Age-restrictions on the web and user privacy and safety

Web content restrictions and age verification has been in the news recently and the more I read about it, the more states that mandate it, the more conversations I have (e.g., at W3C’s TPAC 2025 a few months ago), the more thoughts I have on the topic of user privacy and user safety on the web. This is among the topics that were at the heart of the October W3C/IAB workshop on Age-Based Restrictions on Content, whose report is being prepared.

This post is neither a W3C statement, nor representative of the Workshop co-organizers. However, it is a topic I care about and I spoke with my colleague Tara Whalen, W3C’s Principal Privacy Specialist and I would like to share informed personal considerations, of which I think there are many, in both the problem and solution spaces.

The workshop approached the fact that regulation is being enacted in many jurisdictions to restrict online content based on age and that this has detrimental effects on technical architectures and users; and attempted to build a shared understanding of the properties of the solutions — focusing on the technical and architectural aspects, without debating the merits and mandates of online age-restrictions.

A few of the unintended consequences that we are collectively grappling with are privacy violations, gatekeeping, fragmentation, data breaches, anonymity violations, and increased phishing risk. It also seems important to caution that in the absence of rigorous testing and mature deployments, it is unsafe to assume that security measures like zero-knowledge proofs can guarantee the minimal disclosure of personal information. In many cases, the issues appear to be more than age-based, they are safety-based, privacy-based.