On 22 May 2026,
@AztecLabs_ submitted a response to the UK government's consultation on children's online safety.
I'll be direct about where we stand. We are sceptical of mandatory age verification. The evidence that it works is mixed, and the surveillance infrastructure built in the name of child safety rarely stays narrowly scoped. We said so plainly in the submission.
But the consultation is happening, and if the government proceeds, the detail that matters most is how these systems are actually built.
Every method deployed today related to online age verification either gets bypassed easily or forces users to hand a document scan to a third-party server, which creates centralised databases of sensitive personal data. Those databases get breached often and easily, creating personal and national security risks. This is the predictable result of collecting far more than the question requires.
So our submission, among other things, asks the government for three things:
1. make privacy by design a hard requirement rather than an aspiration;
2. recognise device-level proofs within the existing trust framework; and
3. do not restrict VPNs, which serve real privacy and security purposes.
The UK can set the global standard for how this is done, or it can attach a breachable identity database to every platform its citizens use. I think the choice is clear.
Governments are moving to mandate online age verification
We think this is the wrong decision, and we said so in our response to the United Kingdom's consultation
But if these mandates proceed, the way these systems are built will have consequences far beyond child safety
👇