EFF: Zero-Knowledge Proofs Won't Save Age Verification

Age-verification laws are spreading fast across the internet: roughly half of all U.S. states have already passed rules of one kind or another, the KIDS Act and the Kids Online Safety Act are advancing at the federal level, European Union countries are preparing a centralized app by year's end, and Australia has one extremely sweeping restriction in force. Advocates of these measures are convinced they've found a “silver bullet” — Zero-Knowledge Proofs (ZKP). The Electronic Frontier Foundation (EFF) argues that this is an illusion.

How it works

ZKP is an elegant cryptographic tool, but it was never designed for age verification. It lets one computer prove to another that some statement is true without revealing the underlying data. The user's device records a “commitment” regarding the relevant information, and the site's server generates mathematical “challenges” that can only be answered correctly if the statement is true. To avoid slowing the internet down with a lengthy back-and-forth, a non-interactive, condensed version is used — zk-SNARK, where the answer is hashed and verified instantly. Ideally, this makes it possible to confirm adult or child status without handing over any other personal data.

Why it's no cure-all

The problem, in EFF's view, runs deeper than the technology. A token certifying age at every login creates a permanent link to the entity that issued it. That entity can track every use of the credential, amassing a dangerous trail of metadata — and, under pressure from an authoritarian state, could strip a person of access to a service and, in effect, to the internet itself. A single point of failure contradicts the very idea of a free and open network.

Practice bears out these fears. In the EU, an age-verification “mini-wallet” is already being rolled out inside the European Digital Identity Wallet, with the promise of working ZKP. Yet it turned out that the ZKP features themselves are only included in a closed demo build, unavailable to ordinary users. What's more, a security researcher used a hastily assembled Chrome extension to make the app accept the same “18+” token over and over, without requesting a fresh verification.

More than 400 security specialists signed an open letter: age checks, even ones built with privacy in mind, will do more harm than good. Once the “mini-wallet” is fully embedded in the EUDI Wallet, the same vulnerabilities will scale up — and passports, driver's licenses, travel data and financial information will be at stake.

Conclusion

No method of age verification is ever simultaneously private, accurate and universal without serious security risks. ZKP does not resolve this paradox — it merely defers the question of trust, resting, as EFF quips, on technical ignorance and “magical thinking” about how the internet works. Mandatory online age verification in any form remains a dangerously flawed idea.

Source: Lobsters