Britain's Online Safety Act has become a cautionary tale in regulatory overreach. By requiring age verification for any website that could potentially host harmful content—from pornography to discussions of self-harm, bullying, or substance abuse—the UK government has created a system so vague that websites have simply chosen to geofence their entire services to British users rather than navigate it. The result: ProtonVPN saw an 1,800% spike in UK downloads in the week after the law took effect.
The technical problem masks a deeper one. Age verification requires identification, and identification creates profiles. Whether handled by private companies or the state, each approach carries distinct risks. A private third party collecting data across multiple platforms could eventually construct what Mark Zuckerberg never achieved—a unified profile of someone's entire internet behavior. A government-run system invokes the classic surveillance state concern: the ability to track and cross-reference everything someone does online against their real-world identity across health, tax, and social services databases.
The European Union is exploring a more elegant solution: a browser-level digital ID, akin to a driving license for the internet, that sits on the device itself rather than with any intermediary. You authenticate once, and the browser silently verifies your age to websites without exposing your identity. Yet even this doesn't resolve the fundamental tension: should a teenager accessing a subreddit about quitting smoking be identifying themselves at all, given the legitimate reasons someone might want anonymity online—seeking domestic abuse resources, for instance?
The UK's approach reveals how age-gating doesn't scale gracefully to an open internet. Tobacco and alcohol require verification at point of sale. The web has no registers. What emerges instead is either mass blocking (websites defaulting to exclusion), privacy erosion (third-party verification ecosystems), or mass evasion (VPN adoption). The real debate isn't whether age verification is necessary—it probably is—but where the verification happens and who controls the data. A public digital credential, auditable and transparent, beats private profiling. But it still requires accepting that parts of the internet will no longer be anonymous.