1. What will you grant your friendly AI cost-savings partner access to in order for them to embed? Think internal data, workflows, customer info, pricing logic, emails, etc. You could be giving away the farm.

2. Do they promise they really, really won’t keep copies of your data? (How will you know?) You likely won’t be able to verify it. Logs, embeddings, backups, subprocessors… Many of today’s AI companies exist because they hoovered up as much of the internet as they could sic their data scraper bots on. Maybe they were great at pitching you because of information they already scraped about your company.

3. Once they’re in, what happens to the penetration pricing they offered to get their foot in the door? Hostage alert: Predatory price increases and recurring revenue models are the prime movers in the Silicon Valley playbook. See: Every service ever. Pick Netflix. Pick Oracle. Salesforce. How’s that pricing going.

4. When they begin hiking prices aggressively or degrading your service, how easy will it be to remove them, start fresh, and take your data with you? At a minimum, we’re talking time, money, people power, and broken processes, all to get it back to a place where it may not even be usable.

5. Will your AI partner learn enough from their embed with your business that it allows them to replace you and put you out of business? You’re handing over edge cases, decision-making - everything that actually matters.

6. If you embed a multi-billion-dollar tech company, do you believe you’ll be able to afford the fight for enforcement of your NDA or non-compete if they go rogue? What are your options if your AI vendor decides you matter just as little as the other employees it just replaced.

Maybe you’re not just screwing your employees? Maybe the person you’re really screwing is yourself.

Unsure whether this is true? Have a look at what the co-founder of Y Combinator, Paul Graham, thinks should happen if your company isn’t deemed ready for AI integration.

Background

The bill was formally introduced in the House on April 13, 2026.

NSPM-7

The bill is sponsored by Josh Gottheimer (D-NJ) and Elise Stefanik (R-NY), two of the most outspoken supporters of a country whose Cyber Unit identifies “inflammatory” online content and issues takedown requests to platforms like Meta and YouTube. In 2024 alone, they sent over 9,500 requests, with high compliance rates from social media companies (source: the EFF).

The government could theoretically cross-reference these verified identities with the “domestic terrorism” lists generated under NSPM-7 (National Security Presidential Memorandum-7), which applies to individuals as well as groups.

If a user’s speech on a platform is flagged as violating the ideological standards of NSPM-7, the government could argue that the app or the OS now has knowledge of a security threat. This could trigger mandatory “safety” interventions, such as locking the user out of an app or their device.

These laws turn your phone from a private tool into a digitally tethered ID card. Though “safety” for children is the public-facing goal, the technical infrastructure it builds is a system of total identification that is vulnerable to both criminals and government overreach that ostensibly ends with lockout from phones, computers, and apps, leaving users in the wilderness as a result of online speech.

Per Ken Klippenstein’s summary of NSPM-7:

Mechanics of the bill

This bill would require operating system providers to collect a user’s date of birth before they can set up and account and use a device.

Because the way the language is written is so broad, the definition of devices with operating systems includes:

Smartphone software, laptop and desktop computer software, tablet software, smart TV software, video game consoles, virtual reality and augmented reality headsets, smartwatches and fitness trackers, car dashboard screens, independent computer systems like Linux, Chromebook software, smart home devices (like smart fridges or thermostats), and public touchscreens (like ATMs or self-checkout kiosks).

Once verified at the operating system level, the bill requires providers to develop an API (think of it as a tunnel) that allows third-party app developers to access this age data. Apps would then dip into the information stored at the operating system level to perform age checks.

Those apps are only supposed to store a signal that indicates the age grouping, but we’ve seen over and over that there is a high possibility that some will store all they have access to via that API and no one will be the wiser because no one is going to audit their servers.

In terms of the types of IDs that would be acceptable, the bill leaves it to the unelected body at the FTC to come up with the methodology within 180 days of enactment.

One obvious risk here is that this starts out requiring less information in order to get it on the books, but then grows, just as FISA warrantless surveillance grew significantly over time.

