resistance.
The window to insist on the former is now, while these bills are still in motion. The KIDS Act heads to a skeptical Senate. Chat Control 2.0 aims for a political agreement in July. In both cases, the principle that platforms must be able to distinguish adults from children has effectively been established. What hasn’t been decided is whether this capability relies on privacy-preserving evidence or a mountain of uploaded passports. This is a technical decision with consequences for civil liberties, and it is made, at present, largely by default.
There is a more important reason to address this issue properly, and to address it now. The old classification of Internet traffic as “bots or humans” is already collapsing: a third verified category is coming, AI agents acting, with permission, on behalf of people, companies and governments, and they will soon have to prove what they are authorized to do without unmasking those behind them. “Know your agent” will require the same privacy-preserving architecture that we’re currently debating for people. Decide well for human age controls, and we set the template for everything that follows. If we make a bad decision, we build surveillance into the identity layer of the Internet, for both humans and machines.
