The US House of Representatives has passed the KIDS Act - the Kids Internet and Digital Safety Act - in a 267 to 117 vote, and it could push age verification across much of the American web. Billed as child-safety legislation, the bill leans heavily on making platforms check how old their users are. The Electronic Frontier Foundation has already urged the Senate to reject it, warning that the practical result would be ID checks, passport uploads or face scans for everyone, not just children.
What the KIDS Act would do
The bill is a bipartisan package out of the House Energy and Commerce Committee. Among its provisions, it would restrict disappearing messages for minors, require AI chatbots to disclose that they are not human, mandate age verification for platforms that host pornographic content, and add safeguards and targeted-advertising limits for underage users. On paper it is aimed at protecting kids. The disagreement is about the method - and specifically about who ends up getting checked.
The age-verification problem
Crucially, the House version drops the "duty of care" standard from the earlier KOSA proposal and leans on age checks instead. It asks platforms to judge whether a user is "more likely than not" a minor before showing certain content. As the EFF points out, no service can make that call reliably without checking everyone - which in practice means demanding an ID, a passport, or facial and behavioural age-estimation from all users. That is the same design that has already drawn a backlash at the state level, where California recently pulled back from a broad web age-check mandate.
Every age check is a honeypot
The privacy problem is not abstract. To verify age, a platform (or a third-party vendor) has to collect and store government IDs or selfies for a huge share of the population. Each of those systems becomes a concentrated target - a database of identity documents that is a breach waiting to happen. We have seen the pattern with age-verification schemes that turn an everyday account into an identity document, and we have seen what happens when big databases fall into the wrong hands. Mandating age checks nationwide multiplies the number of honeypots, and history says some of them will leak.
What it means for privacy and VPNs
When anonymous access to ordinary sites shrinks, people who value their privacy look for ways around the gate, and a VPN is the usual first step - it hides your IP and location so a site cannot tie your browsing to a real-world identity as easily. But it is worth being clear about the limits: a VPN does not fill in an ID upload for you, and it does not stop a service you have verified with from holding your documents. The deeper issue the KIDS Act raises is the honeypot itself - the shift from an anonymous-by-default web to one where using a normal service can mean handing over your papers.