Verification options

Options the FTC would consider likely consider using for verification:

1. Uploading a photo of a driver’s license or passport

2. Using facial scans or AI-based age estimation (biometrics)

3. Verifying identity and age against credit bureau info

4. Parent or guardian verification, in which case the parent must also verify

Why would its existence be very risky from a purely technological perspective?

1. The obvious: the bill creates massive databases of linked identities that would be a goldmine for hackers

2. Historical breaches at verifiers like AU10TIX and platforms like Discord have already exposed thousands of user ID images

3. On compromised devices, hackers can often bypass local security gates. For example, UK-based security consultant Paul Moore found he could hack a similar EU age-verification app in under 2 minutes by editing local files to disable biometric requirements and reset security PINs.

4. Hackers could send phishing emails or show pop-ups that look like official OS age-verification prompts. Unsuspecting users might then verify their age by uploading their driver’s license directly to a hacker’s server

In terms of who has access to this data, let’s pick on Meta/Facebook/Zuckerberg as an example

In April 2018, Zuckerberg testified before Senate and House committees after it was revealed that the data of up to 87 million users was improperly harvested.

In July 2020, Zuckerberg appeared before a House subcommittee to discuss whether Facebook’s massive data collection gave it an unfair advantage over competitors.

In November 2020, Zuckerberg testified about how user data and platform algorithms were managed during the 2020 election cycle.

In April 2025, a former Meta director testified that executives had betrayed American values by allegedly allowing the Chinese government to access to user data.

Given this past behavior, Congress is willfully ignoring the evidence to pretend these companies will just store a signal.

Why that’s likely absolutely untrue - Persona

Peter Thiel-backed Persona Identities, a third-party identity verification vendor that was used by Discord for age verification trials in the UK, had left nearly 2,500 frontend code files publicly accessible on a US government-authorized (FedRAMP, ie, Federal Risk and Authorization Management Program) server.

The claim is that the Persona data was on a FedRAMP-authorized server because Persona was in the process of pursuing official government certification to expand its identity verification services to federal agencies.

According to a post-incident review by Persona, the exposure occurred on a non-production test environment, specifically a subdomain called onyx.withpersona-gov.com, used to validate infrastructure for government-specific work.

Security researchers at vmfunc.re argued that, though individual identities weren’t leaked this time, the code revealed a hidden surveillance pipeline that routes routine ID checks (like for OpenAI or Discord) into government watchlist databases and suspicious activity reporting systems.

Results:

1. Persona’s CEO reached out to vmfunc directly to discuss the findings, and even praised their “clear talent” though of course they expressed frustration with how the report was released

2. Discord immediately cut ties with Persona for its UK age verification trial once the report went viral

3. Major platforms like OpenAI and Anthropic faced renewed scrutiny over their use of the same watchlist infrastructure

Bottom line: A tool meant for a simple age check was actually a sophisticated surveillance engine.

A collection of bills framed as enhancing kids’ online safety would require all Americans to share their IDs online, regardless of age, handing sensitive personal data to companies with deeply troubled data protection records.

A group of bills moving through Congress purportedly aims to make the internet safer for kids, a goal with broad bipartisan support, but these proposals claim that the best way to achieve safety is by mandating widespread ID verification and expanded monitoring for all.

This shift permanently dismantles online privacy. By forcing Americans to hand over government IDs or biometric scans to private companies in order to browse the internet or use common apps, these bills put our most critical data in the hands of tech companies, many with questionable motives and track records, and guarantee that immutable personal data will eventually be exposed to hackers and scammers.

Ultimately, if passed, these bills will force citizens to trade their right to browse privately for a perpetual risk of abuse by Big Tech, the government, and identity thieves.

The only way to determine who is or isn’t a child is for everyone to provide Big Tech with their ID.

It is no surprise that identity-verification proposals have gained traction in Washington.

Lobbyists for the Big Tech platforms most likely to run these systems argue that verifying users is the only practical way to protect children.

However, tech critics point out that these same companies have spent years trying to build user data profiles. These profiles consist of verified birth dates, government-issued IDs, and biometric scans, which are the most valuable assets a tech firm can possess.

