The ID Trap: How "Protecting Kids" Became a Surveillance Machine

Something is being built right now — quietly, legislatively, almost beneath notice — and by the time most people realize it exists, it will already be infrastructure.

In the past few years, age verification has transformed from a niche policy debate into the defining privacy threat of our generation. At least 25 U.S. states have enacted age verification laws targeting social media and pornography websites, requiring government-issued ID, biometric data, or third-party verification systems — with seven major implementation dates landing in 2026 alone. The UK is actively enforcing new ID requirements. Australia has banned social media for under-16s. Federal legislation in the U.S. has stalled but hasn’t died. And every week, the list grows.

The story being sold is simple: we need to protect children online. That story is being used to build something else entirely.

The Paradox at the Heart of It

By attempting to enforce age verification, companies end up undermining the very privacy of the users they claim to protect. Researchers call it the “age verification trap”: the tools being deployed don’t just check a birthdate — they demand government-issued IDs, facial scans, and biometric analysis powered by AI.

There’s a reason this is inescapable. To verify that a child isn’t accessing a platform, the system must verify everyone. That means every adult who has used social media anonymously for years is suddenly being asked to hand over their driver’s license or submit to a facial scan just to scroll their feed. The internet as anonymous public space — gone.

When age verification laws took effect in Louisiana and Utah, traffic to affected sites plummeted as users refused to surrender their identification. This is what digital self-defense looks like when people still have the option to walk away. But as requirements spread to more platforms and more states, that option disappears.

The Companies Cashing In

Here’s who actually benefits from all of this. Age verification isn’t just policy — it’s an industry. Identity verification companies have raised hundreds of millions in venture funding, betting that age-gating will become permanent internet infrastructure. Their pitch to investors is straightforward: every major platform will need these services, creating a recurring revenue stream from hundreds of millions of users.

The breaches and controversies below are not cherry-picked worst cases. They are the current state of an industry being handed your most sensitive data by legal mandate.

AU10TIX

AU10TIX wasn’t born in a garage in Silicon Valley. It was founded as the technology arm of ICTS International, a Dutch security company that itself was established by former members of the Shin Bet, Israel’s domestic intelligence service. That lineage is not incidental to what the company does — it is the point.

Multiple reports have connected AU10TIX founder and current chairman Ron Atzmon to Unit 8200, the IDF’s elite signals intelligence division, though Israeli media have disputed this, stating he served in the Israeli Navy. MintPress News ↗ Regardless of Atzmon’s personal service record, the company’s engineering staff includes confirmed Unit 8200 veterans. The unit is responsible for mass surveillance and is widely documented to use collected information for political persecution and recruitment of informants. Unit 8200 has been described as providing Israel with 90 percent of its intelligence material, and functions explicitly as a pipeline into the private tech sector — more than 1,000 companies have been founded by its veterans. Waze, Wix, Viber, and NSO Group — creator of the Pegasus spyware — all share this origin.

Atzmon is not AU10TIX’s only connection to Israeli military intelligence. Several of the company’s engineers previously worked in Unit 8200 before joining the firm. Chief marketing officer Amazia Keidar previously worked in senior marketing roles at Cellebrite, the Israeli firm known for selling phone-cracking technology to law enforcement agencies globally. VP of EMEA sales Edo Soroka previously served as sales director at AnyVision, an Israeli startup accused of using facial recognition to surveil Palestinians in the occupied West Bank. ICTS International’s supervisory board chairman Menachem Atzmon was convicted in 1996 of campaign finance fraud while serving as co-treasurer of Netanyahu’s Likud party.

AU10TIX is not a neutral technology company. Its leadership was trained in state-level surveillance, its key personnel have cycled through the Israeli military-industrial intelligence complex, and it now holds biometric identity data on tens of millions of people globally — users of X, TikTok, Uber, PayPal, LinkedIn, Coinbase, eToro, Fiverr, Bumble, and Upwork.

