Why Nym is against age-verification laws

Governments in the UK, USA, and Australia are erecting identity checkpoints on the Internet and calling it child protection. It’s an old ruse. What is actually being built behind it is surveillance infrastructure: systems that record who you are and what you access, run by private companies with commercial interests in that data, and designed to expand far beyond whatever purpose they claim today. Age verification is surveillance dressed like care. We shouldn’t accept it.

1. Age-verification systems are mass surveillance infrastructure. When you verify your age online, you don't just get access: you leave a file of who you are, what you wanted to see, and when. That file belongs to whoever asked for it. The UK's own regulators acknowledge the data risks, and what they recommend is guidance, not prohibition. Yet the barriers are being built anyway.

2. Your data ends up with private companies. Not protected from them. When the UK first tried age verification, the company that stepped up to run the checks was MindGeek (now Aylo): the owner of Pornhub and many of the world's biggest pornography sites. Essentially the industry the law was meant to police would have held the keys. The Open Rights Group found no meaningful oversight to stop it doing whatever it wanted with the data.

3. Every age-verification database is a breach waiting to happen. These databases get hacked. Ashley Madison: 37 million accounts exposed, users outed to their families, blackmail, suicides. Australian Medicare card numbers for sale on the dark web. The UK NHS's patient records in ransomware criminals' hands. Now picture that dataset with your government ID attached to your browsing history.

4. Age verification doesn't stop children. It creates records of adults. Ask any teenager how long an age gate takes to beat. With free VPNs, fake birthdates, older sibling's accounts, it doesn’t take long. The Open Rights Group has confirmed what everyone already knows: age gates don't even work as barriers.

Europeans should be well aware of this. When the EU tried to mandate AI scanning of private messages (called Chat Control), Nym advisor and cyber security expert Bart Preneel and hundreds of Europe's leading cryptographers proved the technology doesn't work: it’s trivially easy to evade, wrong at massive scale, and impossible to fix without breaking encryption for everyone. These systems simply fail as protection. What they do succeed at is data collection, generating permanent records of every adult who bothered to comply.

5. Age-verification laws don't just block pornography. They block suicide prevention guides. Age-gating can't tell the difference between pornography and LGBTQ support hotlines, sexual health resources, or suicide prevention guides. For a queer teenager in a hostile home, the Internet may be the only place they can ask for help. When fewer than 40% of LGBTQ young people find their own home supportive, these walls to community and information are harmful. The Trevor Project's data makes this clear: access to affirming spaces, including online ones, goes hand in hand with lower suicide risk. Age-verification laws put those teenagers at greater risk, not less.

6. You don't have to be watched to be silenced. You just have to know you could be. After Snowden revealed mass NSA surveillance, Wikipedia traffic to surveillance-flagged topics like terrorism dropped, notably among people who'd done nothing wrong. This “chilling effect” means that you don't need to prosecute people to silence them.¹ You just need them to know they're being watched. Age verification builds that knowledge into the Internet itself.

7. “Protecting children” is how censorship gets its foot in the door. Every time. None of this is new. In 1996, the US Communications Decency Act was going to protect children from internet harm. The Supreme Court struck down its censorship provisions for gutting free speech (Reno v. ACLU). Since then, CIPA, the Children's Internet Protection Act, has been used to block LGBTQ resources in public libraries among other things. The UK's Online Safety Act ², passed in 2023, is already age-gating song lyrics on Spotify and social justice movements on social media: content that has nothing to do with protecting children.

8. To make age verification work, they have to destroy the tools that protect journalists and activists. They know this. Age checks only hold if they can't be circumvented. That means banning VPNs. The same block that stops a teenager from accessing a pornography site stops a journalist in a hostile environment from protecting their sources, or an activist to organize without fear of harm. The Freedom of the Press Foundation has documented how fundamental VPN access is for reporters operating under surveillance. Age verification doesn't just affect what sites you visit: it dismantles the privacy infrastructure everyone relies on.

9. There's a way to verify age without building a surveillance database. They're choosing not to use it. Zero-knowledge credentials – based on W3C Verifiable Credentials standards already in commercial deployment – let a trusted authority prove you're over 18 with no name, no document number, nothing that traces back to you. The site learns only that you qualify. No record links you to what you read. There is nothing to breach. This isn't theoretical: Nym builds exactly this technology, zk-nyms, and uses it so that even we can't link a customer's payment to their VPN use. Governments know this technology exists, but they're not using it.

10. An internet that requires identification to access isn't the Internet. It's a gated community.

Tim Berners-Lee, the inventor of the web, declared in 2018 that “the web is under threat.” Age verification at scale is that threat, enacted. A checkpoint, once built, doesn't stay limited to the purpose that justified it. It always expands.

Nym stands against age-verification laws because we're against surveillance. Children matter. But you don't protect them by turning the Internet into an ID checkpoint. You protect them with better tools, better platform design, and better education, not by handing governments and private companies a database of who reads what. The cryptographic alternative exists, yet it's being ignored.

The Internet should remain free and open to all. Privacy protections should be accessible to everyone with tools like NymVPN and others. And we shouldn’t accept regulatory measures that parade mass surveillance tooling as a public safety measure.

References

1. Jon Penney, “Chilling Effects: Online Surveillance and Wikipedia Use.” Berkeley Technology Law Journal, 2016

2. UK’s Online Safety Act