Age Verification Law States: 29 Ask Adults for ID or Selfie

Seventy thousand people uploaded a picture of their government I.D. just to prove they were old enough to use a chat app. Then those pictures got out. According to Discord, the leak didn't even come from Discord itself. It came from an outside company hired to handle the age checks.

If a website has ever stopped you cold and asked

If a website has ever stopped you cold and asked for your driver's license or a selfie, this story is about you. That moment can feel strange. You're handing your face or your license to a screen, and you have no idea where it goes next. That unease makes sense. According to Gadget Review, twenty-nine U.S. states now have age-verification laws in force. These laws aim to keep kids away from harmful material and addictive apps. To do that, websites have to figure out who's a child. And the only way to find the kids is to check everybody. So who's holding all that data once the check is done?

Start with the people in that Discord breach. They did what they were asked. They scanned an I.D., hit submit, and moved on with their day. Most of them probably never knew a third company was involved at all. Seventy thousand license photos. Collected to keep people safe. Now sitting somewhere they were never supposed to be.

That third company is the heart of the problem. Most websites don't check your age themselves. They hire age-assurance vendors, specialist firms that look at your I.D. or your face and send back a yes or a no. The Center for Democracy and Technology has warned that these tools often collect a lot more than a birthday. Some ask for a driver's license. Some ask for a birth certificate. Some scan your face. Every one of those vendors becomes a single place where thousands of identity documents pile up. For a hacker, that pile is worth far more than any one website's user list. For you, it means your license could end up in a database run by a company whose name you've never heard.

Now widen the lens. These twenty-nine states don't agree on much. Florida bans kids under fourteen from opening social media accounts at all. New York goes after addictive, algorithm-driven feeds for anyone under eighteen. Virginia sets a default limit of one hour of social media a day for minors. Three states. Three completely different rules. A platform that operates nationwide has to track where each user is sitting, which rule applies there, and how long that state lets it keep the data. For compliance teams, that's a moving target that shifts every time you cross a state line. For everyone else, it means the same app might ask for your face in one state and nothing at all in the next.

Why not just skip the checks

So why not just skip the checks? Because the child safety side has real weight behind it. The U.S. Supreme Court has ruled that a state can require age verification on websites where more than a third of the content is sexual material harmful to minors. And in February of twenty twenty-six, the Federal Trade Commission put out a new policy statement under COPPA that openly encourages these age-checking tools. Protecting kids from predators and manipulative design is a legitimate goal. Nobody serious argues otherwise.

The trouble is what happens after the yes or no. According to the Center for Democracy and Technology, the safeguards that matter most are limits on keeping the data, sharing it, and reusing it for other purposes. Those limits vary wildly, and users usually can't see them. For investigators and lawyers, that's the sharp point. A growing trail now ties real names and faces to everyday browsing, and that trail can be breached, sold, or subpoenaed. For the rest of us, it means the quiet freedom to read something online without anyone knowing it was you is shrinking.

This isn't really a fight between safety and privacy. It's two kinds of privacy pulling against each other, a child's right to be protected, and an adult's right to stay anonymous. And right now, the weakest link in protecting both is the vendor in the middle that neither side ever sees.

More than half the states now make websites check ages, mostly to protect kids. To find the kids, those sites check everyone, often by collecting I.D.s or face scans. That data piles up at outside companies, and one leak already exposed seventy thousand I.D. photos.