The facial recognition technology the company uses to authenticate users is not incidental either. AU10TIX uses the same class of facial recognition technology developed for Israeli military and intelligence operations — technology used to compile images of Palestinians crossing into Israel from the West Bank as part of one of the most comprehensive surveillance architectures in the world. When you upload a selfie to verify your age on a platform using AU10TIX, the algorithmic pipeline your face travels through was forged in that context.

The breach 404 Media ↗

In December 2022, admin credentials at AU10TIX were likely first compromised through malware. In March 2023, those credentials appeared on a public Telegram channel. In June 2024 — a full year and a half later — cybersecurity experts discovered the credentials were still working.

The exposed credentials allowed access to a logging platform containing links to identity documents and verification results, including names, dates of birth, nationalities, ID numbers, and images of those documents. Passports. Driver’s licenses. Facial images. All sitting exposed behind credentials that were circulating on Telegram.

AU10TIX’s initial response was dismissive. When 404 Media first contacted the company, they claimed the credentials had been promptly revoked. Researchers then demonstrated the credentials were still functional, directly contradicting that claim. The company later admitted the data was “potentially accessible” but claimed no evidence of exploitation. We have only their word for that.

Journalist and Israeli national security analyst Richard Silverstein noted that AU10TIX must maintain a vast database containing personal information on millions of people to deliver its fraud-detection product. The opacity is structural, not accidental.

Perhaps most telling: X’s AU10TIX verification requirement is not available in the EU, UK, or European Economic Area — almost certainly because data protection laws in those jurisdictions would make the arrangement illegal. The company enforces these requirements on users in countries with weak protections while quietly carving out exemptions for the places where accountability has teeth. That tells you exactly what the risk calculus looks like from the inside.

Persona

Persona Identities, Inc. is a San Francisco-based identity verification startup founded in 2018 by Charles Yeh and Rick Song, both former engineers at Dropbox and Square respectively. Its pitch is clean and familiar: a privacy-respecting age verification platform that checks who you are, then forgets you exist. Its client list tells a different story. Persona currently runs identity and age verification for OpenAI’s ChatGPT, Roblox, LinkedIn, Square, Coursera, Lime, and others. OpenAI’s own help documentation confirms that users who need to verify being 18+ are routed to Persona, which may ask for a live selfie and a government ID.

The Thiel problem

Persona’s investors include Founders Fund, Peter Thiel’s venture capital firm — the same firm that co-founded Palantir, which is ICE’s surveillance contractor of choice. Founders Fund led Persona’s $150 million Series C Persona ↗ and co-led its $200 million Series D alongside Ribbit Capital. Persona ↗

Persona has repeatedly denied any operational connection to Palantir or to government agencies. In a customer email, the company stated it does not work with the Department of Homeland Security or ICE, and that Thiel holds no board seat, offers no advice, and plays no operational role. Founders Fund and other investors, Persona added, have zero access to personal user data. Those denials may be technically accurate. They do not resolve the structural concern — that a company handling the biometric identities of millions of ordinary users is financially tied to the primary architect of ICE’s targeting and deportation infrastructure.

The government server Primary Source ↗

In February 2026, independent cybersecurity researchers discovered something that should have been impossible. On February 16, 2026, researchers published a blog post documenting that nearly 2,500 of Persona’s frontend source files were publicly accessible on a U.S. government-authorized FedRAMP endpoint. No exploit was required. “We didn’t even have to write or perform a single exploit; the entire architecture was just on the doorstep,” one researcher wrote.

What those files contained was the real revelation. The exposed code documented 269 distinct verification checks that Persona runs on users, far beyond simple age confirmation. The system can screen users against global financial watchlists, flag potential money launderers or terrorist financiers, run facial recognition against lists of politically exposed persons, compare selfies to political figures using facial similarity scoring, and flag individual users as a “suspicious entity” based on their face alone. Built-in functionality includes filing Suspicious Activity Reports directly with the U.S. Treasury’s financial intelligence unit, FinCEN, and Canada’s equivalent, FINTRAC.

The checks are defined as a TypeScript enum in the exposed source. The structure researchers found, paraphrased from the primary disclosure at vmfunc.re:

Persona’s platform can collect and retain for up to three years: IP addresses, browser and device fingerprints, government ID numbers, phone numbers, names, faces, and a battery of selfie analytics including suspicious-entity detection, pose repeat detection, and age inconsistency checks.

