This is the fork worth fighting for, and it is being missed because the debate is stuck on the wrong axis. Legislators frame the choice as security versus liberty; critics frame it as protection versus privacy. Both accept a false premise that keeping children out of adult spaces requires identifying the adults. It doesn’t. The right choice is between two ways to verify age: one that minimizes data and forgets you the moment you pass, and one that maximizes data and remembers everyone forever. Only the second is surveillance, and only the second is currently the path of least resistance.
The window to insist on the first is now, while those bills are still moving. KIDS Act heads to a skeptical Senate. Chat Control 2.0 aims for political agreement in July. In both cases, the principle that platforms must be able to distinguish adults from children has effectively been established. What hasn’t been decided is whether this ability is built on privacy-protecting evidence or on a mountain of uploaded passports. It’s a technical civil liberties decision, and it’s being made right now, pretty much by default.
There is a greater reason to settle this well, and settle it now. The old sorting of Internet traffic into “bot or human” is already breaking down: a verified third category is on the way, AI agents who act, with authorization, on behalf of people, companies and governments, and will soon have to prove what they are authorized to do without revealing whoever is behind them. “Know your agent” will require the same privacy-preserving architecture we’re discussing now for people. Decide well on the human age control and we set the pattern for everything that follows. Get it wrong, and we embed surveillance into the identity layer of the Internet, for humans and machines alike.
