A bipartisan deal in Congress designed to protect children online carries a surveillance capability that legal experts and press freedom advocates say could fundamentally undermine anonymous speech, investigative journalism, and the protection of confidential sources. The KIDS Act — framed as a child safety measure — would, in practice, require broad age verification across major internet platforms, and there is, as one attorney has noted, no way to verify someone’s age without also verifying who they are.

What the KIDS Act Actually Does

According to reporting by The Intercept, co-authored by Caitlin Vogus, a senior adviser to the Freedom of the Press Foundation and First Amendment attorney, and Aliya Bhatia, a senior policy analyst with the Center for Democracy & Technology’s Free Expression Project, the KIDS Act at minimum strongly incentivizes — and for some services outright requires — age verification across social media platforms and video-sharing services.

Platforms like X and video-sharing services like Vimeo, which host content that could be categorized as “sexual material harmful to minors” — a term the bill defines broadly — may be legally required to verify users’ ages. The practical consequence is that any platform implementing age verification must collect identity information from all users, not just minors.

The legislation could come to a House floor vote as soon as the week of its reporting, and both Democratic and Republican sponsors have presented it as a straightforward child safety measure. But the downstream effects on adult anonymity are anything but straightforward.

The Surveillance Architecture Hidden in Child Safety Language

The Center for Democracy & Technology has documented the core problem with age verification as a technical and legal matter: requiring users to prove their age to access content or services leads to more data collection and retention by already data-rich services. Users who are forced to hand over identity information lose the ability to access the web anonymously. People go online to access and speak about sensitive topics — health status, sexuality, religious or political views, experiences with domestic violence, and whistleblowing. Age verification eliminates the privacy cover that makes those disclosures possible.

The Electronic Frontier Foundation has catalogued additional structural harms. Document-based verification assumes everyone has government-issued ID in the correct name and at the correct address. Approximately 15 million adult U.S. citizens do not have a driver’s license, and 2.6 million lack any government-issued photo ID. Another 34.5 million adults do not have a driver’s license or state ID with their current name and address. The EFF notes that 18 percent of Black adults lack a driver’s license, and that Black and Hispanic Americans are disproportionately less likely to have current licenses. Undocumented immigrants, people with disabilities, and lower-income Americans all face elevated barriers to maintaining valid ID — meaning age verification structurally excludes those who already face the greatest access barriers online.

The Whistleblower and Source Protection Problem

The implications for press freedom are what Vogus and Bhatia describe as a largely overlooked dimension of the debate. Age verification laws will create a new pool of data that the government can demand when hunting for information about people who may have spoken to the press.

The concern is direct: if tech companies are required to collect and retain identity data on all users as a condition of age verification compliance, that data becomes accessible via subpoena, court order, or government demand. Instead of subpoenaing journalists — a legally and politically complicated process — the government could potentially demand that platforms identify users who accessed certain content or communicated in certain spaces.

This is not a theoretical risk. The Intercept reported that the Department of Justice issued and then withdrew subpoenas seeking to compel reporters from the Washington Post and Wall Street Journal to testify, likely as part of a leak investigation. The Trump administration has made explicit its interest in unmasking sources and punishing those who speak to the press. Age verification infrastructure would create an additional avenue for that effort — one that bypasses journalists entirely.

The State-Level Preview

The federal KIDS Act arrives against a backdrop of accelerating state-level age verification mandates. The CDT notes that Mississippi, Louisiana, and Montana have all passed laws requiring age verification for content ranging from adult material to social media access entirely. The Supreme Court’s ruling in Free Speech Coalition v. Paxton, examining whether Texas could require age verification for content deemed obscene to minors, has made age verification a more viable legal instrument going forward.

The effects at the state level are already visible. Bluesky no longer offers service in Mississippi due to that state’s age verification law — described by the Mississippi Free Press as a significant blow to residents. PornHub and the open-source blogging platform Dreamwidth have also withdrawn service from Mississippi residents. This fragmentation of the web by jurisdiction represents a concrete consequence of verification mandates: platforms forced to choose between collecting identity data and abandoning entire user populations.

The UK’s implementation of its Online Safety Act offers another data point. Users there have been required to submit identity documents or have their faces scanned to access not only adult content providers but platforms ranging from Spotify to Discord. The EFF, noting the lessons from that rollout, has warned American users and policymakers about the scope of what normalized age verification produces in practice.

Press Freedom and the Duty of Care Provision

The Freedom of the Press Foundation has previously documented how earlier iterations of related legislation — including the Kids Online Safety Act — threatened student journalists by making it harder to find information on social media for reporting purposes. The KIDS Act’s broad definition of harmful content, and the platform liability it creates, gives services strong incentives to filter aggressively. Topics that student journalists might legitimately research — suicide, eating disorders, drug use, violence against LGBTQ+ youth — are among those explicitly flagged as harmful by the legislation, meaning platforms may restrict access to that content even for users researching it in a journalistic capacity.

The compounding effect is a platform environment where anonymous access has been eliminated by verification requirements, and where the content available to verified users has been filtered to minimize platform liability. Both conditions degrade the conditions under which sources can safely communicate with journalists, and under which journalists can safely research sensitive subjects.

The Data Retention Question

At the center of all these concerns is a question that proponents of the KIDS Act have not answered publicly: what happens to the identity data collected during age verification, how long is it retained, and under what legal conditions can it be accessed by third parties, including government agencies?

The CDT has noted that age verification schemes often rest on premises that lead to more data collection and retention by already data-rich services. Privacy-preserving alternatives — approaches that do not require service-side data collection — exist, but the KIDS Act as written does not mandate them. In the absence of such requirements, platforms implementing verification will accumulate databases of user identity that represent a persistent surveillance asset.

For journalists, sources, activists, and anyone else who depends on the internet for communication that they have reason to keep private, that asset exists to be seized, subpoenaed, hacked, or sold — regardless of the intent behind the law that created it.

What Comes Next

The KIDS Act represents a moment where the architecture of internet anonymity may be restructured through legislation that most people will read primarily as a child protection measure. The trade-off being made — identity verification for access — is one whose costs fall most heavily on those who most need the protection of anonymity: sources, whistleblowers, journalists, and members of marginalized communities who use pseudonymous or anonymous online spaces as a matter of safety.

Whether Congress engages with those costs before passage, or whether this bill becomes law in its current form, will say something significant about whose interests the child safety framing was ultimately designed to serve.

This article draws on reporting from The Intercept, the Electronic Frontier Foundation, the Center for Democracy & Technology, and the Freedom of the Press Foundation.