Age Verification Policies Risk Breaching Privacy, Claims Billions CEO

On June 29, 2026, significant internet legislation progressed in both the U.S. and the EU. The House of Representatives passed the Kids Internet and Digital Safety Act, while negotiations on the EU's Chat Control 2.0 reached their final trilogue. Critics have noted that these bills retreated from more invasive proposals but retained mandatory age verification measures.

Evin McMullen, in his commentary, emphasizes that age verification reshapes the internet experience not just for children but for adults as well. While civil liberties groups celebrate the withdrawal of certain provisions, they overlook how age verification fundamentally alters user privacy.

McMullen highlights the inherent flaws in the current approach to age verification, which he claims equates verifying age with collecting users' identities. This leads to the creation of large databases containing sensitive personal information, increasing risks of data breaches and expanding the surveillance landscape.

He points out the example of the UK's Online Safety Act, where age verification measures have already begun to infringe on user privacy. McMullen warns that the discussions around these laws fail to differentiate between age verification and identity collection, often resulting in excessive data retention practices that can compromise user security.

Moreover, McMullen suggests that an alternative, privacy-preserving method exists—using zero-knowledge proofs to verify age without collecting personal data. This approach could fulfill the legislative intent without compromising user anonymity. He laments that legislators focus solely on the outcome of age verification without considering the implications of how that outcome is achieved.

As these legislative processes continue, McMullen urges a critical examination of the age verification frameworks being endorsed. He stresses the importance of deciding on privacy-focused verification methodologies before these laws are enacted, which will set a precedential architecture for future digital interactions—not only for humans but also for AI agents requiring similar verification standards.

Thus, the current legislative trajectory raises substantial concerns for privacy advocates. McMullen warns against normalizing the notion that child protection necessitates the identification of all users, underscoring the potential for establishing an identity surveillance infrastructure under the guise of safety. Such outcomes, he argues, would not only undermine civil liberties but also disadvantage marginalized groups who rely on anonymity for protection from repression.