"Age verification" isn't one technology, it's a design choice, and the privacy risk depends on how that choice gets made: who sees the ID, whether it's linked to the site being visited, and whether a persistent record gets created. CNIL's 2022 analysis found the tradeoffs varied sharply across the six approaches it tested: payment-card checks, facial analysis, offline verification, ID documentation, government tools, and inference (New America).

Some jurisdictions have tried to design around the worst of it. Under France's SREN law, adult sites were required by April 2025 to offer at least one "double-blind" option, structured so no single party could link a user's identity to the site they were accessing (New America, last year). That requirement didn't survive contact with the courts for long: Aylo, Pornhub's parent company, pulled its service from France in protest over the law's privacy implications in mid-2025, and the law was suspended soon after while French courts weighed its compatibility with EU law (New America). The double-blind model is still the right idea; whether France's version of it survives judicial review is a separate, unresolved question.

The European Union is building a more ambitious version into its broader digital-identity framework: a zero-knowledge-proof system that lets a user prove they're over 18 without revealing anything else, with an interim age-verification app running in the meantime. The target for the full system was the end of 2026 (New America). That target is now less than three months away, and nothing so far confirms the system has shipped on schedule.

Lower-exposure architectures exist and are being piloted abroad, in other words. Several U.S. state laws, by contrast, including Mississippi's Walker Montgomery Protecting Children Online Act, Louisiana's Act 440, and Montana's Senate Bill 544, mandate collecting government ID or biometric data directly from users (CDT). That's a legislative choice about where to put the exposure, not an inevitable feature of verifying age.

Granting that architecture matters doesn't make the dominant U.S. approach safe. Direct ID and selfie collection creates a uniquely sensitive, hard-to-remediate data store, and the risk isn't hypothetical. Date of birth, home address, and biometric scans are largely immutable; unlike a password, none of it can be reset once exposed (CDT).

That immutability has already turned into real incidents, not abstract online age verification security risks. Discord disclosed this week that a data breach exposed identity documents users had submitted to appeal incorrect age estimates made by the platform's age-assurance system (CDT). Last year, a separate breach hit a leading age-verification provider, exposing users' names, driver's licenses, and nationality to anyone who found the leaked data (CDT).

Regulatory scrutiny of live providers tells a similar story. An independent evaluation by AI Forensics found that AgeGO, a verification provider used to gate adult content in France, failed to adequately mitigate privacy risks and didn't meet the accuracy and transparency criteria set by ARCOM, France's media regulator (CDT). The lower-exposure alternative described above isn't ready to replace this model yet, which is part of why the riskier version keeps getting deployed despite its flaws.

That combination, immutable data, centralized storage, a documented regulatory failure, and two documented breaches, is the case for guardrails. It doesn't need to be inflated into something worse than what's already on the record.

No system is foolproof, and that alone isn't disqualifying. The sharper question is whether the reduction in access actually achieved is large enough to justify the privacy cost and the adults it locks out along the way.

The Supreme Court itself didn't claim Texas's law would eliminate access; it framed the goal as preventing minors from "easily circumventing" restrictions (CRS). That's a lower bar than it sounds, and it matters because no age-assurance technology has achieved, or is likely to achieve, perfect strongness against circumvention. VPN adoption reliably surges once these mandates take effect, according to a 2026 discussion paper examining age-assurance technologies (arXiv).

Facial age estimation, one of the most common alternatives to document checks, doesn't solve the problem either. Its accuracy varies significantly by algorithm, sex, image quality, and region of birth, and no single algorithm performs best across all of those groups (ETSI, 2024). Document- and credit-card-based checks carry their own exclusion problem: millions of U.S. adults lack a valid government photo ID, and the FDIC's 2021 survey found 28.5 percent of households had no credit card at all (New America).

None of this means verification laws accomplish nothing. It means the right test isn't whether a law stops every minor, because none will. It's whether the deterrence achieved outweighs demonstrated demographic accuracy gaps and the exclusion of adults who can't or won't produce the required credential. On the evidence assembled here, that case remains incomplete.

If lawmakers keep passing these laws, and the post-Paxton legal environment makes that likely, there's already a concrete standard for what responsible implementation looks like. Sorting the alternatives by how much they expose clarifies the real choice on the table.

Site-side ID or biometric collection, the model several state laws currently require, is the highest-exposure option: it directly ties a person's identity to the site they visited (CDT). Third-party tokenized or double-blind attestation, the model France attempted under SREN and the one the EU is building toward, proves age without exposing identity to the site itself. But every privacy-preserving age verification system built on zero-knowledge proofs remains in proof-of-concept or beta, with nothing deployed commercially at scale as of last year's reporting (New America).

Device-side age-range signaling, the approach Apple and Google are building through tools like Apple's Declared Age Range API, sidesteps the problem differently: it can reduce or eliminate service-side ID collection, since the device itself vouches for an age range instead of handing over documents (CDT). The tradeoff is concentration, not exposure: it hands Apple and Google more control over who gets to verify what, a cost the arXiv researchers flag explicitly against the privacy gains (arXiv).

CDT has proposed a baseline test for any of these approaches: proportional and narrowly tailored, built on accurate and nondiscriminatory data, private and secure with limited retention, transparent, and accountable. Laws like Mississippi's, Louisiana's, and Montana's, which mandate direct document collection without comparable data-minimization language, don't clearly meet that test. What's needed isn't "verify less." It's verifying through the least exposed architecture available, and writing data-minimization rules into the statute itself rather than leaving them to whichever vendor wins the contract.

Paxton substantially lowered the constitutional barrier to age-verification mandates for adult content. It did not resolve every question about how those mandates get implemented, or foreclose challenges to statutes built differently than Texas's. States will keep writing these laws, and more will probably follow Texas's model now that the Supreme Court has blessed it.

The open question is whether those laws, and the broader social-media age-assurance rules increasingly modeled on them, require the architecture and data-minimization standards that already exist on paper: in CDT's criteria, in the EU's zero-knowledge-proof framework, in France's now-suspended double-blind requirement. Privacy-preserving age verification is closer than it was two years ago, but it isn't proven at scale yet, and the breaches already on the record suggest the cost of waiting falls on exactly the users these laws claim to protect. Whether lawmakers write the safeguards in now, or wait for the technology to force their hand, is the test worth watching over the next legislative cycle.