Privacy Is Not Secrecy: Age Verification, Digital Identity, and the Privacy Risks of an Identity-Gated Internet

Across the Internet, websites increasingly ask users for government-issued identification, facial images, biometric information, or third-party identity verification.

The motivations are often legitimate: protecting minors, reducing fraud, combating impersonation, and establishing trust online. But legitimate objectives do not automatically justify collecting every piece of information capable of satisfying them.

The better question is:

What is the minimum information necessary to accomplish the verification?

A website needing to establish that someone is over eighteen does not necessarily need to know who that person is. The distinction is fundamental: proving an attribute is not the same as revealing an identity.

Prove the Attribute, Not the Identity

Consider an adult accessing an age-restricted website. The website needs one fact:

AGE ≥ 18 = TRUE

A driver's license provides far more: legal name, exact date of birth, address, photograph, license number, signature, and other identifying information.

Providing an entire credential to establish one fact conflicts with the cybersecurity principle of data minimization.

NIST's Digital Identity Guidelines recognize this distinction. If a relying party needs to determine whether someone has reached the age of majority, an identity provider can return a derived attribute, a Boolean result, rather than disclose the person's actual birth date. NIST also supports selective disclosure to limit unnecessary information provided to relying parties.[1]

The transaction changes from:

“Tell me who you are so I can determine whether you're old enough.”

to:

“Prove that you satisfy the age requirement.”

That is a fundamentally different security architecture.

Identity Data Is Different

Government identity information is unusually durable.

A stolen password can be changed. A compromised credit card can be canceled. An authentication token can be revoked.

You cannot change your face or date of birth, and many government identifiers are difficult to replace.

Canada's Office of the Privacy Commissioner warns that age-assurance information can be sensitive and that information about the services people access can itself create privacy risks.[2]

This leads to a simple cybersecurity principle:

The safest sensitive information in a database is information that was never placed there.

Encryption, access controls, audits, and retention policies reduce risk but cannot eliminate the exposure created by collection. Once identity data enters another organization's systems, it becomes subject to compromise, insider misuse, third-party exposure, excessive retention, legal demands, corporate acquisitions, and future policy changes.

The question should therefore not merely be, “Do I trust this company?”

It should be:

“Would I accept the consequences if this information were eventually compromised?”

Verification Is Becoming More Common

Identity verification is already expanding beyond age-restricted websites.

Meta has described Instagram age-verification methods involving government ID submission and video-selfie age estimation.[3]

LinkedIn offers identity verification through providers such as Persona. For U.S. users, LinkedIn states that Persona may collect a government-ID image and live selfie and provide selected verification information to LinkedIn. LinkedIn states that it does not receive the user's biometric data, government-ID photographs, document number, expiration date, or issue date.[4]

That distinction matters. The privacy argument does not require alleging that companies sell government-ID images.

The better question is architectural:

How much information does the service actually need?

Ideally, verification should represent an assertion from a trusted verifier, not require unnecessary identity information to flow through or remain with the relying service.

Architecture Is Stronger Than Promises

History provides reason to favor technical constraints over promises alone.

In 2019, the Federal Trade Commission imposed a $5 billion penalty and additional privacy restrictions on Facebook following allegations involving its privacy practices. Among them, the FTC alleged that telephone numbers collected for a security feature were also used for advertising without adequate disclosure.[5]

That does not establish misuse of today's identity-verification data. It demonstrates a broader principle:

Information collected for Purpose A may eventually become valuable for Purpose B.

“We will not correlate this information” is useful. A system designed so the organization cannot correlate it is better.

“We delete your government ID after verification” is useful. A protocol in which the website never receives it is better.

Good privacy architecture reduces the amount of trust that must be placed in future corporate behavior.

The Greater Risk: Linkability

The deeper systemic risk is not simply that another company learns your identity. It is that identity infrastructure can make activities that were previously separate linkable.

People routinely maintain legitimate boundaries between different parts of their lives: employee, patient, customer, political participant, researcher, hobbyist, religious believer, and private citizen. Identification in one context does not mean those contexts should become technologically connected.

Cybersecurity already recognizes the value of compartmentalization. We segment systems so compromise of one trust domain does not automatically expose another. Identity deserves a similar principle:

Verification in one context should not automatically create linkability in another.

