The Privacy Dilemma in Safeguarding Children Online

Frederik Gregaard, CEO of the Cardano Foundation, raises critical concerns regarding privacy issues tied to age verification in the context of child safety online. Recent incidents highlight the vulnerabilities of identity verification services, such as the 2024 data breach involving AU10TIX, which exposed drivers' licenses, and a subsequent breach in 2025 that affected approximately 70,000 Discord users. These events underscore the risks associated with relying on third-party vendors for age verification, which can inadvertently become targets for cyberattacks.

The urgency of this matter is further emphasized by the recent passage of the Kids Internet and Digital Safety (KIDS) Act by the U.S. House, which aims to establish a framework for protecting minors online. The Act, which passed with a vote of 267-117 on June 29, awaits Senate consideration. Authors of the original Kids Online Safety Act (KOSA), Richard Blumenthal and Marsha Blackburn, are advocating for a stricter version that would include federal oversight of AI regulations.

While the KIDS Act does not explicitly mandate age verification, it places liability on platforms for any harm that minors may encounter, incentivizing companies to implement age verification processes. This creates a paradox where platforms may inadvertently collect more data than necessary, transforming what should be a simple age check into a broader identity verification system. Gregaard cautions against this trend, noting that such a system could lead to increased risks of data breaches similar to those seen with AU10TIX.

In Utah, the Cardano Foundation's Veridian initiative demonstrates a model for digital identity that prioritizes privacy while allowing age verification without disclosing excessive personal information. This approach illustrates the possibility of balancing safety and privacy, suggesting that lawmakers should aim for standards that minimize data collection and avoid creating extensive databases prone to exploitation.

Gregaard emphasizes the need for policies that focus on targeted, specific protections for children without imposing broad data collection requirements that could lead to surveillance. He argues that effective safety measures can be achieved through strategies that prioritize data minimization and privacy-preserving verification methods. The aim should be to protect minors while maintaining their privacy and trust, ensuring that safety does not come at the cost of increased surveillance.

In conclusion, the KIDS Act should reflect a commitment to safeguarding children while limiting unnecessary data collection and fostering trust without compromising privacy.