Zero Knowledge Proofs Aren’t Age Verification Silver Bullets
from the they-still-put-people-at-risk dept
Age verification (laws and regulations requiring platforms and websites to assure or estimate that a user seeking to use an online service is of a certain age) is everywhere. At the time of writing, about half the states in the US have some internet age verification law in place, and dangerous proposals, from the KIDS Act to the Kids Online Safety Act (KOSA), have been advancing at the federal level. European Union member states are moving toward having age verification in a centralized app by the end of this year. Australia famously now has one extremely broad restriction in place.
Most age verification laws tend to fail at their primary goal of barring kids from being online or from entering only specially designated zones, not to mention they pose a significant threat to everyone’s privacy. Some proponents of these age-based internet restrictions think they’ve found the silver bullet: Zero-Knowledge Proofs (ZKPs). We wrote about ZKP’s when they were first rolled out in the age verification context last year. However, more recent examples show our concerns weren’t just conjecture; ZKP-focused AV schemes are gameable, hackable, and not the cure-all some may claim.
ZKPs in Age Verification Would Only Centralize Power and Create More Harms
Before we jump into how these systems work, it must be said: creating a single point of failure for internet access contradicts the very idea of a free and open internet.
The mechanisms underlying ZKPs pose an existential threat to everyone’s digital rights, not just kids. The idea behind ZKPs is that you are issued a “token” that vouches for your age every time you log in, creating a constant link back to the entity that verified you. The issuer of the tokens these AV schemes rely on could track every time that credential is used, creating a dangerous trail of metadata on any user they wanted to target. The issuer itself could be pressured by authoritarian governments to remove a user’s access to a service, essentially removing that person’s access to the internet entirely. Without oversight of who has authority to implement and operate these systems, this approach centralizes critical internet infrastructure in the hands of very few actors.
How ZKPs Work
ZKPs are mathematically impressive cryptographic tools—but they weren’t developed with age verification in mind. Essentially, they let a computer quickly attest to the validity of a given question asked by another computer without divulging any underlying private data.
Computer A (such as the device operated by a person trying to access a website) is able to prove to Computer B (such as the server for the website that person is trying to access) that something is true without actually sharing the contents of that information itself. Computer A locks in a “commitment” to the information it needs to convey. Computer B, which wants to verify that information, generates mathematical “challenges” that can be answered correctly only if the information is true. Traditionally, this happens over many different “challenges” until there is no room for doubt that Computer A’s “commitment” is true.
Since that kind of lengthy back-and-forth process would drastically slow things down over the internet, there’s a shortened version of this exchange that’s “non-interactive.” In that case, the ZKP is verified instantly. The answer itself is hashed (mathematically converted into a fixed, shorter string of characters), and the resulting hash is theoretically unpredictable and tamper-resistant. This shortened version of the ZKP exchange is called “zk-SNARK,” which is the current preferred method for age verification.
In the ideal scenario, this means that ZKP’s are able to attest to a person’s status as an adult or a child without actually giving away any other private information about that person. In other words, only one entity would collect that private information, typically on the user’s device, instead of every website or app that needs the user’s age attested to. Unfortunately, recent real-world testing of these systems prove that ZKP’s aren’t the silver bullet that proponents of AV laws were hoping for.
EU’s AV Rollout Reveals How Broken It Is
By the end of 2026, the 27 states within the European Union are expected to have infrastructure in place to do age verification within a “mini-wallet” app that will live inside the EUDI (European Digital Identity) Wallet. This is being met with plenty of warranted criticism from digital rights experts. The “mini-wallet” version is already being rolled out, with promises that the ZKPs are in working order. But recent insights show that the ZKP features aren’t yet turned on except for the closed demo/prototype build (not the version of the app people are using “out of the box”), which the vast majority of everyday users can’t access.
Worse still, a security researcher found they could bypass the app’s system using a quickly built Chrome extension that tricked the app into repeatedly accepting the same “over-18” token. It did so without ever asking for fresh verification.
