This is the fork worth fighting for, and it is being lost because the debate is stuck on the wrong axis. Lawmakers frame the choice as security versus freedom; critics frame it as protection versus privacy. Both accept a false premise: keeping children out of adult spaces requires identifying adults. It’s not like that. The real choice is between two ways to verify age: one that minimizes the data and forgets you the instant you walk by, and another that maximizes the data and remembers everyone forever. Only the second is surveillance, and only the second is currently the path of least resistance.
The window to insist on the former is now, while these bills are still pending. The KIDS Act reaches a skeptical Senate. Chat Control 2.0 aims for a political agreement in July. In both cases the principle has effectively been established that platforms should be able to distinguish adults from children. What hasn’t been decided is whether that capability is based on privacy-preserving evidence or a mountain of loaded passports. This is a technical decision with consequences for civil liberties, and at this point it is being made largely by default.
There is a bigger reason to get this right and do it now. The old classification of Internet traffic as “robot or human” is already crumbling: a third verified category is arriving, AI agents who act, with authorization, on behalf of people, companies and governments, and will soon have to demonstrate what they are allowed to do without unmasking whoever is behind them. “Know your agent” will require the same privacy-preserving architecture that we are discussing now for individuals. Get it right for the human age controls and we’ll set the pattern for everything that follows. If we decide wrong, we will connect surveillance to the identity layer of the Internet, for both humans and machines.
