Age Verification Is the Trojan Horse. Identity Control Is the Prize.

A post from Dyne.org is making the rounds on HN (781 points) with a blunt thesis: age verification mandates aren't about protecting children. They're about converting the open internet into a permission-based system where every user is identified, every session is authenticated, and anonymity is an artifact of a previous era.

The technical trajectory is straightforward. Age verification doesn't stay binary. Once you've built the infrastructure to prove someone is over 13 or 16 or 18, you've built the infrastructure to prove exactly who they are. As one commenter put it: "The end goal is verified user identification. They want every transaction on the internet to be associated with the exact identity of the user. No more anonymity."

Brazil just passed a law requiring age verification for every site categorized as 16+. The UK's Online Safety Act is moving in the same direction. France, Australia, and multiple US states have active proposals or laws on the books. The pattern is global and accelerating.

Here's what makes this particularly insidious for developers: these mandates push enforcement down the stack. You don't get to shrug and say "not my problem" when your SaaS, your API, or your community platform needs to integrate with a government-approved identity verification provider. That's new compliance surface area, new data liability, and new infrastructure costs — all framed as child safety so opposing it is politically radioactive.

There's a cynical but plausible market angle too. As frontier AI models flood the internet with human-sounding content, ad-supported platforms face a Dead Internet Theory problem: advertisers start questioning whether they're paying to reach humans or bots. Universal identity verification solves that problem nicely for the ad industry while governments get the surveillance infrastructure they've always wanted. Both sides win. Users lose.

The counterargument deserves a fair hearing. Some commenters who grew up with unrestricted internet access candidly admit it harmed them. The desire to protect children is real and legitimate. But the policy response — building a universal identity layer into the internet's architecture — is wildly disproportionate to the stated goal. Parental controls, device-level filtering, and school network policies already exist. They're imperfect, but they keep control with families rather than handing it to governments and identity verification companies.

For developers specifically, the action items are concrete: track age verification legislation in your operating jurisdictions, understand that compliance will likely mean integrating third-party identity services (with all the privacy and liability implications that entails), and support organizations like EFF and Access Now that are fighting the most overreaching proposals. The child protection framing makes this harder to oppose than previous surveillance pushes. That's the point.