EU Kids Act Proposes Mandatory Age Verification for All Users

Von der Leyen proposes the Kids Act: EU-wide age verification

Banning social media for children under 13 is an easy sell. The challenge lies in the implementation: to identify who hasn't turned thirteen, platforms must first verify who you are. This catch has triggered alarms since Ursula von der Leyen introduced the so-called Kids Act, a European proposal circulating with a summary that is as simple as it is uncomfortable: goodbye to anonymity as we knew it.

According to detailed analyses of the text, the proposal does three things simultaneously. It bans social media for minors under 13. It requires those aged 13 to 15 to have only supervised mini-accounts. And above all, it mandates that platforms verify the age of all their users, regardless of how old they are.

What is the European Digital Wallet and why is it linked to the Kids Act?

This is the crux of the matter. Age verification doesn't exist in a vacuum; it requires an identity to check against. In Brussels, this identity has a name: the European Digital Wallet, a single repository where passports, national ID cards, driver's licenses, addresses, and even purchase history would be stored. With this tool on the table, any comment on a website, opinion on a forum, or entry into a chat would require prior validation of your real identity.

It is worth noting that this isn't entirely new: as one participant pointed out, a similar mechanism was applied across the Atlantic ten years ago. What is new is not the method, but the scope: it is no longer limited to a specific sector, but applies to the gateway to the internet itself.

Zero-Knowledge Proofs: The technical solution nobody wants

Cryptographically, there is a clean alternative. It is called ZKP (Zero-Knowledge Proof), which allows proving that you meet a condition—such as being an adult—without revealing any other data. In other words, the system could know you are an adult without knowing who you are. This is exactly what is needed to verify age without creating a census.

However, this approach appears briefly in discussions before fading away, which is telling. Some argue that protecting children is merely the official excuse and the real goal is different: building the registry. A solution that solves the problem without constructing a database of identities holds little interest for those designing the regulation to build such a database.

Merz and "Free Speech": What is already being said openly

The sense that the wind is blowing in one direction is reinforced by developments from Germany. According to messages shared in forums, Merz announced his intention to heavily restrict social media with a phrase that leaves little room for interpretation: "Don't come at me about freedom of speech!", coupled with the idea that citizens must still be protected from misinformation.

The implication is direct: whoever decides what constitutes misinformation decides what can be said. And whoever designs the identity verification system decides who can speak and under what conditions.

Can the rules be bypassed with a VPN or Tor?

Here the conversation turns technical, and optimism quickly fades. The first shortcut suggested is the classic one: if the rule is European, use a VPN or Tor and move on. If you just need to cross a digital border, you do.

The counterargument raised is that the law applies not to servers, but to European users: it is their IP addresses that remain within the perimeter. The burden falls on the individual, who would have to use proxies, falsify data, and declare a location that isn't theirs just to read and comment. It is useless for a website to migrate to a server outside the EU if the person typing from home is the one flagged.

From soft verification to mandatory digital certificates

The scenario drawn next is the truly worrying one. Some claim the system has been designed intentionally hastily and poorly so that it fails in practice. That failure would then serve as the perfect pretext to raise the bar: instead of asking each platform for age proof, a digital certificate would be required from the user at the moment of connecting to the internet. The pandemic health passport, which was well-implemented, is cited as a model. No certificate, no connection.

Those leaving: Alternatives, games, and escape valves

In parallel, the conversation shifted to tools. Anonymous network alternatives were reviewed—the old Freenet, now rebranded as Hyphanet after its split, stable but slow and heavy; and a still immature Freenet 2023—with the warning that migrating solves nothing if the problem is at your front door. Another possibility mentioned is a rarely discussed side effect: if regulations tighten, even private game servers like Minecraft or Warcraft could face restrictions.

The uncomfortable question remains, one that no one fully answers. If a significant function of the internet was to channel collective anger without anyone breaking anything, closing that valve has consequences no one has calculated. Less porn, fewer forums, more accumulated resentment. And a fundamental doubt: if the real goal were to protect minors, why does the design require identifying adults?