The U.S. House of Representatives passed the KIDS Act on June 29, 2025, with a vote of 267 to 117, aiming to enhance child online safety. However, critics warn the legislation could inadvertently force platforms to collect vast amounts of personal data, increasing hacking risks.
Data collection risks under the KIDS Act
While the KIDS Act does not explicitly mandate age verification, it holds platforms legally liable for harms to minors. This creates a de facto requirement for companies to verify user ages to avoid liability. Experts argue this structure pressures platforms to collect and store extensive identity data, turning them into prime targets for hackers.
Past incidents illustrate the danger. In 2024, identity verification firm AU10TIX exposed driver's license data for over a year while serving TikTok and Uber. In 2025, a vendor for Discord's age verification system was hacked, leaking about 70,000 government IDs. These breaches highlight how centralized data repositories create attractive attack surfaces.
Privacy-preserving alternatives exist
Proponents of privacy note that age verification does not require full identity disclosure. Utah's SEDI (State Enhanced Digital Identity) law, built on Cardano Foundation's Veridian system, allows users to prove they meet an age threshold without revealing other personal information. This model minimizes data collection while maintaining trust.
Balancing child protection and surveillance
The KIDS Act's core goal is protecting children, but its current structure may lead to expanded digital surveillance. Senators Richard Blumenthal and Marsha Blackburn, co-sponsors of the underlying KOSA bill, have criticized the House version and called for stronger rules. The Senate Commerce Committee's review will determine whether the final law emphasizes data minimization or broad collection.
Experts suggest that policies should mandate limited data retention, secure storage, and privacy-preserving verification. The KIDS Act's outcome will set a precedent for digital identity standards, influencing whether the internet becomes a gateway for identity checks or a space where safety and privacy coexist.