Under these laws, Americans would be forced to surrender this sensitive information to the very platforms and verification firms that have faced two decades of federal investigations, lawsuits, and civil rights penalties.

By mandating ID uploads for basic online services, Congress is effectively handing these companies the precise data they previously sought through questionable practices.

Furthermore, critics who understand tech fear that a fundamental Congressional misunderstanding of the cloud is creating an enormously valuable target for hackers and scammers to exploit our most sensitive personal information.

It’s hard to imagine that Congress can’t connect the dots.

In June 2022, Senator Ed Markey (D-MA), a lead sponsor of identity legislation called COPPA 2.0, blasted the identity verification firm ID.me for its “reckless and irresponsible” disregard for security after sensitive documents like Social Security cards and passports were found unsecured on internal dashboards.

Markey warned that the stakes are incredibly high when biometric data is involved, yet his current legislative push would funnel millions more Americans into these very same third-party systems he has only recently characterized as careless.

By mandating age checks while acknowledging the industry’s history of mismanagement, Markey is essentially forcing citizens to hand their most sensitive gold data to entities he has already labeled as untrustworthy.

Several bills are at the center of this debate

• The Kids Online Safety Act (KOSA), sometimes called KOSPA, would require platforms to exercise a “duty of care” to prevent harm to minors online. It has bipartisan sponsorship in the Senate, including Democratic Sen. Richard Blumenthal.

• The KIDS Act is a broader proposal that includes KOSA and would require age verification for certain online content. It recently passed the House Energy and Commerce Committee on a party-line vote, with Democrats opposing that particular version because of concerns about state authority.

• COPPA 2.0 would update a children’s privacy law from 1998. The new version would restrict targeted advertising and data collection for users under 17 and passed the Senate unanimously. How would the age of internet users be known? ID verification.

• The App Store Accountability Act shifts the responsibility for verifying users’ ages away from individual apps and onto the companies that run app stores.

• The Kids Off Social Media Act (KOSMA) proposes banning children under 13 from social media and limiting algorithmic recommendations for teens.

• Finally, Sammy’s Law would require platforms to allow third-party safety software that lets parents monitor their children’s accounts.

Implementing these laws, which may sound beneficial on the surface, would necessarily require a new system of identity verification across much of the internet for all users.

Who would actually collect your most sensitive personal information?

If age verification becomes mandatory for online services, the question quickly becomes: who collects and stores that data?

Several types of organizations would likely be involved.

• App Store ID Verification

  Right now, companies like Apple and Google hold a lot of user data, but they generally don’t hold verified government IDs for the entire population. If laws require them to become the primary age-verification gatekeepers, they could end up controlling something much closer to a nationwide identity layer for the internet.

  It also raises questions about government access to those databases. Even when companies resist broad government requests, verified identity databases can become extremely valuable to law enforcement or regulators through subpoenas, warrants, or regulatory pressure.

  Critics worry that once such databases exist, history indicates that government access will expand over time.

• Third-party ID Verification Companies

  Some tech firms do not want to store government IDs themselves, so they outsource the process. Money-making services such as ID.me, Persona, Yoti, or Clear specialize in verifying identity documents and biometric scans. In a typical system, a user might upload a driver’s license or passport and take a selfie video. The verification company checks the documents and returns a digital confirmation that the person is over a certain age.

• Apps and Social Platforms, Themselves

  Even if the initial verification happens elsewhere, the resulting age signal would still have to be passed to individual apps so they know what content or features to allow. That information would then be stored at those platforms.

• Third-party Monitoring Services

  Money-making services introduced by proposals like Sammy’s Law that provide parental oversight tools could gain access to accounts so they can scan messages or posts for dangerous behavior and alert parents. This triggers surveillance concerns. Users will not know which companies are conducting what surveillance or where.

• Government regulators

  Agencies such as the Federal Trade Commission would likely oversee enforcement and audit companies to ensure they are following age-verification rules. In practice, that means our identification data could move through several layers of companies and the federal government who warrant varying layers of trust.

