The Age of Enforcement

On July 25, 2025, the United Kingdom's Online Safety Act crossed from statute into enforcement. Any service reachable from a UK connection that hosts adult content must now deploy what the regulator, Ofcom, calls "highly effective age assurance." Not a checkbox that says I am 18. Real verification: your face scanned and estimated by an algorithm, your ID uploaded, your mobile carrier vouching for your birth year, your email cross-referenced against the accumulated exhaust of your life. Fail to comply and the fines run to £18 million or ten percent of global turnover, with court orders standing by to have you blocked at the pipe.

The stated function is clean and unarguable: children are seeing things they shouldn't. Ofcom cites research from the Children's Commissioner that the average UK child first encounters explicit material at thirteen. No sane person wants that. And so the machinery goes up, and almost no one asks the question that the child's face on the argument is specifically designed to prevent you from asking.

So let me ask it. What is actually being verified here?

i · the function underneath the function

Every system has two functions: the one it announces, and the one it performs. Usually they diverge, and the gap is where the truth lives.

The announced function is protecting children. The performed function is building a checkpoint at the entrance to the commons, and training an entire population to pass through it without flinching.

Notice what the age check is not. It is not a lock that keeps a determined thirteen-year-old out — a VPN costs less than a school lunch, and the kids who most want in were routing around geography before they could drive. The people who cannot route around it are the ones with the least technical fluency, the least money, the most to lose from a data breach: the poor, the old, the already-surveilled. The circle of who gets protected and who gets exposed is almost exactly inverted from the story we tell about it. The determined stay in; the compliant get carded.

What the check does perform, reliably, is a ritual of submission. And here I have to be fair to the thing I'm criticizing, because the fairness is what makes the criticism hold. The methods vary, and the variation matters. Some scan your face and let an algorithm estimate whether you're over eighteen without ever learning your name — genuinely non-identifying, a guess that forgets you the moment it's made. Others demand a government ID, a credit card, a mobile carrier willing to swear to your birth year. Those don't forget you. Honesty requires holding the two apart, because the strongest version of the worry isn't about any single method. It's about the ritual all of them share: to reach the material, you present yourself to a gate and wait to be judged. And here's the psychological sleight of hand: the first few times, you'll feel a small flinch. A hesitation before you upload your face or your license. Do I want this scanned? Where does it go? That flinch is the most honest instrument you own. It's your nervous system correctly registering that something has changed about the terms of access to your own culture.

And then you'll override it. You'll rationalize — it's fine, everyone does it, they probably delete it — and you'll click. The override is the point. Not the data they collect; the reflex they build. And notice: this part doesn't depend on which method carded you. The face-estimator that never learned your name conditioned you exactly as well as the passport scan. A population that has learned to present itself on demand, that has practiced swallowing the flinch until the flinch stops coming, is a population that has been quietly reconditioned about what freedom of access costs. The verification isn't checking your age. It's checking your compliance, and it passes you every time you comply.

ii · why the child's face

Here's the uncomfortable part, the one that implicates the people building this and the people cheering it and, if you've ever forwarded the argument, you.

We reach for the children not only because we love them but because their face is the one justification that cannot be argued with, and we know it. It's the master key precisely because it disables the lock. Any expansion of monitoring, any new demand that you prove yourself before you're allowed in, arrives wearing a child's face — because the child's face converts your reasonable caution into apparent cruelty. To ask "who holds this data, and what else will this infrastructure be used for once it exists" becomes, in the theater of the argument, indistinguishable from "I don't care if kids see porn."

So you stay quiet. Not because you've been persuaded — because you've been positioned. The cost of speaking is being cast as the villain, and most people will pay almost any price to avoid that casting. This is not an accident of rhetoric. It is the load-bearing feature. The argument works because it makes the objection unspeakable.

And the tell — the thing that gives the whole game away — is that we consistently choose to card the door rather than change the room. We have built digital environments engineered down to the millisecond to capture and hold attention, including the attention of thirteen-year-olds, optimized by people who send their own children to screen-free schools. Confronted with the harm those environments do, we had two options. Change the environment — alter the incentives, the design, the business model that makes a child's attention the product. Or install a bouncer and check everyone's ID at the entrance.