This matters because identity verification exists within a much larger commercial-data ecosystem. The FTC has documented how data brokers obtain information from numerous sources and combine or distribute it for purposes including marketing and fraud prevention.[6]

Identity, biometrics, employment, location, purchases, browsing behavior, social relationships, and advertising identifiers become far more revealing when correlated. This resembles the intelligence-analysis concept of the mosaic effect: individually innocuous information can become highly revealing when assembled.

Verification providers themselves could become correlation points. If many unrelated websites depend on a small number of providers, transaction records could become sensitive depending on system design.

Consider an oncology forum, addiction-support community, religious site, political organization, dating service, or whistleblower platform. Knowing where someone verifies may reveal something sensitive even without knowing what the person did there.

Canada's privacy regulator recommends architectures intended to mitigate this problem, including “double anonymity,” in which the age-assurance provider does not know what content the individual accesses while the website does not learn the individual's identity. Its guidance also supports selective disclosure, reusable credentials, on-device processing, and minimizing unnecessary identifiers and metadata.[7]

The objective should therefore be more than protecting identity data from theft. It should be preventing identity systems from unnecessarily becoming a bridge between otherwise separate parts of a person's life.

A Better Architecture Already Exists

Privacy-preserving alternatives do not require abandoning verification.

A trusted provider could verify someone's identity and issue a cryptographically protected digital credential. The person's device could subsequently prove:

AgeOver18 = TRUE

without revealing a name, address, driver's-license number, exact birth date, or photograph.

The principle extends further:

IdentityVerified = TRUE

LicensedPhysician = TRUE

CurrentStudent = TRUE

VeteranStatus = VERIFIED

This is least privilege applied to personal information. We would not grant an application administrator privileges merely because it needs one file. Why disclose an entire identity credential when a service requires only one attribute?

Florida law already recognizes this distinction. Florida Statute § 501.1738 defines “anonymous age verification” and restricts third parties performing it from retaining personally identifying information after verification, using it for another purpose, or sharing it.[8]

In February 2026, the FTC issued a COPPA enforcement policy statement encouraging age-verification technologies while conditioning its enforcement discretion on safeguards including purpose limitation, prompt deletion, reasonable security, and restrictions on third-party disclosures.[9]

Safety and privacy need not be opposing objectives.

Privacy Is Not Secrecy

This brings us to the familiar argument:

“If you have nothing to hide, why are you afraid to identify yourself?”

It misunderstands privacy.

Most people do not publish their financial records, medical histories, private messages, or every place they visit. Nor would most willingly hand their driver's license to a stranger without a legitimate reason.

None of that implies wrongdoing.

Privacy is the ability to maintain reasonable control over who knows what about us, when they know it, and why they need to know it.

Pseudonymity serves legitimate purposes as well. Whistleblowers, abuse victims, journalistic sources, cybersecurity researchers, law-enforcement personnel, political dissidents, and ordinary people researching sensitive subjects may reasonably separate an activity from their public legal identity.

An identity-gated Internet could weaken those boundaries incrementally. No conspiracy is required. Each new verification requirement may be independently reasonable while collectively producing an Internet in which routine participation increasingly requires legal identification and previously separate activities become easier to correlate.

That cumulative architectural change deserves scrutiny.

Ask One Question

When a website requests government identification, a facial image, or biometric verification, users need not assume either that the request is malicious or that compliance is harmless.

Instead, ask:

Why do you need this information?

If a website needs to establish that you are eighteen, let it establish that you are eighteen. If a service needs to verify a professional credential, let it verify the credential. If a network needs evidence that someone has been independently verified, let a trusted system attest to that fact.

None of those requirements automatically means the organization needs everything contained on a government-issued ID.

Sometimes providing identification will be reasonable. Sometimes declining will be equally reasonable. The decision should be informed.

A driver's license is not another username. A passport is not another password. A facial biometric is not another verification code. These are durable components of identity.

Privacy does not require having something to hide.

“I have nothing to hide” and “I have nothing I need to reveal to you” are entirely different propositions.