Why critics warn about massive data breach risks.

Many in tech argue that systems requiring large-scale ID verification could create enormous cybersecurity risk.

Databases containing government IDs, biometric scans, and verified identity information are among the most valuable data stores attackers can target. Concentrating that information in large centralized systems increases the potential impact of a breach.

Once that data is stolen and makes its way onto the dark web, it is there forever, and users often receive no notification that this has occurred. Even if users are notified, it is of little value, given that there is little to nothing people can do to address the loss of their facial scan, physical address, driver’s license number, or birth date to scammers. Unlike a password, these forms of identification cannot easily be changed.

If a password leaks, you reset it. If a biometric scan or ID photo leaks, it is lost for life.

Another concern involves the growing number of systems holding that data. Today, a driver’s license primarily exists within government databases. Under age-verification regimes, digital copies or biometric matches could exist across app stores, verification firms, and possibly individual platforms.

As we’ve learned over and over from breaches such as even well-secured systems can be vulnerable if a cloud configuration is misconfigured, if internal credentials are compromised, or if employees misuse access, which happens.

In September 2015, a breach of Experian’s servers exposed the personal data of 15 million T-Mobile applicants, including names, addresses, dates of birth, Social Security numbers, and government ID numbers.

This was followed by an August 2020 Experian incident in South Africa that compromised the names and ID numbers of 24 million consumers.

Most recently, in January 2021, a massive leak involving Serasa Experian in Brazil exposed the names, Social Security numbers, and tax forms of 220 million people, though the company disputed the source of the data.

Experian’s repeated breaches are an important analogue for the risks of the cloud-based ID databases required by bills like KOSA.

The consequences for these companies are not a deterrent.

For a multi-billion-dollar corporation like Experian, a settlement of ten or twenty million dollars is a minor cost of doing business that represents a tiny fraction of its annual revenue.

While the company’s balance sheet remains virtually untouched, the millions of people whose Social Security numbers and passport details were exposed face a lifetime of identity theft risk.

A gold mine for hackers.

If Congress mandates that every American must upload government IDs to private tech platforms, it creates an extremely high-value target for hackers.

The companies signing up to provide these services have every incentive to harvest our most sensitive data, but history indicates they would face no penalty large enough to actually force them to protect it.

There have already been warning signs in the industry. Identity verification companies and related systems have experienced breaches exposing sensitive information in recent years, raising questions about how secure large-scale identity infrastructure really is.

The risks are already well-established.

In just the past two years, these companies have proven that they’re not up to the task of keeping our information safe.

In 2024, National Public Data suffered a massive breach exposing the Social Security numbers of 272 million people, which were later auctioned on the dark web.

By late 2025, attackers breached 700Credit, stealing consumer identity records used for auto financing.

The crisis accelerated in February 2026 when IDMerit left an unsecured database online, exposing one billion records, including 203 million from the U.S., containing names, addresses, and national ID numbers.

That same month, Odido lost the passport and driver’s license numbers of 6.2 million customers.

And, as previously mentioned, ID.me, a primary government partner, was caught carelessly exposing sensitive IDs on internal dashboards, proving that these massive data targets are often compromised even before a hacker arrives.

The rise of a new type of scam.

There’s another risk that has less to do with hacking and more to do with deception.

If verifying your identity becomes a routine step for online access, scammers could exploit that expectation.

Online security experts warn about a trust gap. Once people become conditioned to uploading our IDs or biometric scans to access services, it becomes easier for fraudsters to trick them into doing the same on fake websites.

Common tactics could include fake websites that mimic legitimate verification services, phishing emails claiming your account access will be suspended without verification, scam messages pretending to come from regulators or technology companies, and search ads that lead to fraudulent verification portals.

Artificial intelligence could make these scams all the more convincing. Generative AI tools can quickly build professional-looking websites or generate fake identity verification interfaces. Once scammers obtain someone’s ID and biometric data, the accessibility of AI tools means that it’s far easier today than at any time in the past to create synthetic identities, blending real and fake information to access accounts or commit financial fraud.

