Kids Act: EU to verify your age and eID closes the circle

Kids Act: Brussels forces age verification and eID closes the circle

The European Commission presented a couple of days ago the so-called Kids Act, a proposal that bans social media for under-13s and requires young people between 13 and 15 to use supervised "mini-accounts". For the system to work, platforms will be legally required to verify the age of all their users. And there, right there, the rule stops being a law about children.

The problem is not the stated goal, but the mechanism. Verifying the age of absolutely all users requires an identification system that does not exist today on social media. The proposal also appears in parallel with the rollout of the European digital wallet, a single repository where citizens' identity data would be stored. Two pieces that fit suspiciously well together.

What exactly the Kids Act prohibits

The text sets three tiers. Under-13s are directly excluded from social media. Between 13 and 15, a limited account under adult supervision is enabled. From there on, a full account, but always with age verified to the platform.

The practical consequence is that no user, whatever their age, would browse without identifying themselves beforehand. Age verification becomes the gateway to the internet, not a one-off check for specific content.

Technology already allowed age verification without giving data

There is a cryptographic mechanism, known as zero-knowledge proofs (ZKP), with which one can prove that someone is of legal age without revealing any other data: no name, no date of birth, no document. It verifies the condition, not the identity.

The most repeated criticism is that the Commission has not gone that way. The circulating argument is that ZKPs solved the technical problem years ago, but the proposal does not include them because the real goal was never just the user's age. Child protection would serve as an alibi, not as an end.

The five phases that anticipate the slide

A widely repeated analysis describes the typical sequence of these rules: first, proof of legal age is required; then it is argued that records must be kept to prevent fraud; next, the need to identify the holder to prosecute crimes is added; later comes interoperability between services; and finally, the obligation to respond to judicial requests. Each exception seems reasonable on its own. The final result is a system different from the one that was sold.

What is eID and why is it mixed with age verification

The eID is the European digital identity, a wallet where personal identification data is centralized. Its rollout coincides in time with the requirement to verify users on social networks. If you have to prove who you are on each platform and there is a single repository of identities, the connection is immediate.

Added to this is the political climate. In Germany, Chancellor Friedrich Merz announced his intention to "massively" restrict social media with a phrase that has been quoted ad nauseam: that no one come to him with freedom of speech. The framework, according to various analyses, points to a model of digital control closer to the one already operating in China than to the traditional European one.

From controlling minors to controlling everyone

The obvious objection is circumvention. A VPN or the Tor network allow bypassing geolocation and a good part of the verifications, and it is taken for granted that young people will find the loophole, among other things because any public control system will be botched by definition. The counterargument is that the rule doesn't need to be perfect: it's enough that it rearranges who can speak and how.

It remains to be seen whether the proposal is approved as is, whether ZKPs enter the final text or whether eID ends up being the only gateway. What if the right question is not how to protect minors, but who decides from now on who is who on the internet?