Critics say the California Age-Appropriate Design Code Act, a digital privacy law for minors, could lead to invasive age verification methods like face-scanning
While the California Age-Appropriate Design Code Act was hailed as a victory for digital privacy, critics warn of a litany of unintended consequences. Tweets: @carnage4life , @eff , @reason , and @reason Tweets: Dare Obasanjo / @carnage4life : A digital privacy law that requires stringent age verification is a contradiction. You can't definitively prove the person accessing an app or website is above 18 without massive privacy invasions. How can you prove Dare's teenage son didn't tweet this? https://reason.com/... @eff : “As currently written, we believe that the standard businesses are asked to consider—'the best interests of children'—is too vague and perhaps incoherent,” EFF had written in urging Gov. Gavin Newsom to veto the bill. https://reason.com/... @reason : Ironically, online businesses could soon enact invasive age-verification requirements to comply with what is supposedly a digital privacy law. https://reason.com/... @reason : The vague language leaves unclear what kinds of business might be subject to the law's constraints and what specific actions companies must take to comply with the law. https://reason.com/...
Context & Ripple Effects
California lawmakers had framed the proposal as child-data protection modeled on the UK approach in an earlier bipartisan push for a youth privacy code. The criticism here identifies the enforcement tension at its center: distinguishing minors from adults may require collecting more sensitive information than a privacy measure is meant to limit.
Later coverage shows that concern becoming a broader policy and product question, from the nationwide push to age-gate online access to websites’ use of AI facial age scanners. California’s subsequent device- and app-store age-verification law makes the question of where verification responsibility sits especially consequential.
First-order effects
- Online services subject to California’s youth-design requirements face pressure to establish users’ ages, while EFF, Reason, and Dare Obasanjo argue that stringent checks can introduce face-scanning and other privacy-invasive collection.
- Minors and adults using the same services may encounter age-gating or age-estimation flows that require providers to process identity or biometric-adjacent signals.
Second-order effects
- Verification vendors gain a clearer use case as platforms seek ways to separate minors from adults; the later reporting on AI facial age scanners illustrates the type of tool that can fill that demand.
- App stores and device makers become more central compliance gatekeepers as California later assigns them age-verification duties under AB 1043, shifting some burden away from individual websites and apps.
Third-order effects
- If child-safety rules continue to rely on age assurance, digital privacy policy will increasingly hinge on whether age can be proven with data-minimizing methods rather than persistent identity checks.
- California’s sequence of youth-protection and verification measures points toward access control becoming infrastructure shared among platforms, app stores, device makers, and specialized verification providers.
The trend: Child-safety regulation is moving internet access from self-declared age toward increasingly formal age-assurance systems, intensifying the trade-off between youth protections and data minimization.