The KIDS Act would force age verification on every U.S. website

What happened

The Kids Online Safety and Privacy Act — the KIDS Act — landed in the Senate this month, and the Electronic Frontier Foundation just published a long-form objection that hit 390 points on Hacker News. The bill's mechanism is simple and, EFF argues, catastrophic: any 'covered platform' that 'reasonably could be accessed by a minor' must verify the age of every user before serving content. That language sweeps in essentially every general-purpose website on the open web — not just social networks, not just adult sites, not just gaming platforms. A Substack. A subreddit. A weather page. A developer's personal blog with a comments section.

EFF's core legal argument is that the Supreme Court already settled this in NetChoice v. Bonta (2025), which struck down California's Age-Appropriate Design Code on the grounds that forcing platforms to identify users burdens the First Amendment rights of adults to speak and read anonymously. The KIDS Act, EFF writes, is 'the same constitutional problem dressed in federal clothing.' The bill doesn't specify *how* sites must verify age — that's left to a future FTC rulemaking — but the menu of available options is narrow: government-ID upload, credit-card check, biometric face scan, or a third-party 'age estimation' service like Yoti or Incode. All four create a chokepoint where every reader of every site has to identify themselves to someone.

The political coalition behind the bill is unusual. The lead sponsors are Senators Blackburn (R-TN) and Blumenthal (D-CT), and the bill has picked up endorsements from both the Heritage Foundation and Common Sense Media — a left-right child-safety alliance that has been steadily building since KOSA stalled in 2024. The opposition is also cross-ideological: EFF, ACLU, FIRE, Chamber of Progress, and — quietly — most of the platform engineering community.

Why it matters

The technical question isn't whether age verification *works* — it doesn't, reliably — but what it costs the architecture of the open web to deploy it everywhere. Every age-verification scheme on the market today is some combination of expensive ($0.10–$0.50 per check), invasive (government ID, face scan), or trivially bypassable (VPN, borrowed credit card) — and most are all three. The compliance burden falls hardest on exactly the sites that make the web worth reading: independent blogs, hobbyist forums, small Mastodon instances, niche wikis. A Substack writer with 4,000 readers cannot integrate Yoti. They will simply geo-block the U.S., the way roughly a dozen adult sites geo-blocked France after the 2024 ARCOM law took effect.

The France precedent is the part American observers keep missing. France passed a similar verification mandate in 2024; rather than implement face-scan gates, Pornhub, YouPorn, and Redtube simply withdrew from the French market entirely — and French VPN sign-ups spiked 1,000% in a week, per Proton's published numbers. The actual effect of the law was not 'fewer French minors viewing porn' but 'every French adult now routes their traffic through a Swiss VPN.' The KIDS Act, applied to the general web rather than just adult content, would produce the same dynamic at vastly larger scale — and the VPN-traffic shift would punch a hole in every advertising, analytics, and fraud-detection system that relies on accurate geolocation.

There's also a quieter platform-power story. Mandatory age verification is the single largest competitive moat Big Tech could ask for: Meta, Google, and Apple already have verified identity for billions of users via their existing account systems; a Substack writer or a four-person SaaS does not. The bill would effectively ratify a world where the only sites that can afford to operate in the U.S. are the ones that have already centralized identity. EFF doesn't say this out loud, but the policy logic points there: KOSA-style bills aren't anti-platform, they're anti-everyone-else.

The HN thread is worth reading for the developer-side reactions. The top-voted comment notes that the bill's 'reasonably could be accessed by a minor' standard has no functional limit — minors can access *anything* — and that the only defensible engineering response is to age-gate every page or geo-block the country. The second-most-upvoted comment points out that the FTC rulemaking phase is where the real fight happens: the statute is vague enough that the implementation rules will determine whether this is 'upload your driver's license to read a blog' or 'click a checkbox claiming you're 18.' History suggests the former.

What this means for your stack

If you ship anything consumer-facing in the U.S., start thinking about an age-gate layer the way you currently think about a cookie banner — annoying, jurisdiction-driven, and probably inevitable within 18 months regardless of whether *this specific* bill passes. The architecture pattern is already standardizing: a third-party verification provider (Yoti, Incode, Persona, Stripe Identity) returns a signed JWT asserting 'over 18,' your edge function caches it in a first-party cookie, and unverified traffic gets a paywall-style interstitial. Budget $0.10–$0.30 per new visitor for the verification call, plus integration time, plus the conversion-rate hit — which the few sites that have A/B-tested it report at 40–60%.

The defensive move, if you run a small site, is to start logging the percentage of your U.S. traffic that comes from likely-minor sources (school IP ranges, certain referrer patterns) and the cost-per-acquisition delta you'd absorb under a compliance regime — because that's the number that determines whether you keep the U.S. market or geo-block it. Larger platforms should be auditing whether their existing account systems can produce a verified-age claim without a re-onboarding flow; the ones that can will eat the ones that can't.

The sleeper risk is the data-retention question. None of the age-verification vendors have a clean answer for what they do with the ID scans and biometric templates they collect. The 2023 Australian eSafety pilot of age-assurance vendors found that four of the seven providers retained biometric data beyond the verification event, and two had no published deletion SLA. A breach of an age-verification provider — and there will be one — exposes a database of government IDs tied to the specific sites each person tried to visit. That is a worse privacy event than any single platform breach in the last decade.

Looking ahead

The KIDS Act will probably not pass this Congress, but the structural pressure behind it — bipartisan child-safety politics, a Supreme Court that hasn't yet ruled on a *federal* age-mandate, and a platform industry that has stopped fighting because the verification rails benefit them — means some version of it will. The realistic forecast is not 'will the open web have to verify ages' but 'how much of the open web will simply leave the U.S. market rather than try.' Watch the FTC rulemaking, watch the next round of state-level copycats (Texas, Florida, and Utah all have analogs queued for 2027 sessions), and watch which third-party verification vendor consolidates the market — because that company will end up sitting between every American and every website they read.