# Child safety vs privacy: AI’s age verification dilemma > Source: > Published: 2026-07-30 15:04:16+00:00 # Child safety vs privacy: AI’s age verification dilemma ### There’s good reason to limit how children use chatbots. But the trade-offs might be too costly When Megan Garcia told lawmakers about how her 14-year-old son died by suicide after months of conversations with a chatbot from [Character.AI](Character.AI), one of her main requests might have been, on the face of it, the simplest — restrict access for those under a certain age. “I don’t think that chatbot technology in its current form is safe for children,” she told a Senate Judiciary subcommittee in September. “So if they could stop children from going on their platforms, don’t make it 12+ in your app store: have proper age verification so that children under the age of 18 do not have access to chatbots. I think that would save a lot of lives and save families from devastation.” Robbie Torney, senior director of AI programs at Common Sense Media, also told the hearing that AI companions shouldn’t be available at all to children below a certain age. Everyone on the panel at the very least agreed there needed to be strong safety measures in place if the tools are made available to children. Garcia’s story is becoming depressingly common. There’s no official count of how many children have been harmed, but OpenAI [said](https://openai.com/index/strengthening-chatgpt-responses-in-sensitive-conversations/) in October 2025 that about 0.15% of users in a given week “have conversations that include explicit indicators of potential suicidal planning or intent,” and a Pew Research study indicated that about two-thirds of teens have [used](https://www.pewresearch.org/internet/2025/12/09/teens-social-media-and-ai-chatbots-2025/) a chatbot. Taken together, that suggests a significant number of teens are discussing suicide with AI chatbots, not to mention engaging with sexual content, and there’s even more of a risk if those chatbots are manipulative. It’s little surprise then that Garcia’s prescription is gaining support from the public and increasing numbers of lawmakers. The problem is, age gating AI might not be feasible, with both practical barriers and ethical concerns. Stopping children from accessing AI services effectively means assessing *every* user’s age, and doing that securely is a technological and logistical challenge. Not everyone has access to the information they need to provide their identity by all the age verification solutions available at all times, and managing all the data collected safely and securely isn’t easy. There are also important free speech issues, and privacy concerns about collecting sensitive data. Age verification creates a fragmented internet in the best cases, and risks infringing on constitutional rights in the worst, posing lawmakers with a challenging set of trade-offs. “There’s no form of age verification that is not privacy invasive,” says Joe Mullin, a senior policy analyst at the Electronic Frontier Foundation. “There’s basically no perfect system. There’s no system that’s even close to perfect.” ### Growing pains Age gating is the theoretically simple practice of providing users with different experiences based on their age. What gets complicated is the implementation. The [Children’s Online Privacy Protection Act](https://www.ftc.gov/legal-library/browse/rules/childrens-online-privacy-protection-rule-coppa), for example, restricts certain types of data from being collected on children under the age of 13 without parental consent, which is why most social media services require users to be 13 or older in the United States. But the “actual knowledge” standard set by the law has been interpreted to mean that ticking a box to confirm one’s age is sufficient for a company to treat the user as if they really are. Age gating is present in the law, but the law’s text and subsequent rulemaking has a massive loophole. When it comes to knowing someone’s age, services are effectively permitted to take their word for it. In recent years, dozens of laws have been introduced at the state and federal levels to apply stricter age gating for social media, chatbots or both. The simplest of these calls for age “verification” — some process for confirming that a user really is over a certain age. How much responsibility a company has for blocking underage users based on data it may have collected on their behavior, or whether it must affirmatively check whether someone is above or below a certain age, varies and is often vague. The GUARD Act, for example, requires tech companies run users through a “reasonable age verification process,” while the Senate version of the Kids Online Safety Act (KOSA) requires technology companies block or limit the features available to minors if the company can estimate their age based on behavior. The age verification industry uses specific, and slightly different, definitions for each tier. “Verification” typically means affirming a user’s age directly, often checking against a government ID. A looser standard is age “inference,” which involves linking some other account or service that proves a user is of age — for example, an active account for a credit card that requires being over the age of 18, or a pilot’s license. Apple has also created a solution based on a birth date entered when setting up their device, with the expectation that a parent is involved, while Google pulls that information from data it already has. Both systems tell other apps and services that the user is above the age required without transmitting their precise birth date. This is technically a different type of age “assurance,” because the operating system is vouching that the