On August 18, 2026, the Electronic Frontier Foundation published an analysis by Daly Barnett arguing that zero-knowledge proofs — the cryptographic technique increasingly pitched as the privacy-preserving fix for internet age verification — are "gameable, hackable, and not the cure-all some may claim." The post lands as roughly half of US states now have some form of internet age verification law on the books, with the KIDS Act and the Kids Online Safety Act advancing federally, EU member states moving toward a centralized age-verification app by year's end, and Australia's broad restriction already in force.

Why It Matters

For adult platforms, cam sites, sextech retailers and any sexual-health service with an age gate, ZKP-based verification has been the emerging best-case scenario — the compliance path that satisfies regulators without forcing merchants to warehouse government IDs. EFF is arguing that path relocates the risk rather than eliminating it, shifting it from a thousand merchant databases to a handful of credential issuers with far more leverage over user access than any individual site ever had. That matters commercially, not just philosophically. If a small set of issuers becomes the chokepoint for adult-content access, the industry gains a new category of gatekeeper — one structurally similar to the payment processors it already spends enormous energy placating, and one just as capable of deciding which lawful businesses get to exist. Companies building age-assurance roadmaps should be modeling issuer concentration and revocation risk now, before the standard hardens around whichever vendors move fastest.

The technical objection is not that ZKPs are bad math. EFF's post walks through how they work — Computer A commits to a piece of information, Computer B issues mathematical challenges that can only be answered correctly if the commitment is true, and the shortened non-interactive variant known as zk-SNARK verifies instantly, which is the flavor currently favored for age assurance. In the ideal case, a user proves adult status without disclosing anything else, and only one entity ever holds the underlying identity data.

The objection is architectural. Under the token model these schemes rely on, a user is issued a credential that vouches for their age every time they log in, "creating a constant link back to the entity that verified you." EFF's argument: the issuer can track every use of that credential, generating a metadata trail on any user it chooses to target, and can be pressured by an authoritarian government to revoke a person's credential — effectively removing their access to the internet. Without oversight of who is permitted to operate these systems, the approach "centralizes critical internet infrastructure in the hands of very few actors" and creates a single point of failure for internet access.

EFF also notes it flagged these concerns when ZKPs were first deployed in the age-verification context last year, and that more recent examples show the worries "weren't just conjecture." The group's broader position is unchanged: most age verification laws fail at their stated goal of keeping minors out while posing significant privacy risk to everyone. Separately, EFF wrote to the Senate Commerce Committee on August 5 opposing the SCREEN Act (S. 737), KOSA (S. 1748), the Youth AI Privacy Act and the CHATBOT Act — bills the committee voted to advance that day.

Sources

Update — 2026-08-20

Initial entry — story first created.