The privacy paradox of protecting kids online

In 2024, identity verification provider AU10TIX, which provided services to companies like TikTok and Uber, was found to have exposed drivers' licenses to hackers for over a year. In 2025, the age-verification systems provider for the social media site Discord was breached, exposing potentially 70,000 users' government IDs. In 2026, the lesson should already be clear that once age verification depends on vendors and stored identity data, a safety system can become a breach vector.

And the rise of AI is only accelerating these risks, making hacks faster and the resulting damage easier to inflict.

This is the backdrop against which the U.S. House passed the Kids Internet and Digital Safety (KIDS) Act on June 29th, a sprawling package built around the Kids Online Safety Act (KOSA), 267-117. The bill now sits in the Senate, where KOSA's own authors, Democrat Richard Blumenthal and Republican Marsha Blackburn, resoundingly rejected the House version and are pushing a tougher one, in part by tying it to federal preemption of state AI laws. A Senate Commerce Committee markup is expected this month. Whatever emerges from that process will shape how identity works online for years.

The intent is to protect minors. The risk is that the mechanism protecting them requires building a much larger surveillance apparatus than anyone campaigning for it admits.

KIDS doesn't mandate age verification outright, because it doesn't have to. Making platforms liable for harm to minors who access their services gives companies a simple risk calculus. Either you verify age, or accept the legal exposure of not knowing who's a minor. Liability without a verification mandate still produces verification. That's the mechanism, and it's worth naming explicitly, because "there's no explicit age check in the bill" is a technically true defense that misses how the incentive actually works in practice.

Once disclosure becomes the price of access, the information dragnet tends to expand. A tool built to confirm someone is old enough becomes a tool that confirms who they are, and a database built to prevent liability becomes just a liability -- one more repository of identification data waiting for the next AU10TIX-style breach.

But if a platform only needs to know that a user is old enough, it should not require a full identity file or other data it may use as a proxy for age. If a service only needs to reduce exposure to harmful content, there is no need to build a database that can later be repurposed. These distinctions, however small, matter.

In Utah, which passed State-Endorsed Digital Identity (SEDI) legislation, Cardano Foundation-built Veridian has already shown that digital identity can be delivered in a privacy-preserving way, allowing users to prove that they are over or under a specific age without exposing any other data. It's a working model of what responsible verification can look like and shows trust does not require unnecessary disclosure. Privacy can be designed into the system from the start.

That is the standard bills like KIDS or KOSA should favor.

If the goal is to protect children, the tools should be narrow, purposeful, and minimally invasive. Broad mandates that push every platform toward more data, more retention, and greater dependence on identity are too blunt and risk creating a multitude of other problems alongside the ones they claim to solve.

A better approach is straightforward. Build for data minimization, limit retention, and use privacy-preserving verification where verification is truly needed. If digital trust can be established without exposing personal data, lawmakers should prefer that path. If safety can be improved without turning the internet into an identity checkpoint, that should be the only option.

Children deserve protection online. But they do not need a policy framework that makes everyone more visible in order to make the internet, and the companies that thrive on it, more accountable.

The right standard is simpler: protect minors, limit data, preserve privacy, and build trust without unnecessary disclosure.

That should be the test for KIDS, because you can build safety without surveillance.

This content is provided for general informational purposes only and doesn't constitute financial, investment, legal, or tax advice. Any events, rewards, online promotions, or related information mentioned herein should not be considered a recommendation, solicitation, or invitation to purchase, sell, trade, or otherwise deal in any crypto assets. Crypto assets are highly volatile and may result in loss. The availability of WEEX services, products, and related events may vary by region. You are responsible for ensuring that your participation is in accordance with applicable local laws and regulations.