user is of age rather than transmitting documentation that proves it. An array of third- party age verification providers do something similar, where they manage information about users and tell apps whether they fit the age requirements. There is also a burgeoning field assessing age based on biometrics such as face scans or hand movements, and age “estimation,” where a tool assesses whether a user is above or below a certain age based on behavioral patterns, such as what they talk about or shop for. Each of these methods come with pros and cons. Requiring government ID, for example, is fairly reliable for the users who can provide it, but excludes the 2.6m Americans who lack any government ID, and many of the 34.5m who don’t have an up to date ID one — disproportionately younger and people of color, [according](https://cdce.umd.edu/feature/new-cdce-survey-shows-millions-lack-id-voter-id-laws-spread-more-states) to a 2024 report from the University of Maryland’s Center for Democracy and Civic Engagement. Linking a credit card account is convenient, but only works if you have one that fits the criteria. Apple and Google’s systems have worked well so far, but Apple’s is flawed in that some children might be able to convince a parent or guardian to lie about their age when they set up their phone, while children can circumvent both with a burner phone. Estimation can also be tricky: as journalist Taylor Lorenz has said, “there’s no meaningful way to tell the difference between a 17 and a half year old and an 18 year old.”. Without standardization, the user experience of the internet becomes fragmented. Some users will be able to fulfill some verification requirements, but not others. But a law that is too prescriptive can also make this worse, by not giving users enough options, or blocking out innovation as new ways of age verification are developed. The more often age needs to be verified, the more irritating the user experience can also become, raising barriers to entry for some products. Different laws have different requirements for what kinds of technology is acceptable. The GUARD Act, for example, permits the use of any “commercially reasonable method” and the KOSA [calls](https://www.congress.gov/bill/119th-congress/senate-bill/1748/text#toc-id43fe8c4d-e881-41b0-819c-a88c54ed5043) for a study into “technologically feasible methods” for age verification and their impacts on internet access, privacy and market competition. In New York, rules [released](https://ag.ny.gov/press-release/2026/attorney-general-james-and-governor-hochul-release-final-safe-kids-act-rules) by the New York Attorney General’s office require annual auditing of age verification tools, as well, assessing their accuracy and data management techniques. Even if those practical issues can be overcome, age verification raises a whole host of wider privacy issues. Information submitted to pass an age verification checkpoint is sensitive, whether that be a child’s age, a face scan, or passport details. And a collection of sensitive data like that is a honeypot for hackers, who could theoretically use it for identity fraud or blackmail. It could also be used by companies for advertising and engagement purposes or, worse, the federal government for surveillance. The government already [surveils](https://judiciary.house.gov/media/press-releases/new-report-exposes-massive-government-surveillance-americans-financial-data) financial transactions, and information about a user’s online behavior routinely [appears](https://www.naegeliusa.com/blog/social-media-evidence-in-court) in lawsuits and law enforcement [inquiries](https://www.cedus.it/files/Infographic-Social-Media-Use-in-Law-Enforcement.pdf). Despite that, people talk about breaking the law online, and often engage in activities they would like to keep private from the government — particularly [if they think the internet is more anonymous](https://daniellefavreau.com/2025/09/11/the-psychology-of-social-media-why-we-say-things-online-wed-never-say-in-person/) than it is. Age verification is ultimately the [expansion of the data collection](https://www.eff.org/pages/age-verification-systems-are-surveillance-systems) used to surveil us already, and any backdoors can inevitably be used for purposes other than initially intended. In seeking to do the simple task of assessing someone’s age, it effectively ends anonymity on the internet, something that many see as vital to freedom of expression. Imagine a world where the government can tie all of your online activity — every political tweet, every chatbot query and yes, every porn video — to your real identity. Age verification technology could usher in that reality. As AI tools become an increasingly important part of our digital lives, losing privacy there could have significant implications. There are technological solutions that allow verifiers to assess age without actually retaining the data, like zero knowledge proofs, which cryptographically verify information. But Alexis Hancock, director of engineering at the Electronic Frontier Foundation, says their benefits are limited because of how easy it is to piece together different signals to build a more complete profile of an individual, and then use that data for other purposes. Some age gating laws have provisions that bar the misuse of data, but not all, and the definition of misuse is often poorly defined. “I would much rather people use a zero knowledge proof of some kind to share above or below an age range, but there’s no governance,” she said. “Say I’m under 18 last week, and I prove that I’m over 18 now to that same verifier — what is the governance behind that, that makes sure that they don’t flag that as an important piece of info about me