Who holds the data?

Another major issue raised by critics is who would ultimately control the identity data collected under these laws.

Some of the same companies likely to manage age verification have faced scrutiny for privacy issues in the past.

Social media platforms, for example, have previously been criticized for large-scale data harvesting and misuse of personal information. The most famous case involved Cambridge Analytica, which harvested Facebook data from tens of millions of users and used it to build psychological profiles for targeted political advertising.

Other companies that might act as identity gatekeepers, such as major app store operators, already have significant control over digital ecosystems.

Privacy advocates argue that expanding their role to include identity verification could give them even greater influence over online access. In addition, we are now firmly in the era of surveillance capitalism, and this is precisely the kind of gold, authoritative data these companies have been working to compile for decades. Congress would be handing it to them on a plate.

The proposals rely heavily on trusting companies that lawmakers themselves have spent years accusing of mishandling user data.

Big Tech CEOs have fully emerged as political figures.

The issue becomes even more complicated when politics enters the picture.

Large technology companies have played complicated roles in U.S. elections and political campaigns. In 2025 and 2026, Elon Musk’s Department of Government Efficiency (DOGE) has increasingly integrated Palantir’s infrastructure to centralize and analyze federal data.

Under executive orders aimed at eliminating what it referred to as information silos, DOGE and Palantir have collaborated on a mega API for the IRS and a master database for immigration tracking, effectively creating a digital ID system with up to 314 data points on every person in the U.S.

This partnership is driven by Palantir co-founder Peter Thiel, who was a major donor to Donald Trump’s 2016 and 2024 campaigns, and Elon Musk, who was a major Trump donor in 2024.

The integration was further fortified by a 2025 Supreme Court ruling that granted DOGE unimpeded access to Social Security Administration records. Critics argue this collaboration creates an unprecedented surveillance target; in February 2026, a Congressional filing alleged that DOGE members shared sensitive Social Security data with outside advocacy groups to match against state voter rolls. So, one question is why Democratic lawmakers would want to turn all of our data over to these same tech CEOs. It’s a staggering self-own by Democratic politicians.

When the same tech owners who fund political campaigns are handed the keys to our most sensitive data, online safety begins to look like a tool for political control. The shift from the 2016 Cambridge Analytica scandal to the 2026 DOGE-Palantir partnership shows a dangerous evolution. Personal information is no longer just being harvested for ads. It is being codified into a permanent and government-sanctioned digital ID.

By mandating that every American surrender their government IDs and biometric scans to these platforms, Congress is not just creating a target for hackers. It is building a centralized surveillance infrastructure for the very billionaires and companies that have already demonstrated a willingness to weaponize data for political ends.

The bottom line.

At its core, this debate is not about protecting kids online; it is much more complex. This is about civil rights, privacy, control, and risk.

This represents an open door for nameless, faceless companies collecting and sharing our most important identifying data in the background, cataloguing the sites we visit, what links we go to, what we write, and who we interact with in ways that would horrify us in our offline daily lives.

Once that freedom is lost, it is likely lost forever.

This is a First, Fourth, and potentially a Fourteenth Amendment issue.

This legislation would normalize a slippery slope of widespread identity checks online, increase the risk of data breaches, empower scammers, and concentrate enormous amounts of personal information in the hands of technology companies.

Voter action is urgent.

Because several of these proposals are already advancing through Congress, the time to weigh in is now.

If you are concerned about the potential privacy risks, one of the most effective steps is contacting your elected representatives and telling them where you stand before voting is finalized.

A simple message can be enough. For example:

“I’m calling to ask the Representative/Senator to oppose legislation that requires online age verification systems because of the risks to Americans’ privacy and personal data security.”

You can find the contact information for your elected officials here:

House of Representatives:
https://www.house.gov/representatives/find-your-representative

U.S. Senate:
https://www.senate.gov/senators/senators-contact.htm

Lawmakers often track how many calls and messages they receive about specific issues. If you want your voice included in that count, reaching out directly is the most immediate way to do it.