Imagine you had to show your papers before you could walk into a shopping mall. Not to buy alcohol, not to enter a bar, just to walk in, look around and meet a friend.

That is the direction the EU is taking for the internet. After pressure from member states, it is now setting the course with its “KIDS Act” for a general digital ID requirement, far-reaching surveillance infrastructure and the exclusion of large parts of the population from digital life. The proposal is sold as child protection. It fails exactly at that goal and instead establishes an intrusion on fundamental rights.

In practice, you would prove your age with an official proof of identity, through a wallet or app solution.

First social media, then everything

It did not start this big. At first, the EU had ambitions to age-gate only social media platforms with harmful design features and video-based services. That changed with the expert report released this summer. Suddenly the net is cast far wider, taking in app stores, video games, AI chatbots and more.

What began with 18+ content led to social media and AI chatbots. Tomorrow it could sweep in sensitive topics like reproductive health, sex education, LGBTQ+ issues or controversial public debates. Each expansion can be twisted to be justified in the name of child protection. Taken together, they add up to a system in which free and equal access to the internet, our shared space for communication and exchange, depends on your ability to produce an ID or pass a verification check.

It is as if you had to show your papers not just to enter the bar, but to walk into the shopping mall. This is no quick glance from a bouncer who forgets your face a second later. Your ID is tied to an identity infrastructure that outlasts the moment.

Grandma meets a locked door

And who is actually stopped at the entrance? The proof of identity is out of reach for many. People without valid ID documents, refugees, people with an unresolved residency status and those without a fixed address risk being effectively locked out of the central spaces of digital communication. Add to that people without a suitable smartphone and elders who lack the digital skills to use such a system.

So who is actually shut out of social media? It's not the 12-year-old who followed a step-by-step tutorial and installed a VPN in ten minutes. It's grandma, trying to keep up with her grandson on Facebook. The teenager finds the workaround, but the pensioner finds a locked door. A measure that is practically out of reach for part of the population cannot be considered proportionate.

Locked-out teens don’t just log off

The KIDS Act is NOT child protection. When large, regulated platforms become off-limits to teenagers, they don't simply log off. In the worst case, young people will move to dangerous and unregulated platforms that potentially harm them more. For queer youth without support in their family environment or for anyone who otherwise feels alone with their worries, online spaces are often the only community they can find. Those who lock them out protect no one, but take something away from precisely those who need it most.

Meanwhile, age limits create a false sense of security among parents. Lean back, relax, the EU has got your back. But once people believe the state has taken over control, their own supervision slips. Do you really think the EU can parent your children better than you can?

Children can easily circumvent age verification with a VPN, and they hide it out of fear of punishment. That makes them less willing to turn to their parents when it matters, whether in cases of grooming, cyberbullying or contact with harmful content. Platforms lose their incentive too. If age verification lets providers assume there are no minors left, why invest in moderation, education or child-friendly default settings? On paper, the problem has been solved, but in practice it has simply been moved out of sight.

Surveilling family structures

New and particularly dangerous in the EU draft is parental surveillance. For children under 15, parents can set up "parent accounts" with limited functions, through which mom and dad can see every click, every message, and every picture. This would accustom young people to everyday surveillance of their online behavior.

To create such a surveillance account, the parents must identify themselves too. Platforms would be enabled to access state databases and analyze interactions between parents and children. An age limit thus becomes an ID requirement for the entire family, with all the risks of ID uploads and facial recognition. Families without suitable documents simply remain excluded, and patchwork, foster and atypical family models would be permanently disadvantaged.

As so often, the data protection section reads most cynically. The Commission sells us supposedly super data-minimizing "zero-knowledge proofs," yet it plans access to birth registries and parental self-declarations to prove legal guardianship to platforms. It is completely unclear to us how this is supposed to be implemented in practice.

Bye bye fediverse

And as the crowning touch, unlike under the DSA, small platforms such as Mastodon or F-Droid are not spared. Billion-dollar corporations like Meta, Google, and Apple would have to meet the same requirements as small European providers. Wikipedia and Codeberg get their exemption, but a decentralized network like Mastodon does not, even though it is just as open and run by volunteers.

This means age verification for every single instance and every software marketplace, with all the bureaucratic weight that comes with it. A Mastodon server with a few hundred users simply cannot afford this infrastructure, while a Meta or TikTok pays for it out of petty cash. In the end, the only options are to shut down or to kick young people out of the privacy-friendly, open parts of the internet. Ultimately, only the biggest Big Tech companies will survive, while alternatives disappear.

The Fediverse thus won't die from lack of demand, but from a law that promises child protection and kills the only spaces that would be a real alternative to Big Tech.

Watched even if no one is looking

Our case against mandatory age and identity checks doesn't begin with the question of whether these systems are secure today. It begins with what they could become. Once access to core digital services is tied to age or identity verification across the board, Europe gets a technical infrastructure that could in principle link identity data with usage data. The EU is currently adamant about safeguards against exactly that, but infrastructure does what it is configured to do, and configurations can change as easily as political majorities in parliament.

No actual abuse or tracking is even required for the damage to occur. The mere feeling of being watched is enough to trigger a chilling effect. This could lead people to avoid legal content, hold back in their communication or stop voicing opinions, even when they have nothing legally to fear. That effect sets in whether or not anyone is actually looking. In the end, it feels as if the EU is installing dummy surveillance cameras across the internet and calling it protection. The cameras may not even need to work, but the behavior may change regardless.

How to build a safer internet for everyone

We must protect every user. The problem is not that children are online, but that platforms are built to keep everyone hooked with dark patterns, addictive algorithms and unfair personalisation. Those harms don't disappear at 15 and they won't be solved by checking IDs at the door.

The KIDS Act offers insufficient protection and it serves as a convenient excuse to hollow out the upcoming Digital Fairness Act. The DFA could actually take on manipulative design, instead of letting Big Tech off the hook with an age gate. The Digital Services Act already offers powerful instruments, but they only work if they are enforced, which means more litigation and more consequences for platforms that ignore the rules.

If we do want to give families more control, there is a better way. Parents need the right tools, not an identity infrastructure. Device-based age verification keeps the check where it belongs, on the device in the family's own hands, without handing sensitive identity data to platforms or building a surveillance framework along the way. We have outlined how this could work here.

Protecting children means making the internet safer for everyone, not making it harder for everyone to get in.