The push to protect children online through age verification laws is creating a surveillance apparatus that could expose massive amounts of personal data, according to Cardano Foundation CEO Frederik Gregaard. In the past two years, identity verification provider AU10TIX exposed drivers' licenses to hackers for over a year, and Discord's age-verification vendor was breached, leaking potentially 70,000 government IDs. Gregaard warns that as the U.S. KIDS Act moves through Congress, the safety system intended to shield minors could become a breach vector, especially with AI accelerating the speed and damage of hacks.
The KIDS Act and its hidden mechanism
The U.S. House passed the Kids Internet and Digital Safety (KIDS) Act on June 29, 2026, by a vote of 267-117. The bill does not explicitly mandate age verification, but it makes platforms liable for harm to minors who access their services. Gregaard argues this creates a risk calculus where companies either verify age or face legal exposure, effectively forcing verification without an outright requirement. He calls this a "technically true defense that misses how the incentive actually works."
The surveillance trap
Once disclosure becomes the price of access, the information dragnet tends to expand, Gregaard writes. A tool built to confirm a user's age becomes a tool that confirms their full identity, and the resulting database becomes a liability waiting for the next breach. He points to the AU10TIX and Discord incidents as real-world examples of how age-verification systems can fail, exposing sensitive data like driver's licenses and government IDs.
A privacy-preserving alternative
Gregaard highlights the Veridian system, built by the Cardano Foundation, which allows users to prove they are over or under a specific age without revealing any other data. Utah's State-Endorsed Digital Identity (SEDI) legislation has already adopted this approach. He argues that lawmakers should favor narrow, purposeful tools that minimize data retention and use privacy-preserving verification where verification is truly needed.
The path forward
Gregaard concludes that children deserve protection online, but not at the cost of turning the internet into an identity checkpoint. He urges Congress to ensure that the KIDS Act and similar legislation prioritize data minimization and privacy, building safety without surveillance.