Protecting children online also means protecting the information we are asked to share.
An age limit sounds simple: children below a certain age cannot enter. Online, someone has to determine who belongs on which side of that line.
On 8 September 2026, Reuters reported that Emmanuel Macron had urged the European Commission to support an EU-wide social-media ban for children under 15. This was a proposal, not an EU-wide ban already in force. Reuters reporting.
Protecting children makes sense. But if platforms must keep younger users out, adults may also need to prove they meet the age requirement. That does not necessarily mean uploading a passport; it depends on how the rules and systems are designed.
Still, what are we being asked to give away in return for access?
These questions echo themes we explored at WHY2025, where I was invited to take part in a political debate alongside fellow experts, including Ron Roozendaal, Bert Hubert and Brenno de Winter. Together, we discussed cybersecurity, AI, privacy and the choices shaping our digital future. You can watch the recording of Het Grote Cyber Debat.
Proving your age does not have to mean revealing your identity to every website. Think of a cinema checking whether you are old enough for a film. It needs an answer to an age question. It does not need to keep a photocopy of your passport.
A digital system can work similarly: a trusted organisation checks your age and provides a secure proof. The website receives confirmation that you meet its age threshold, without receiving your name or birthday.
The European Commission’s age-verification solution follows this principle. Its documentation describes an app that retains an age confirmation rather than identity details, with checks designed to prevent your separate visits being linked through verification. European Commission explanation.
That is encouraging, but the actual service still needs independent testing. What does it collect during the initial check? What appears in its logs? Are uploaded documents deleted? A good design cannot compensate for a supplier quietly keeping unnecessary copies.
The “master key” concern is about concentrating too much information and power in one place.
Age verification does not inherently require one government database containing everyone’s ID. But a poorly designed provider serving many websites could collect identity documents, face images and account links in one valuable store. A breach could then expose far more than people’s ages.
Other failures matter too. A stolen signing key—the digital equivalent of an official stamp—might allow someone to forge proofs. That is different from stealing ID scans, but both require protection.
The danger is a system where one failure affects too many people. You can change a password; you cannot change your date of birth.
What someone can connect that stolen information to makes the problem larger.
Our personal details already have a market. Data brokers collect information from different sources, combine it and sell access to it. Companies can buy information about people’s contact details, purchases and interests to help target advertising. The US Federal Trade Commission has documented these practices. FTC report.
Location data can be traded too. In its December 2024 case against Mobilewalla, the FTC alleged that the company sold sensitive location information that could reveal people’s homes and visits to health clinics. FTC’s Mobilewalla case.
Think of your information as a scattered jigsaw puzzle. One piece shows where you work. Another contains your email address. Others suggest your interests or routine. Together, they can reveal much more than you intended to share.
AI can help sort, cross-reference and summarise information someone has obtained. The UK’s National Cyber Security Centre assesses that attackers are already using AI to research victims, process stolen data and support scams. NCSC assessment.
For a company, a profile can help target a marketing campaign. For a criminal, matching details could make a fraudulent message feel familiar: it mentions your real employer or a service you use.
That makes a profile useful, even when it is incomplete. It does not automatically unlock your accounts, and AI can connect the wrong people or invent details. But a few accurate pieces can make deception more convincing.
If verification information is leaked or repurposed, could it help connect parts of our lives that were previously separate?
European privacy regulators have recognised this concern. The European Data Protection Board says age assurance should avoid creating additional opportunities to identify, profile or track people. EDPB statement.
Those principles need to survive implementation. I want safeguards against verification information being resold, added to advertising databases or used for unrelated AI training. Proving my age should never become permission to build a more profitable profile of me.
AI also complicates the check itself. Fake documents and generated video can support impersonation, risks explicitly addressed in NIST’s digital-identity guidance. NIST guidance.
That creates an uncomfortable cycle: fraud encourages providers to collect more information, while collecting more increases what a breach could expose. Every extra requirement should have a demonstrated purpose.
Responsibility must be clear before something goes wrong. Under the GDPR, the organisation deciding why and how personal data is used is generally the controller. A supplier handling it on that organisation’s behalf is a processor. Both have responsibilities; outsourcing does not remove the controller’s accountability. EDPB explanation.
In ordinary language: who receives my documents, who can access them, when are they deleted, and who helps me if they are stolen?
The answer also needs to consider how long that information remains sensitive.
Quantum computing adds a future risk, but it is not a universal unlock key. A sufficiently powerful future quantum computer could break some widely used cryptography, including RSA and elliptic-curve methods used to secure connections and sign digital credentials. There is no reliable date for such a machine. NIST’s technical explanation.
The concern called harvest now, decrypt later is real. Imagine someone copying a locked box today because they expect to obtain tools capable of opening that particular lock later. Attackers can capture encrypted information and keep it for a future attempt. Identity information may still be valuable years afterwards. NIST explanation.
This does not mean everything uploaded before quantum computers mature will become easily readable. Properly used AES-256, for example, is expected to remain strong against known quantum attacks. The whole setup matters, including how its keys are exchanged and protected. NIST encryption FAQ.
Replacing a vulnerable lock later does not change a copy an attacker already took. Organisations should therefore prepare now. NIST finalised its first post-quantum standards in 2024, and these protections can run on ordinary computers. NIST’s migration explanation.
Meanwhile, the young people behind the gate still matter. Social platforms can hold friendships, fandoms, creative communities and support that someone struggles to find elsewhere. Exclusion also affects legitimate users when they lack suitable documents or a system gets their age wrong. Accessible alternatives and ways to challenge errors are among the EDPB’s principles. EDPB age-assurance statement.
An age check also leaves the platform’s own design to address: safer defaults, effective reporting, limits on unwanted contact and fewer incentives to keep people scrolling.
I want children to be safer online. I also want them to grow into an internet where belonging does not require surrendering an increasingly detailed account of their lives.
Before asking us to prove our age, the organisations operating the gate should demonstrate how they will protect the people passing through it.