Meta's $2B Bet: The 'Child Safety' Bill That Builds a National ID Layer

A bill moving through Congress right now would require you to prove your age before you can fully use your phone. Not just to download an app. To activate the operating system itself. And the company pushing hardest for it — Meta — wouldn't have to do a thing to comply.

If you've ever handed a phone to your kid, this

If you've ever handed a phone to your kid, this story is about you. If you've ever set up a new device and tapped through the privacy prompts without reading them, this is about you too. The bill is called the Parents Decide Act — H.R. eighty-two fifty. It's bipartisan, and on the surface, it sounds reasonable — parents get more control over what their children access online. But underneath that framing, the bill would force Apple and Google to build a verified identity checkpoint into every phone and tablet they sell. Not an age gate on Instagram. A permanent identity layer baked into the device you carry everywhere. Meanwhile, Meta — the company that actually runs Instagram and Facebook — would be exempt from doing the verification itself. So the question running through this whole story is: whose problem does this bill actually solve?

Start with what the bill requires. Every user would have to provide a date of birth just to set up a device and create an account on the operating system. For anyone under eighteen, a parent or legal guardian would need to verify that identity. Then the operating system — meaning Apple's iOS or Google's Android — would build an A.P.I., a digital pipeline, that feeds that age information to every app on the phone. The F.T.C. would oversee the process, with a hundred and eighty days after the bill passes to write the rules. But the specific method of verification — whether it's a simple dropdown menu, a government I.D. scan, or a biometric check — that part stays undefined until after the bill becomes law. You're being asked to approve the architecture before anyone's drawn the blueprints.

Now zoom out. What does "age verification at the operating system level" actually create? It creates a verified identity signal — not just for kids, but for every person who turns on a device. That signal sits at the deepest layer of the most widely used consumer technology on earth. And once it's there, it can be correlated with everything else the device already knows — your location, your browsing habits, your purchase history. That's not a parental control. That's a national identity layer, built into a phone.

Why is Meta spending so aggressively to make this

So why is Meta spending so aggressively to make this happen? According to federal lobbying disclosures, Meta spent over twenty-six million dollars on federal lobbying in twenty twenty-five alone. Broader reporting puts the company's total investment in shaping age verification legislation at roughly two billion dollars. That money isn't going toward building Meta's own verification tools. It's going toward making sure someone else builds them. Under current law — C.O.P.P.A., the Children's Online Privacy Protection Act — platforms face fines of more than fifty thousand dollars per violation if they have actual knowledge that a user is under thirteen. Meta has faced F.T.C. scrutiny for years, with potential exposure in the tens of billions. But if age verification moves upstream to Apple and Google, Meta gets a legal shield. It can say: we relied on the operating system's signal. The liability shifts to the companies that make the phones — not the companies that make the feeds kids scroll through at two in the morning.

For anyone tracking regulatory strategy, that's a textbook case of regulatory capture — a company shaping the rules so the burden lands on its competitors. For the rest of us, it means the company that profits most from your attention is paying billions to make sure it never has to ask who you are.

The strongest argument in favor of this approach is simple. App-level age checks don't work. Kids bypass them by typing in a different birthday. If platforms can't be trusted to enforce their own gates, maybe the device layer is the right place to do it. But the counter cuts just as deep. If the device-level check is still just a dropdown menu where you pick a date of birth, you haven't solved the problem. You've moved it. You've shifted the liability and the identity data to a new location — but you're still relying on the honor system. That's not age assurance. It's an assumption dressed up as infrastructure.