Age verification on the internet, child protection and the strain on privacy

In the contemporary digital debate there are few causes as unquestionable as the protection of children and adolescents on the internet. However, beneath this noble goal lies one of the most complex tensions in today's digital ecosystem: how to advance the protection of minors without compromising the privacy of individuals?

Online age verification has positioned itself as the solution of choice for legislators and platforms. Countries in different parts of the world are moving forward with regulations that seek to prevent minors from accessing certain content or even entire social networks. The problem is that, in practice, these measures transfer the cost of child protection to all citizens, as all adults who use these platforms are subjected to a massive collection of biometric data, identity documents and browsing habits.

The paradox of protecting by policing

The objective of these measures is legitimate, precisely to prevent minors from being exposed to content that may be inappropriate, harmful or harmful digital dynamics, but there are deeply intrusive mechanisms.

To verify age, platforms are resorting to methods that include:

• ID document scanning
• Facial recognition
• Biometric analysis
• Digital behaviour monitoring

This means that millions of users, mostly adults, have to hand over extremely sensitive data just to access basic internet services. The question is unavoidable: why should someone upload their identity card or an image, which, when processed by recognition systems, could become a biometric data, to view online content?

Imperfect systems in the face of real risks

More worryingly, these systems are not only intrusive, but also ineffective. Experts have warned that current solutions can be easily circumvented by VPNs, borrowed accounts or artificial intelligence tools. In other words, minors, through different tools, can still access content, while ordinary users are exposed.

Worse still, these mechanisms create new risk surfaces as systems designed to protect minors can end up breaching their own security by exposing data of minors (who are trying to log in) and thousands of adults who are legitimately logging in.

Sensitive data in the wrong hands?

From a data protection perspective, the use of biometrics and official documents to verify age raises serious issues of proportionality. This is not just any information, but sensitive data whose processing requires the highest standards of security and lawfulness, which is apparently not being met.

The accumulation of this data by private platforms (often without full transparency about its use) opens the door to structural risks:

• Massive leaks
• secondary use of data (profiling, surveillance)
• International transfers, without any effective control
• Creation of permanent digital identification infrastructures

In simple terms, we are building an architecture where anonymity could disappear.

Is this tension inevitable?

Not necessarily. Europe's own regulatory development offers a relevant clue, as not all protection requires identification. Models based on "anonymous tokens" or verifiable credentials allow proof of age without revealing identity. Likewise, initiatives such as digital identity wallets seek to reconcile security and privacy.

The key legal principle is data minimisation. If the objective is to know if someone is of legal age, it is not necessary to know who that person is.

A warning for Chile

Chile is in the process of modernising its personal data protection framework, so this debate is very relevant to our reality.

Protecting minors on the internet is an ethical and legal obligation, but doing so at the expense of the privacy of the entire population is not only disproportionate: it is counterproductive.

Do we want a safer internet or a more policed internet? The answer lies in the design, not the intention.