If digital identity becomes a larger part of the Internet, we should build that infrastructure deliberately around data minimization, selective disclosure, compartmentalization, least privilege, and systems designed for compromise.

The goal should not be an Internet where everyone must continually identify themselves.

It should be one where people can reliably prove what needs to be proven, without unnecessarily revealing who they are or linking where they have been.

Prove what needs to be proven. Reveal nothing more.

Notes

[1] National Institute of Standards and Technology, Digital Identity Guidelines: Federation and Assertions, NIST Special Publication 800-63C-4 (2025). NIST discusses derived attribute values and selective disclosure as mechanisms for limiting unnecessary disclosure to relying parties.

[2] Office of the Privacy Commissioner of Canada, “Assessing Whether and How to Use Age Assurance: Guidance for Websites and Online Services,” May 4, 2026.

[3] Meta, “Introducing New Ways to Verify Age on Instagram,” June 23, 2022, updated May 24, 2024.

[4] LinkedIn, “Identity Verification via Persona,” LinkedIn Help, accessed September 3, 2026.

[5] Federal Trade Commission, “FTC Imposes $5 Billion Penalty and Sweeping New Privacy Restrictions on Facebook,” July 24, 2019.

[6] Federal Trade Commission, “FTC Recommends Congress Require the Data Broker Industry to Be More Transparent and Give Consumers Greater Control over Their Personal Information,” May 27, 2014.

[7] Office of the Privacy Commissioner of Canada, “Assessing Whether and How to Use Age Assurance: Guidance for Websites and Online Services,” and “Designing Age Assurance to Be Privacy-Protective: Guidance for Age Assurance Developers,” May 4, 2026.

[8] Florida Legislature, Florida Statutes § 501.1738, “Anonymous Age Verification” (2026).

[9] Federal Trade Commission, “Enforcement Policy Statement Promoting the Adoption of Age Verification Technology,” February 25, 2026; Office of the Privacy Commissioner of Canada, “Designing Age Assurance to Be Privacy-Protective,” May 4, 2026.

Bibliography

Federal Trade Commission. “Enforcement Policy Statement Promoting the Adoption of Age Verification Technology.” February 25, 2026. https://www.ftc.gov/legal-library/browse/enforcement-policy-statement-promoting-adoption-age-verification-technology Federal Trade Commission. “FTC Imposes $5 Billion Penalty and Sweeping New Privacy Restrictions on Facebook.” July 24, 2019. https://www.ftc.gov/news-events/news/press-releases/2019/07/ftc-imposes-5-billion-penalty-sweeping-new-privacy-restrictions-facebook Federal Trade Commission. “FTC Recommends Congress Require the Data Broker Industry to Be More Transparent and Give Consumers Greater Control over Their Personal Information.” May 27, 2014. https://www.ftc.gov/news-events/news/press-releases/2014/05/ftc-recommends-congress-require-data-broker-industry-be-more-transparent-give-consumers-greater Florida Legislature. Florida Statutes § 501.1738. “Anonymous Age Verification.” 2026. https://www.flsenate.gov/Laws/Statutes/2026/501.1738 LinkedIn. “Identity Verification via Persona.” LinkedIn Help. Accessed September 3, 2026. https://www.linkedin.com/help/linkedin/answer/a1717004 Meta. “Introducing New Ways to Verify Age on Instagram.” June 23, 2022. Updated May 24, 2024. https://about.fb.com/news/2022/06/new-ways-to-verify-age-on-instagram/ National Institute of Standards and Technology. Digital Identity Guidelines: Federation and Assertions. NIST Special Publication 800-63C-4. Gaithersburg, MD: U.S. Department of Commerce, 2025. https://pages.nist.gov/800-63-4/sp800-63c.html Office of the Privacy Commissioner of Canada. “Assessing Whether and How to Use Age Assurance: Guidance for Websites and Online Services.” May 4, 2026. https://www.priv.gc.ca/en/privacy-topics/age-assurance/aa-gd-web/ Office of the Privacy Commissioner of Canada. “Designing Age Assurance to Be Privacy-Protective: Guidance for Age Assurance Developers.” May 4, 2026. https://www.priv.gc.ca/en/privacy-topics/age-assurance/aa-gd-developers/