Cory Doctorow used his Pluralistic newsletter on June 23 to attack online age-verification laws, arguing that governments are reaching for a child-safety tool that would require broader surveillance of children and adults alike.
Doctorow’s central claim is blunt: an internet age gate is not a magic bouncer standing outside a website. To decide whether a user is old enough, a service or a third-party verifier has to identify, assess, or monitor that user. In his view, that turns a policy sold as protection from harmful platforms into a mandate for more data collection.
The debate he describes has produced an odd set of allies. Doctorow says some anti-Big Tech campaigners, angry about platform harms, have lined up alongside Heritage Foundation-backed culture-war groups that want to restrict minors’ access to LGBTQ material. He says both camps have converged on minimum-age rules for parts of the internet.
How the proposed fix works
Age verification can mean several things in practice: checking identity documents, estimating age from a face scan, or using other signals to infer whether a person is a minor. Doctorow points to a UK government publication on facial age estimation and ridicules the idea that a phone camera can reliably draw a clean legal line between someone just under 18 and someone just over it.
His objection is mechanical, not decorative. If websites must prove they kept minors out, they need records showing who was checked and how. If that checking follows users across sites, the verification layer becomes a map of online activity. The ad-tech industry already wants persistent identity and cross-site tracking; Doctorow argues age laws could give that infrastructure a statutory glow-up.
Doctorow also warns that workarounds will become the next target. He links to a Daily Express report saying a VPN ban was being considered in the UK under Labour. His point is that if minors use VPNs to dodge age gates, lawmakers may be pushed toward restricting privacy tools rather than reconsidering the gates.
Privacy law gets the side-eye
Doctorow says governments have moved faster on age-checking bills than on privacy rules that would limit the surveillance systems used to target young users in the first place. He notes that the United States has not comprehensively updated consumer privacy law since the 1988 Video Privacy Protection Act, which restricted disclosure of video rental records.
He contrasts that with the European Union’s General Data Protection Regulation, while arguing that enforcement against major tech companies is weakened because many cases run through Ireland, where several large US tech firms have their European headquarters.
The essay broadens from children to surveillance generally. Doctorow argues that the same data used for commercial targeting can affect prices, wages, lending, employment, and housing. He also links to Wired reporting that ICE asked companies about ad-tech and big-data tools, using that as an example of how identity and tracking systems built for one purpose can be repurposed by the state.
The policy conclusion is Doctorow’s: protecting children from online harms should start by limiting surveillance, not by making more of it compulsory. Age verification, in his telling, treats the machinery of platform abuse as the cure. That is a neat trick if you sell the machinery.
This story draws on original reporting from Pluralistic.
