Finally, a Path Forward for Online Age Verification

For years, Utah and other states have struggled to craft legislation that keeps minors away from adult content online. The intent behind these efforts—to empower parents to guide their children’s online activity – has never been an issue. The internet is a double-edged sword, offering both incredible educational and social opportunities as well as risks that many parents seek to mitigate. 

The issue has always been the age verification mechanisms required to differentiate minors from adults that raise red flags. The fundamental flaw with most age verification bills is that they run afoul of the First Amendment and create significant privacy risks. Requiring users to present an ID or other identifying information to post content online undermines anonymous speech—a right protected by the Constitution. Moreover, mandating the upload of personal information opens the door to data breaches and government overreach. 

While the desire to shield minors from inappropriate content is good, the cost of eroding constitutional rights and personal privacy is simply too great. That is why I have opposed these age verification bills in Utah for three years now, including this year’s app store bill. 

I will continue to oppose such mandates in the future, but I want to be clear that I don’t oppose the intent. Moreover, just because age verification has been problematic in practice does not mean it is impossible to achieve in a way that both protects privacy and upholds constitutional rights. Achieving this balance, however, requires a fundamental rethinking of how individuals identify themselves online and how that information is authenticated without compromising anonymity.

Fortunately, Senate Bill 260, sponsored by Senator Kirk Cullimore, is a promising step in this direction. The bill directs the Department of Government Operations to study and develop recommendations for a Digital ID system that meets rigorous privacy and security standards – including protections from government surveillance. Unlike traditional identification methods that expose excessive personal details, a properly designed Digital ID system could allow individuals to verify their age without disclosing their actual date of birth or other sensitive information.

This approach is ambitious but necessary. The digital world is evolving, and existing forms of identification—rooted in hard-to-replace physical documents and centralized databases—are ill-equipped to handle the challenges of online authentication. A Digital ID system designed with privacy, autonomy, and anonymity at its core could serve as a transformative solution not just for online age verification but for a wide range of identity verification needs in the digital age.

A particularly crucial section of SB 260, found between lines 110 and 139, outlines key protections that a state-endorsed digital identity must include for purposes of age verification:

“(2) The state may not endorse an individual’s digital identity unless: … (e) the state-endorsed digital identity enables an individual to: … (ii) verify that the individual’s age satisfies an age requirement without revealing the individual’s age or date of birth.”

This provision establishes an important safeguard: it ensures that users can prove they meet age requirements without exposing unnecessary personal information. In a world where cyberattacks are a matter of “when,” not “if,” this aligns with modern cryptographic techniques such as zero-knowledge proofs which allow verification of a piece of information without revealing the information itself. If implemented correctly, this could offer a way forward that respects both parental concerns and individual privacy and speech rights.

Of course, there are many unanswered questions. What technology will be used to create and manage these Digital IDs? How will the state ensure that private data is not misused or stored in a way that invites hacking and surveillance? Will participation in the system be truly voluntary, or will it eventually become a requirement for broader online activity? These are the kinds of questions that the Department of Government Operations must answer through its study.

The earliest possible reporting on the study’s findings would be October 2025, meaning that any potential implementation is still years away. However, SB 260 represents a crucial step toward a future where identity verification is both privacy-protective and constitutionally sound. 

Simply mandating age verification without addressing the privacy and security implications creates serious risks. By contrast, a well-designed Digital ID system—one that allows for secure, anonymous age verification—could provide a path forward that respects both the concerns of parents and the constitutional rights of all internet users.

The road to achieving this vision will be long and hard. There will be significant challenges in ensuring that any Digital ID system meets the high standards outlined in SB 260. But by taking a thoughtful, proactive approach, Utah has the chance to shape the future of digital identity in a way that is consistent with both privacy and free speech principles. Regardless of your position on age-gating the internet, that is a goal worth striving for.