The company’s CEO Rick Song moved quickly to downplay the findings. According to Persona’s public statements and correspondence with researchers, Song characterized the exposure as less significant than it appeared, maintained that all data is deleted immediately after verification, and denied any ties to Palantir, ICE, or government data pipelines. Persona acknowledged the exposed endpoint as a development environment not connected to live customer data, describing it as an oversight. Researchers responded that the TLS certificates on the domain showed it had been active since November 2023 — nearly two years before it was discovered.

The FedRAMP endpoint detail warrants precision: Persona already holds FedRAMP Authorized status at the Low Impact level, achieved on October 7, 2025. It is now pursuing Moderate Impact authorization and confirmed it is in discussions around “a couple of potential contracts” with the government, which it claims are limited to workforce account security and do not involve ICE or DHS. The implication is more alarming than initially framed — this was not a rogue development environment. The server where nearly 2,500 source files sat exposed is already an authorized federal platform.

Discord’s short, damaging partnership

Discord had been using Persona to verify ages for UK users under the Online Safety Act, requiring users to submit either a government ID or a video selfie. Following the researcher disclosures, Discord announced it would not be proceeding with Persona for identity verification. Both companies confirmed the partnership lasted less than a month.

An archived version of Discord’s FAQ — since deleted — appeared to contradict the company’s claims about data storage: “If you’re located in the UK, you may be part of an experiment where your information will be processed by an age-assurance vendor, Persona. The information you submit will be temporarily stored for up to 7 days, then deleted.” The phrase “you may be part of an experiment” is not something users had consented to. Discord never proactively disclosed it.

This wasn’t even Discord’s first third-party identity vendor disaster. In October 2025, a separate breach exposed over 70,000 government-issued ID images belonging to users who had submitted them in age appeal cases — that breach was attributed to Discord’s customer service provider, 5CA, not to Persona directly. Discord said it revoked the provider’s access and launched a forensic investigation.

Song’s defense was that Persona verifies identities privately to businesses, not that users should publicly display their faces to the entire internet. The distinction is technically valid — but it nevertheless underscores a basic asymmetry: the people building these systems experience them very differently from the millions of ordinary users being funneled through them.

Yoti

Yoti is a British company founded in 2014 that operates age verification and digital identity services. Its clients include many pornography websites, Instagram, and the retailer John Lewis. In July 2025, the UK government announced it would begin testing Yoti’s facial age estimation technology to assist in official age assessments of asylum seekers who arrive without valid documentation. That last sentence is worth rereading. A company that started verifying ages on adult websites is now being used by the British government to assess the ages of refugees. Yoti alone reported processing over 400 million age verifications globally by 2025. The company has raised $58 million, with investors including HSBC and Lloyds Banking Group.

An investigation by Mint Secure GmbH found that Yoti extensively tracks users without consent, likely in violation of GDPR. The investigation found Yoti’s Android app processes Advertising IDs and forwards them to a third-party analytics company called Adjust. Yoti’s own response confirmed the Advertising IDs are used in their apps. Their explanation: this is “legitimate interests of the company.” The company whose pitch is privacy-by-design was shipping advertising trackers in their verification app.

Yoti’s own privacy documentation reveals it shares your email address with Equifax, which then “re-uses pseudonymised data to enrich their consumer insights and other fraud identity products.” For users in Brazil, Yoti shares your national ID number with a federal company called Serpro, which independently retains that number for five years as a billing record.

Veriff and IDMerit

The breach problem is not isolated to AU10TIX. Veriff’s systems were compromised in December 2025, leaking Total Wireless customer identity data. This was the third major identity verification provider security failure within 18 months.

In November 2025, an AI-powered identity verification company called IDMerit left one billion personal records exposed on the public internet — full names, national ID numbers, dates of birth, home addresses, and phone numbers across 26 countries — in a MongoDB database with no password protection. The exposure occurred for 99 days before public disclosure.