Over 400 security researchers signed an open letter stating that age assurance checkpoints, even if implemented with privacy in mind, would cause more harm than good. A primary focus of their concern, which we share, is the fact that a centralized identity verification system creates a single point of failure that is extremely vulnerable to both cyberattack and authoritarian overreach.
Once the “mini-wallet” version of this is fully integrated into the EUDI Wallet, it will replicate these same failures, perhaps more, but at a much larger scale. At that point, the failures will involve many more pieces of sensitive information that the EUDI Wallet contains: passports, driver’s licenses, travel information, financial information, to name a few.
ZKP’s Aren’t The Magic Bullet
As we’ve said time and time again, no method of online age verification is privacy-protective, fully accurate, and capable of guaranteeing universal coverage without introducing severe security risks.
Lawmakers concerned about the privacy failures of age verification mandates must understand that ZKPs are not a magic bullet. They do not solve the age verification paradox; they simply push the burden of trust down the road, relying on technical ignorance and magical thinking about how the internet actually functions.
Mandatory online age verification of any kind is a dangerously flawed idea. Tell your lawmakers we said so.
Republished from the EFF’s Deeplinks blog.
Filed Under: age verification, centralization, cryptography, tokens, zero knowledge proofs
Comments on “Zero Knowledge Proofs Aren’t Age Verification Silver Bullets”
I mean, this part at least, I don’t see as necessarily a bad thing, at least from a user privacy perspective.
It’s almost like the goal isn’t to protect kids that none of these people actually care about
One of the problems with ZKPs is that they can leak information
I’ll use a simplified (and contrived) example; salt to taste in order to make this fit real-world applications.
Suppose that someone’s birthday is February 31, 2010. (I said it was contrived.) They’ll turn 21 years old on February 31, 2031, and thus a web site which is trying to verify that they’re 21 or older should allow them in on that date, but no earlier.
But they’re excited and anxious, so they try on February 30, 2031 — just to see if they can get in early. The ZKP shows that they’re not 21 yet and their access is denied. They wait a day and try again on February 31, 2031 — and it works. Which means that the web site in question can now deduce not only their birthday, but their birthdate.
Similar methods can reveal things like credit card spending limits (via binary search) or US state of residence (by eliminating as many of the other 49 as necessary) and so on. These methods can be partially blunted by rate-limiting queries, but doing so can facilitates denial-of-service attacks: keep sending bogus/random queries at a rate sufficient to deny real/legitimate ones.
The fundamental problem here is that showing {X1, X2, X3, … } aren’t true can yield information about which Xn is true because each negative answer reduces the search space — and if the search space is small enough (e.g., 50 states) then this becomes feasible.
Note that this gets more complicated if an intermediary service is involved (again: contrived example). Also note that having an intermediary immediately creates a single-point-of-failure/single-point-of-attack which can be leveraged to deny access to every site and every person using it. That makes it a very high value target, with predictable consequences.
Re:
This is only true if the site has some way to link the pre-approval and post-approval accesses. All the more reason to insist on real anonymity, such as by accessing sites over Tor (and, by necessity, avoiding sites that block it).
Re:
Something to add to your example: instead of a single ZKP interaction with a single service… imagine that ZKP is required to show adult ads via an ad service on a website.
Now, suddenly, that ad service that already knows how to follow you around in your browsing, sees a challenge and response on every single website you visit that uses the ad service (let’s call it DabbleKlik).
As a result, the DabbleKlik parent company then knows who’s actually doing the browsing, the exact time they turn 21, and the exact time any other challenges change state that they might be monitoring… AND your ISP and the websites being browsed ALSO know, because your ISP is suddenly getting DNS requests for adult-rated ads, and the other websites are suddenly serving redirects to the adult-rated ad server.
So the risk isn’t really with ZKP in isolation; it’s what happens when you combine it with the existing insecure infrastructure.
