Skip to content
Kallima - Home
en Languages
Menu

Awareness 4 min read

Age verification: our ID documents are already leaking

Protecting children online is a goal everyone shares. The solution many governments have chosen is far less consensual: force sites and apps to verify their users’ age, often by asking them to photograph an ID document or their face. In 2025 and 2026, these laws multiplied. So did the leaks.

A wave of laws

  • United Kingdom: since July 25, 2025, the Online Safety Act requires age checks to access a wide range of content. Within hours, Proton VPN sign-ups jumped by 1,400%.
  • Australia: since December 10, 2025, people under 16 are no longer allowed accounts on major social networks, including Facebook, Instagram, TikTok and YouTube. About 4.7 million accounts were removed or restricted.
  • United States: in June 2025, the Supreme Court upheld a Texas law requiring adult sites to verify age. According to the EFF, about half of US states now require age verification for adult content or social media.
  • European Union: in April 2026, the Commission urged member states to roll out an age verification app by the end of the year.
  • France: since a law of May 2024, the regulator Arcom can fine and block pornographic sites that let minors in. In June 2025, the owner of Pornhub chose to suspend its sites in the country, even for adults.
  • Brazil: since March 17, 2026, the ECA Digital requires services likely to be used by minors, such as social networks, video games and streaming platforms, to use reliable age verification. Simply declaring your age is no longer enough.
  • And beyond: other countries are following, such as Canada, where Bill S-209 has passed the Senate.

And the leaks keep coming

  • Tea, July 2025: this dating safety app for women required a selfie, and sometimes an ID, to verify its users. About 13,000 of those images leaked, among 72,000 exposed photos.
  • Discord, October 2025: government ID photos of about 70,000 people were exposed at a customer service contractor. These people had sent them to appeal the age the platform had assigned them.
  • IDScan.net, September 2026: journalist Brian Krebs revealed that an underground service claims to sell more than 153 million American and Canadian driver’s licences. The scans came from places such as car rental counters and cannabis stores. The company confirmed that an unauthorized party may have accessed customer data. The FBI and Canada’s Privacy Commissioner are investigating.

Why it is a setback

Every check creates a database. The more people are forced to show their papers, the more ID documents contractors accumulate, and the more reason criminals have to target them. Unlike a password, you cannot change your face, and replacing a licence does not stop fraud with the one that leaked.

It is the end of online anonymity. To read, watch or talk, you would have to prove who you are. The people who need anonymity most suffer most: survivors of violence, LGBTQ+ youth looking for information in secret, whistleblowers, activists.

And it is easy to get around. The surge in VPN sign-ups in the UK shows it. The rules weigh on those who follow them, and governments’ next step is often to go after VPNs.

Less intrusive solutions?

The European app relies on zero-knowledge proofs: the site only learns that you are over 18, without learning who you are. That is better, but not perfect. It requires a smartphone and an official ID, which leaves people out. It depends on Google and Apple services. And it normalizes the idea of proving something about yourself at every click.

What you can do

  • Before uploading an ID, ask yourself whether it is really necessary. If you are offered an age estimate done directly on your device, choose that instead.
  • Use the rights your local law gives you. In the EU and the UK, the GDPR lets you ask a company to delete your data, and many countries have similar rules. If it refuses, complain to your data protection authority.
  • If your ID has been scanned or uploaded somewhere, keep an eye on your bank accounts and credit file, and be wary of messages that seem to know you a little too well.
  • Write to your elected representatives and ask that any age verification protect anonymity first and retain no data, and support groups such as the EFF, EDRi or Open Rights Group.

Sources