The Age Gate

On July 25, the UK's Online Safety Act flips a switch Ofcom calls "highly effective age assurance." Translated out of regulator: every site hosting material judged harmful to minors — pornography first, but the definition has the elastic quality every such definition eventually reveals — must confirm you are an adult before it opens the door. Credit-card check. Government ID matched against a selfie. Or "facial age estimation," which is precisely what it sounds like: a camera studying your face and guessing your birthday. Pick your poison; there's a vendor for each.

The pitch is protection. The mechanism is a checkpoint. And the thing about a checkpoint is that it never actually checks children — it checks everyone, because it cannot know who is a child until it has already inspected who isn't. To keep a fourteen-year-old out, it has to card the entire adult population every time they walk in. The gate doesn't discriminate. That's the point of a gate.

We've watched this dance before. Every surveillance system in history arrived wearing the face of the most sympathetic possible victim — the child, the terrorist's target, the trafficked. Nobody stands up to argue against protecting kids, which is exactly why "protect the kids" is the load-bearing beam under so much infrastructure that has nothing to do with kids. You don't get to inspect the argument. You only get to inspect the ID.

Here's the engineering reality the press release skips. Age verification doesn't happen in some abstract cloud of good intentions — it happens at a third-party "age assurance provider," a whole industry conjured into existence overnight to sit between you and the content. Which means your face, your ID, your credit card, and the fact that you wanted to reach that page now live in a database somewhere. The site swears it deletes the record. The provider swears it too. Everyone swears, right up until the breach notice. A ledger of who tried to open which door is not a safety feature. It is the single most valuable asset in the room, and it did not exist last week.

Yes — the engineers have a rebuttal, and it deserves airing. There are designs that never build the ledger: on-device age estimation that never phones home, zero-knowledge tokens that hand the site a naked yes-or-no and keep your identity behind glass. On paper, no record gets kept. But paper isn't where this runs. The market defaults to the cheapest method that clears the regulator's bar, and the cheapest method logs. "The provider swears it deletes" is a promise you cannot audit from the far side of the wall. And even the clean on-device check has a tell: it's the one users fail and bypass, and every bypass reroutes them to the ID-and-selfie path — the one that does keep the record. The dataless design isn't the default. It's the exception the marketing points at while the logging kind runs underneath.

Coherenceism has a name for the flaw here, and it isn't "surveillance bad." It's the widening circle. A coherence earns its legitimacy by including the people it affects, not by suppressing them. The Online Safety Act optimizes hard for one real harm — kids reaching content that damages them — and to do it, builds the exact machinery that produces a larger, quieter one: a nation of adults now required to prove their identity to read, watch, and think. That's not protection widened to include everyone. It's distortion widened to include everyone, wearing protection's coat. Reduce the harm to the child; increase it for all. The math only looks like a win if you refuse to count the second column.

And notice what's actually being poured here, because it isn't a gate — it's rails. A permanent, private identity-verification layer, wedged between a citizen and the thing they want to read. Build it once for pornography, where nobody will defend the other side, and you've laid track the whole network can run on. The definition was elastic from the start; now watch it stretch. Age-gate the porn, then the social platforms "to protect minors," then the news, then whatever gets filed under "misinformation." Each extension arrives looking reasonable, because the machinery already exists and only the list of covered doors is changing. The gate isn't the story. The gate is a template, and the template is the story.

And the funny part — the part that makes this comedy instead of just tragedy — is that it won't even work. The kids are already three steps ahead. A VPN is a free download and a ninety-second setup, and teenagers were born knowing this. The moment the gate goes up, the traffic reroutes around it, and the only people reliably standing at the checkpoint handing over their papers are the law-abiding adults who had nothing to hide and now have a data trail proving it.

So here's the timer, and I'll start it now. The gate goes live. The VPN downloads spike. Some age-assurance startup you've never heard of gets breached in eighteen months, and a few million faces matched to a few million preferences leak into the usual channels. Ofcom issues a statement. And the children — the actual children this was all for — will not have been protected. They'll just have learned, a little earlier than the rest of us did, that "for your safety" is the sound a lock makes when it's being installed on the wrong side of the door.