What if you don’t have a device that runs “apps”? No internet for you?
Re:
There are at least two of us in this world? Your comment gives me hope that I am not alone. Not joking.
Please keep up the good fight against palmtop stupefiers that run “apps”. (My own term for “smartphones”.)
Re: Re:
“What if someone doesn’t have a smartphone?” was a common concern early in the COVID-19 pandemic, when some nations (such as Canada) required Internet-based approval to be presented at the border for entry. I recall reading about a convenience store operator near the border helping people use the store’s computer to do that.
A mall near me also “required” a health questionnaire to be filled via smartphone for access, with the sign saying to talk to the person at the desk if one can’t do that. But there was never anyone at the desk, and this is the local old-person mall, so people just ignored the whole thing. (The grocery store in that mall discontinued paper flyers last year, too, but they were back within a couple of months.)
Apart from people who never had smartphones, there are “recovering addicts” who’ve given them up. All together, we’re talking about much more than two people. But I suspect these programs are developed by young people who assume non-smartphone-users will all be dead soon.
That’s exactly the opposite of the definition of zero knowledge. It’s a technical term.
Yes, you can have bugs.
Yes, you have an authority that may be able to revoke people’s credentials. Yes, there’s a single point of failure that could allow DoS. Yes, there are also problems with credential reuse that are hard to solve without losing the zero knowledge property.
Yes, what the EU is peddling as “zero knowledge” is not zero knowledge. It’s not a single system with unactivated zero knowledge features, though. They’ve actually defined two essentially independent systems they brand as “zero knowledge”. One of the two is really zero knowledge, and the other is just plain not. And people are only rolling out the bad one.
But, nonetheless, any system where “The issuer of the tokens these AV schemes rely on could track every time that credential is used, creating a dangerous trail of metadata on any user they wanted to target. ” is not a zero knowledge system. That’s exactly what the protocols are designed to prevent, and they do work if used correctly.
If you want to talk about real tracking risks, look outside the ZK protocol. Existing identifiers like IP addresses, cookies, and the like work great for tracking.
… and if you want to attack age verification, it might be nice to own the fact that shoving everybody under 16, or 18, or whatever, into a digital ghetto, is a repulsive idea regardless of privacy impact.
Re: Challenging the premises of “age verification”.
Thank you. I know how ZKP works, and it somehow escaped my notice that this is not ZKP.
In my opinion, that is the most important point. However, most people fear not only to say it, but even to think it. The reason is obvious: Porn. Although that digital ghettoization has spread like a metastatic cancer, just like some of us foresaw, it started with porn—and it would collapse without being hinged on that third-rail issue.
In 1968, there were two U.S. Supreme Court Justices who flatly denied that any exceptions to the First Amendment could be made based on age: Douglas, joined by Black. (Fortas also dissented, but with a weaker opinion.) To be clear, the key question was the First Amendment right of young people themselves to access speech.
In speaking to that right, Douglas frankly dismissed concerns about materials deemed “harmful” to youth as the lasting influence of Anthony Comstock. Ginsberg v. New York, 390 U.S. 629, 650 (1968) (Douglas, J., dissenting). Douglas even went so far as to append to his opinion an excerpt from a book that Comstock wrote in 1883 (390 U.S. at 656), which Douglas described as a theory of “‘traps’ created by Satan ‘for boys and girls especially.’” (390 U.S. at 651).
Per Douglas, I think that Anthony Comstock’s theory about Satan’s “traps” is exactly what’s now destroying the Internet.
Note well that in Ginsberg, the majority opinion itself drew “a distinction between the reading of pornography, as unlikely to be per se harmful, and the permitting of the reading of pornography, which was conceived as potentially destructive. The child is protected in his reading of pornography by the knowledge that it is pornographic, i. e., disapproved.” 390 U.S. 629, 642 (n. 10; emphasis added; internal quotation marks omitted). Otherwise stated, the Court decided to allow laws restricting access based on age, to send a moral message to young people that they should feel bad when looking at stuff they’d look at anyway.