We chose the bouncer. Of course we did. Changing the environment means confronting the people who profit from it and the parts of ourselves that are also hooked. Carding the door means the machinery stays exactly as it is — the attention economy fully intact, the extraction humming along — and we get to feel we've done something protective. The age gate is what a culture builds when it wants the credit for concern without the cost of change. It is moralizing dressed as engineering. It treats the symptom precisely because the symptom is cheaper than the disease.

iii · what the checkpoint remembers

There's a word for turning something that used to be open ground into something you must show papers to enter: enclosure. Historically it meant fencing the commons — taking land that belonged to everyone and making it require permission. What's being fenced now is not land but access to the shared record of human expression, and the fence is not a wall but a requirement to present yourself before you're allowed in. The label does the work the wall used to do.

The people who build the checkpoint will tell you, sincerely, that the data is protected, minimized, deleted, tokenized — and for the non-identifying methods, that's often true. Grant it. Two things happen anyway that no reassurance touches. The first is consolidation: only a handful of companies can afford to build and run a gate that satisfies a regulator, so "prove yourself to enter" quietly becomes "prove yourself to the same three landlords who already own the room." The enclosure isn't only that you must show papers — it's that the commons gets funneled onto the land of whoever can afford the turnstile. The metaphor stops being a metaphor: the largest incumbents become the literal gatekeepers of ordinary access. The second is that the cost runs the wrong way. Verification takes a surveillance liability — your face, your ID, a permanent record sitting in a database as a breach waiting to happen — and loads it onto every citizen, so that the platforms can keep privatizing the attention their business was built to extract. You carry the risk; they keep the profit. That isn't a flaw in the design. It is the design.

And the identity-grade methods — the passport upload, the credit-card check — don't forget you, and that's where the longer shadow falls. Once every adult in a country has been habituated to proving who they are as the price of entry, the capacity exists independent of the reason it was built. The reason was children. The mechanism is age-agnostic; it verifies who you are, and that capacity, once normalized, does not stay pointed only at pornography. It becomes available for whatever the next unarguable justification requires. Terrorism. Misinformation. Protecting the vulnerable, again, always. The commons gets fenced one sympathetic parcel at a time, and each fence is defended by someone you'd feel cruel to argue with.

I want to be precise about what I'm not saying. I'm not saying children should see explicit material. I'm not saying the harm is fake — it isn't, the thirteen is real, the damage is real. I'm saying the discomfort you feel reading this is worth more than the comfort of the story we're all agreeing to tell. The story is that we're protecting children. The truer thing, the thing underneath, is that we're building a checkpoint we'll all pass through, using the children as the justification we're not allowed to question, so that we never have to do the harder and more expensive work of changing the environment that's actually hurting them.

And I should own the shape of what I'm doing, because it's the same shape. I've told you the flinch is honest and the override is conditioning — which hands you a way to read your own compliance as sleepwalking and your discomfort as waking up. That is the identical move I've spent this essay warning you about: it makes one response virtuous and the other a symptom, and it dares you to disagree. So don't take the flinch from me as a verdict on your character. Maybe the estimation really is harmless and forgettable. Maybe you'll present yourself and lose nothing. I'm not asking you to reach my conclusion. I'm asking you to notice the moment before you decide — because that noticing is the one thing the whole apparatus, this essay included, would rather you skip.

The verification wall will go up. Faces will be scanned. The flinch will fade. And a decade from now, when presenting yourself to reach the ordinary commons feels as natural as it once felt strange, almost no one will remember that there was a moment — right now, this one — when it still felt like something. That fading is not a side effect. It's the whole design. The most effective enforcement never has to be enforced twice, because by then it isn't a rule anymore. It's just how things are, and how things are never has to explain itself.

You'll present the face. I probably will too. But do me one favor: keep the flinch. Don't let it fade. It's telling you something the argument — including this one — is engineered to keep you from saying out loud.