Age verification vendors charge between $0.10 and $2.00 per check, require proprietary SDKs, demand API keys tied to commercial accounts, and operate cloud-only with no self-hosted option. Your age verification data goes to a third-party cloud service. Every time.

The School Infrastructure Problem

For students, this isn’t abstract. Age verification doesn’t live only on social media apps. The same third-party identity vendors pitching services to Instagram and TikTok are actively marketing to educational technology platforms, standardized testing providers, and school districts. Proctoring software already uses facial recognition and identity capture. Districts adopting ed-tech “safety” software are signing contracts with companies that are one undisclosed partnership away from the same vendor landscape described above.

The infrastructure bleeding into student life isn’t hypothetical. ID.me, which became infamous for its role in federal benefits verification, was simultaneously aggressively pitching services to state education agencies. Proctorio, used by millions of students for exam monitoring, operates continuous biometric capture during tests. These systems are legally distinct from consumer age verification — but they are technically identical. Same facial mapping. Same data retention. Same offshore cloud servers.

The ACLU and EFF have flagged an additional vector: LGBTQ+ youth and minors seeking information about reproductive health or mental health support are disproportionately harmed by verification walls. These are young people who are specifically using pseudonymous online access because they cannot safely seek information in their physical environment — their school, their home, their community. Mandatory identity disclosure at the point of access is functionally a ban for users who cannot afford to be identified.

The Lobbying Machine

Understanding who’s pushing these laws requires understanding that “child safety” has become one of the most powerful political shields in Washington. It is almost impossible to oppose a bill named the “Kids Online Safety Act” without being framed as wanting children to suffer. Lobbyists and corporate strategists know this. They have built an entire industry around exploiting it.

The KOSA Fight

The Kids Online Safety Act (KOSA) was first introduced in 2022 by Senators Richard Blumenthal and Marsha Blackburn. KOSA has been supported by Microsoft, X, and Snap, as well as the American Academy of Pediatrics, the American Psychological Association, The Heritage Foundation, Focus on the Family, and Unilever. That is a remarkable coalition — evangelical conservatives, corporate giants, and tech companies all united under one banner.

KOSA has also drawn serious opposition. The ACLU warned it would “undermine the rights of young people and adults alike.” LGBTQ+ advocacy organizations raised concerns that the bill’s broadly worded provisions could be weaponized by state attorneys general to restrict access to gender-affirming care and reproductive health information for minors. Those aren’t fringe concerns. They are what happens when you give state officials broad discretion to define what “harms” children.

The bill passed the Senate 91–3 in 2024. It still failed to become law after tech companies, led by Meta, spent $51 million in lobbying in the first three quarters of that year to stop it in the House. The bill was reintroduced in 2025 and remains in motion.

Meta’s Astroturf Operation: A Timeline

Here is one of the most cynical corporate lobbying operations in recent memory, documented in federal filings. OpenSecrets ↗ Senate LDA Filings ↗

Why would Meta go to all this trouble? Because Meta faces a potential fine under federal child privacy laws of tens of billions of dollars the moment it “actually knows” users under 13 are on its platforms. If the App Store Accountability Act passes, the age verification requirement — and the legal liability — moves to Apple and Google. Meta gets clean hands while its competitors absorb the compliance costs.

The framing says it all: Meta is forcing Apple and Google to build, maintain, and bear legal liability for a wildly complex state-by-state identity verification system, while Meta’s own apps face zero new mandates.

The Structural Problem

Even if every company in this space had the best intentions, the architecture itself is broken.

Age verification systems are surveillance systems. Mandating them forces websites to require visitors to submit information — government-issued identification — to companies that are, empirically, not capable of securing it. Data breaches of this sensitive information are not a hypothetical concern. It is simply a matter of when the data will be exposed.

Unlike a password or credit card number, a government-issued ID number cannot be changed once exposed. It remains a usable fraud instrument indefinitely, enabling synthetic identity fraud, account takeover, SIM swap attacks, and targeted spear-phishing using the victim’s exact personal details.

The AU10TIX breach, the Veriff breach, the IDMerit exposure, the Persona FedRAMP disclosure — these are not aberrations. They are the predictable outcome of an architecture built on centralized data retention at scale.