If the 6-3 decision in Ginsberg had gone the other way, we wouldn’t even be having this debate. In the United States, all subsequent law supporting “age verification” stands squarely on the Ginsberg precedent that no one will challenge. In Free Speech Coalition, Inc. v. Paxton, 606 U.S. 461 (2025), both the petitioner and the dissent acknowledged Ginsberg as good law. (I do think that FSC bought and paid for their catastrophic loss by a policy that protects corporate profits, not free speech principles.)
For more information on the general topic, I recommend Marjorie Heins (2001). Not in front of the children: “indecency”, censorship, and the innocence of youth. Hill and Wang, New York. Heins was a lawyer on the ACLU team that defeated the CDA in Reno v. American Civil Liberties Union, 521 U.S. 844 (1997), another battle which would have been unnecessary if Douglas’ opinion had prevailed in Ginsberg.
Re: Re:
That was 58 years ago. Why are we still discussing hypotheticals? Pornography’s been legal, common, and available in practice to the under-aged, for a long time. Were it harmful, we’d have generations of people harmed by now.
If a lawyer is talking vaguely about poronography causing “harm” but can’t produce a procession of harmed people in court, you know they’re full of shit. Anti-vax rhetoric, by contrast, has a measurable death toll; I knew someone who died of COVID complications who probably would’ve lived if not for that. (And, for reasons of freedom of speech, I won’t support banning such rhetoric. But I think we should kick some people out of the government for it.)
Young people need to speak up about this.
When I was a person under 18 years of age, I got my first dial-up Internet connection. Suddenly, I could access any information in the world, I could talk to people all over the world, and I could learn to speak to the world in hand-coded HTML. I even had access to E2EE, as I discovered PGP pretty quickly.
This disquieted someone with authority in my life. And so it came to pass that I fought a personal war for my freedom of access to the Internet. Although my self-education about my rights was only beginning, and I did not yet know these words, I acted in the spirit of the principle that “Big Brother can no more say what a person shall listen to or read than he can say what shall be published.” Ginsberg v. New York, 390 U.S. 629, 654 (1968) (Douglas, J., dissenting—in the case which would have cut off at its root today’s whole “age verification” debate, if Douglas’ opinion had been the majority’s).
Now, I read this “age verification” discourse through my once-young eyes. I know how I would have reacted to it then. I react that way now, for I have not changed my opinion. I am still the same person! However, I am no longer young.
Someone needs to stand up for the rights of young people. But no one else can do it for them, without their own voices in the lead. Some people who escaped slavery were amongst leading voices for its abolition. Women led the fight for their equality with men. Privileged supporters of the oppressed can offer advice, education, resources, and alliance—but one cannot fight for another’s freedom unless they act freely.
If these words perchance reach some younger version of myself, I ask you to tell me in your own words: What is your opinion of “age verification”? Demand that your voice be heard on the principle, “Nothing about us, without us!”
The youths of today must fight for their present and for their future. When their elders are designing for them a sci-fi dystopia which will afflict them now when they are young, and later when they are older, they should not accept the proposition that it’s “for their own good”.
ZKPs are one of the greatest liberation technologies, but also potentially one of the most oppressive. What starts with “age verification” will surely not stay there. Citizenship status? Marital status? Or… My imagination abounds with so many evil possibilities, I dare not to list them, lest I hasten their realization—an eventuality which is inevitable, unless “age verification” is defeated now.
It can be defeated only in principle—not by an argument between policies which are more paternalistic, and those which are less so. And it cannot be defeated without the voices of those who are most directly and immediately affected.
This isn’t inherent, this is a design choice (although, it likely would be, if only to prevent fraud etc). But you can design hashing choices that verify 18+ without being traceable back to the original credential.
The article seems to be pretty lacking in details. There’s a single example of a trivially addressable bug.
