How Zero-Knowledge Proofs Can Solve the Age Verification Dilemma

We're witnessing an uptick in laws being proposed restricting minors' access to social media and the internet, including in Australia, Florida, and China.

The state of Louisiana recently enacted a law meant to block minors from viewing porn. To do so, the legislation required sites to make users upload an ID before viewing content.

The Free Speech Coalition, a trade association that represents the adult entertainment industry, challenged the law in a lawsuit, arguing that it was unconstitutional. The lawsuit claimed that the law forced the plaintiffs to engage in conduct that violated the First Amendment in order to avoid an allegedly unlawful restraint on their right to free speech. The lawsuit also stated that the plaintiffs would be forced to choose between two constitutional rights: the right to free speech and the right to privacy.

The lawsuit was eventually dismissed by the U.S. District Court for the Western District of Louisiana on procedural grounds. However, the reaction to the law highlights the dilemma facing policymakers and platforms: how to block minors without violating adults’ rights or creating new privacy risks.

Currently, age verification tools are either ineffective or invasive. Self-declaration is meaningless as users can simply lie about their age. ID-based verification is overly invasive. No one should be required to upload their most sensitive documents, putting themselves at risk of data breaches and identity theft.

Biometric solutions like fingerprints and face scans are convenient for users but present important ethical, privacy and security concerns. Such systems are not always accurate and may generate false positives and negatives. The irreversible nature of the data, which can’t be changed like a regular password can, is also less than ideal.

Other methods, like behavioral tracking and AI-driven verification of browser patterns, are also problematic. For example, some platforms use machine learning to analyze user interactions and identify patterns and anomalies. However, this can create a surveillance culture and may not be effective in all cases.

A privacy-preserving solution exists in the form of zero-knowledge proofs (ZKPs). Like a government ID provider, a trusted entity verifies the user's age and generates a cryptographic proof confirming they are over the required age.

Websites would only need to check the proof, not the underlying personal data, ensuring privacy while keeping minors at the gates. No centralized data storage would be required, reducing the burden on platforms such as Google, Meta and WhatsApp and eliminating the risk of data breaches.

Adopting and enforcing ZKPs at scale presents some difficulties. ZKPs can be complex to implement and the notion of “don't trust, verify,” proven by indisputable mathematics, may cause some regulatory skepticism. For example, policymakers might be less likely to trust cryptographic proofs than visible ID verification.

There are also occasions when companies may need to disclose personal information to authorities, such as during an investigation into financial crimes or government inquiries. This would challenge ZKPs, whose very intention is for platforms not to hold this data in the first place.

Moreover, ZKPs struggle with scalability and performance, being somewhat computationally expensive and tricky to program. However, efficient implementation techniques are being explored and breakthroughs, such as the Noir programming language, are making ZKPs more accessible to developers, driving the adoption of secure, privacy-first solutions.

Google's recent move to adopt ZKPs for age verification is a promising signal that mainstream platforms are beginning to embrace privacy-preserving technologies. But to fully realize the potential of ZKPs, we need more than isolated solutions locked into proprietary ecosystems.

Crypto-native wallets can go further. Open-source and permissionless blockchain-based systems offer interoperability, composability and programmable identity. With a single proof, users could access a range of services across the open web — no need to start from scratch every time, or trust a single provider (Google) with their credentials.

ZKPs flip the script on online identity — proving what matters, without exposing anything else. They protect user privacy, help platforms stay compliant and keep minors off restricted content, all without creating new honeypots of sensitive data.

Google's adoption of ZKPs shows mainstream momentum is building. But to truly transform digital identity, we must embrace crypto-native, decentralized systems that give users control over what they share and who they are online.

In an era defined by surveillance, ZKPs present a better path forward — one that's secure, private and built for the future.