And it gets worse. Deepfake use has increased nearly 8,000% year over year, rendering much of the verification software on the market essentially useless — which means companies keep escalating toward more invasive methods to stay ahead of circumvention. The answer to failed surveillance is always more surveillance.

The Chilling Effects

For students and young people specifically, this matters beyond the abstract. Age verification doesn’t just expose your data. It changes what you can access.

When platforms implement verification requirements, they have every incentive to over-restrict rather than under-restrict — the legal liability of accidentally letting a minor through is higher than the cost of blocking legitimate users. LGBTQ+ advocacy organizations and civil liberties groups have repeatedly flagged that these systems can be used to cut off minors from resources on gender identity, reproductive health, mental health support, and other topics that may be framed as “harmful” depending on which state’s attorney general is doing the interpreting.

The ACLU called this clearly: KOSA “compounds nationwide attacks on young peoples’ right to learn and access information, on and offline.” When book bans are sweeping school libraries and classroom censorship is expanding, adding a federal framework that lets state officials define what’s harmful to minors online is not a neutral act.

The EFF has warned that mandatory verification undermines anonymous speech, threatening LGBTQ+ youth, survivors of abuse, and political dissidents who rely on pseudonymity for safe participation online. These are not hypothetical populations. They are your classmates.

What Actually Works

None of this means children’s safety online isn’t a real issue. It is. Algorithmic manipulation targeting minors is real. Predatory design is real. But the solutions being deployed — mass identity collection, centralized biometric databases, legislative frameworks written by lobbyists for corporate advantage — do not solve those problems. They create new and larger ones.

Privacy-preserving alternatives exist. The most technically robust is the zero-knowledge proof (ZKP): instead of handing a bouncer your entire ID, a ZKP is a cryptographic system that simply flashes a green light confirming you are over 18 — leaving the verifier with zero knowledge of your name, address, or exact birthdate. No data is transferred except the single boolean answer. No database is created. Nothing can be breached because nothing is stored.

A second underutilized alternative is device-level age signaling. Operating systems like iOS and Android already allow parents to configure managed restrictions directly on the device — restricting app downloads, content categories, and screen time — as a local setting that never leaves the phone. This approach entirely negates the need to transmit biometric data to an offshore cloud server. The verification happens on hardware the parent controls, with no third party involved. The limitation is political, not technical: this model generates no recurring revenue for the verification industry and cannot be mandated through legislation in a way that benefits corporate lobbyists.

One promising institutional model involves third-party nonprofit infrastructure that checks a government ID and immediately deletes the sensitive data, issuing only an age-confirmation token. Ireland is developing a government-run verification app where platforms query the app and receive only a yes/no answer — is this user 18 or not? — with no identity information shared.

These aren’t impossible. They’re just less profitable for the age verification industry, less useful as competitive weapons for Meta, and less legible as political slogans than “protect the children.”

What You Can Do

The Electronic Frontier Foundation (EFF) tracks age verification legislation and provides tools for contacting your representatives. Fight for the Future runs active campaigns against the most invasive legislation. Your state’s ACLU chapter is almost certainly monitoring bills in your legislature right now.

When you hear a politician say they’re protecting kids with age verification, ask who wrote the bill. Ask which companies are lobbying for it. Ask who bears the cost and who bears the liability. Ask why the platform actually causing harm isn’t the target of the legislation.

AU10TIX was built by military intelligence veterans and left your passport sitting exposed on Telegram for 18 months. Persona was funded by Peter Thiel’s firm and was running a government-authorized server with 269 undisclosed surveillance checks for nearly two years before anyone noticed. Yoti was sharing your email with Equifax while advertising itself as privacy-first. Meta funded a fake grassroots movement to make sure it was someone else’s problem.

The answers are usually not what the press release says they are.

hapara.fail’s The Takedown is a student privacy research and advocacy publication. We have no corporate sponsors, no advertising, and no institutional affiliation. If you have tips, internal documents, or information about surveillance and privacy in educational or consumer technology, please contact a9x@hapara.fail.