This is true. What’s missing is why this is the standard, especially given that existing laws also don’t reach this lofty bar. Any government policy is going to come with trade offs. If your bar is zero trade offs, nothing is ever going to satisfy that.
ZKPs are not silver bullets. The question is whether they’re good enough for anyone who isn’t taking a hardline no compromise stance. Or what happens if once this gets rolled out for a few decades and is ~basically fine.
Also known as the DMV.
Re: People who have no government-issued ID.
So, as you envision this system, it’s an acceptable “trade-off” to exclude legal adults who don’t have unexpired government-issued ID. That discriminates against millions of people. Disabled people, poor people, brown people, and of course, undocumented immigrants are all much more likely than white middle-class non-disabled U.S. citizens to lack ID. Basically fine?
It is one aspect in which “age verification” is even worse than the Republicans’ voter ID laws, which “only” disenfranchise the millions of legal adult U.S. citizens who lack ID.
The EFF has more to say about this (see subhead, “1. Adults Without IDs Get Locked Out”).
None of this suggests that I’d ever accept abrogating the First Amendment rights of people under age 18 to access information. I just think it’s also very important not to kick underprivileged legal adults off of all the perpetually-expanding portions of the Internet that are supposed to be “age-verified”.
Why, yes, I’m proud to take a hardline, no-compromise stance on free speech!
(To the world outside the U.S., I apologize for being America-centric on this issue. I do need to fight for the U.S. Constitution’s First Amendment.)
Re: Re:
We already have systems that exclude legal adults who don’t have unexpired government-issued IDs from things, including speech. When a person has to show an ID in person to access adult content, that trade off already exists.
So I think to be consistent, you either need to also be against those existing laws, or if you’re ok with it, there is definitionally some threshold where you think that trade off is ok (or you have other concerns beyond access, but you’re asking about access trade-offs specifically). Either stance is ok, but someone should be upfront about which they hold.
Personally, I am ok with those existing in-person laws, so clearly there is some bar where the trade off is fine for me. I don’t think someone has to agree with me, someone can certainly take the hardline stance that existing laws are also unacceptable. But if someone takes that stance I think they should be upfront about it.
I wouldn’t say it’s basically fine. I have major concerns about age verification systems that are currently being implemented. I have not seen a single existing one that I would think is remotely close to fine. But I think you could maybe (and I mean this as actually a maybe, I am not sure) get it to the point where it’d be acceptable for me. I have a pretty high bar, but I’m not a hardliner/no-compromise person on speech.
Which is absolutely fine. But I think if you take that stance, you have to be upfront about it, and EFF tends to skirt around it.
About EU Age-ID app
By the end of 2026, the 27 states within the European Union are expected to have infrastructure in place to do age verification within a “mini-wallet” app that will live inside the EUDI (European Digital Identity) Wallet.
In what month exactly will it start? October? November? December?
If this ever applies to logging into my usual accounts, operating system, VPN, or even hardware, I’d simply disconnect from the internet, try to leave Europe, or even live in a time loop where every day is the day I’m alone at home with free time rather than see it fully implemented.
(That last one is just an exaggeration to feel more outraged)
My company would like to announce an innovative new mechanism for age verification; the UCCS, User Cooperation/Consent System.
Using our novel mechanism, users can be informed of the contents of a website and verify themselves as adults with one click.
Our system has near-100% rates for both sensitivity and specificity (barring intentional circumvention by the user), ensures the user’s personal details never leave their device, shares no information with third parties, and otherwise contains no vulnerabilities that could be used to compromise a user’s personal information. Furthermore, it’s ultra-lightweight, and can be easily customized to suit your website.
Unfortunately our system is relatively easy to deliberately circumvent, but it is our position that any age verification mechanism is susceptible to circumvention. Our design instead places maximum priority on user privacy and well-being, and ensuring that even if our system is circumvented, it is physically impossible for a malicious actor to access the personal information of other users.