In a startling revelation, AU10TIX, a widely-used ID verification service, was found to have exposed their administrative credentials for over a year, compromising the security of users’ sensitive data. This breach allowed hackers to easily access users’ IDs, facial scans, and live video feeds—information that was meant to be securely protected. The service is used by various tech companies to verify the identities and ages of their users, if users themselves choose to do so.
This frightening hack is just one example of many over the past several years.
Increasingly, federal and state governments are looking to mandate age verification, explicitly or implicitly, which will require all users of online services to surrender and verify their information through services like AU10TIX.
The Kids Online Safety Act (KOSA) is one such bill. KOSA contains a de facto age verification mandate. All covered companies will need to demand and store the personally identifiable information of all their users to determine who is and is not a minor. Beyond the free speech implications of the government attempting to determine what kind of speech is and is not “appropriate” to be voiced online, KOSA is a serious threat to children’s online safety.
- Children are the number one target for identity theft, costing American families $1 billion annually and ruining the credit scores of children for life;
- Children in foster care and the state child welfare system are much more likely to be the victims of identity theft and face increased likelihood of abuse;
- Predators steal children’s identifiable information because it is useful in either establishing an abusive relationship with them virtually or bringing that abuse into the real world; and
- Government mandates, explicitly or implicitly, like the one in KOSA to hoard children’s data will put those children at far greater risk to attack and abuse from scammers and predators.
The reality is that on the internet, identity and age verification are really hard to do without massive data collection – data that is a honeypot for hackers and data thieves.
The government makes a terrible parent. Stripping parents and guardians of authority and choice while requiring them to give theirs and their children’s personally identifiable information away in order to access constitutionally protected speech is both dangerous and a violation of their rights.
Rather than trying to replace parents, Congress and state governments should empower law enforcement to go after cyber criminals targeting children, enforce existing laws to stop predators online and educate parents and children about safer ways to approach online connections.