to carry with into a comprehensive profile about me, to use later?” ### The Paxton problem Of course privacy isn’t just a practical matter of keeping sensitive data safe from bad actors, but also an ethical one. Many people are aware, and frustrated by, the amount of data that apps already collect about us to sell us products and to make their own tools more addictive, building complex user profiles that sometimes include sensitive searches or information users thought were private. Ask someone like Mullin, and they will say the only solution is a nationwide data privacy law or COPPA reform which would begin to protect both adults and children from manipulative targeting. He also suggests reforming the Computer Fraud and Abuse Act, which platforms have used to shut out third-party applications. Doing so could strengthen choice over which method of age verification to choose, because it would allow more third-party apps to compete with the major social media companies with similar products. “That law is really what is preventing other companies from making things like Facebook, but with really good parental controls, or like Instagram, but I’m moderating posts about x, y, and z,” Mullin says. “We all leave it up to the one big company, and like, cross our fingers that they have moderation options that work for us.” And even if the privacy issues can also be solved, it still leaves another loaded and potentially difficult to navigate question around age verification — one that revolves around the First Amendment: do age verification laws in principle breach a child’s freedom of speech, and in practice do they also undermine free speech for everyone? The most prominent legal case relevant to these questions is Free Speech Coalition, Inc. v. Paxton, where a coalition attempted a Supreme Court challenge of a Texas law which required age verification for sites where over a third of content was “sexual material harmful to minors.” Ultimately, the Supreme Court [was asked](https://harvardlawreview.org/print/vol-139/free-speech-coalition-inc-v-paxton/) whether the government had a legitimate reason to pursue limiting online speech, and if the law would lead to some level of unacceptable, implicit censorship of adults who were permitted to speak but might curtail their speech because of the age verification regime. The Supreme Court found that the law was permissible under both tests. “When we’re talking about free speech rights, we’re not talking about free speech rights that are, to be frank, equally applied,” explained Michael Toscano, senior fellow and director of the Family First Technology Initiative at the Institute for Family Studies, which has circulated [model bill text](https://ifstudies.org/report-brief/model-legislation-for-age-verification-of-social-media) he feels complies with the First Amendment. “The Supreme Court has taken a fairly maximalist view on adult free speech, and it has, by contrast, taken a more constrained view of the free speech rights of children, which it sees as tending to flow through parents.” There are also ongoing state lawsuits in California and Utah which use arguments suggesting it might be legal to regulate addictive features targeting users who sites know are children, rather than content, each of which could reach the Supreme Court. That may be one reason the Senate version of KOSA focuses on addictive *features*, such as infinite scroll, autoplay, and push notifications. But that’s a legal area to be tested further, Toscano says. “I think that the lower courts don’t know exactly what to do yet, because they’re receiving signals from SCOTUS which suggest that SCOTUS is interested in rethinking some of this stuff. If I were a pioneering policy person … this would be the very time to test these things.” ### The bigger picture Hancock also says lawmakers need to wait to do more research into the methods they prescribe. But that’s inherently at odds with how fast AI is moving. Few doubt we need some types of guardrails for children now. Among those on offer are age gating, pre-deployment testing, frontier model disclosures, or a prohibition on chatbots posing as mental health professionals, many of which are other solutions experts and parents, including Garcia, advocated for in the September hearing. But with current solutions around age gating, lawmakers are attempting to make the internet like the physical world, where children are unable to enter certain spaces that seem unsafe. “In the physical world, you can’t take children to certain movies until they are a certain age,” Said Sen. Marsha Blackburn said in the September hearing at which Garcia appeared. “You can’t have them play certain video games until they’re a certain age. You can’t sell alcohol, tobacco, firearms, have a kid enter a contract. You can’t take them to a strip club. You can’t expose them to pornography because in the physical world there are laws. They would lock up that liquor store, they would put that strip club operator in jail if they had kids there. But in the virtual space, it’s like the Wild West 24/7, 365.” But physical barriers don’t carry with them the same burdens as virtual ones. A bouncer who checks someone’s ID doesn’t retain that data in his brain, or at least not with the precision that is permitted online. He does not muzzle someone he bars from entry, either. Every technology solution has its trade offs, and all create a fragmented internet. Issues of access, privacy and free speech concerns may deter people from using online services even if they don’t actively block them. Simply restricting children from accessing what we decide they shouldn’t online seems like it should be as simple as it is in real life. The reality is it’s anything but.