The privacy paradox of protecting kids online

Opinion The privacy paradox of protecting kids online We don’t need to imagine the privacy pitfalls of age verification. They’ve been happening for years, argues Cardano Foundation CEO Frederik Gregaard. By Frederik Gregaard | Edited by Cheyenne Ligon Jul 15, 2026, 2:58 p.m. 3 min read Make preferred on Share Share this article Copy link X icon X (Twitter) LinkedIn Facebook Email Make preferred on In 2024, identity verification provider AU10TIX, which provided services to companies like TikTok and Uber, was found to have exposed drivers' licenses to hackers for over a year . In 2025, the age-verification systems provider for the social media site Discord was breached, exposing potentially 70,000 users' government IDs. In 2026, the lesson should already be clear that once age verification depends on vendors and stored identity data, a safety system can become a breach vector. And the rise of AI is only accelerating these risks , making hacks faster and the resulting damage easier to inflict. This is the backdrop against which the U.S. House passed the Kids Internet and Digital Safety (KIDS) Act on June 29th, a sprawling package built around the Kids Online Safety Act (KOSA), 267-117. The bill now sits in the Senate, where KOSA's own authors, Democrat Richard Blumenthal and Republican Marsha Blackburn, resoundingly rejected the House version and are pushing a tougher one, in part by tying it to federal preemption of state AI laws. A Senate Commerce Committee markup is expected this month. Whatever emerges from that process will shape how identity works online for years. The intent is to protect minors. The risk is that the mechanism protecting them requires building a much larger surveillance apparatus than anyone campaigning for it admits. Frederik Gregaard is the CEO of the Cardano Foundation, the Swiss-based non-profit organization that exists to ensure the advancement of the Cardano protocol. KIDS doesn't mandate age verification outright, because it doesn't have to. Making platforms liable for harm to minors who access their services gives companies a simple risk calculus. Either you verify age, or accept the legal exposure of not knowing who's a minor. Liability without a verification mandate still produces verification. That's the mechanism, and it's worth naming explicitly, because "there's no explicit age check in the bill" is a technically true defense that misses how the incentive actually works in practice. Once disclosure becomes the price of access, the information dragnet tends to expand. A tool built to confirm someone is old enough becomes a tool that confirms who they are, and a database built to prevent liability becomes just a liability – one more repository of identification data waiting for the next AU10TIX-style breach. But if a platform only needs to know that a user is old enough, it should not require a full identity file or other data it may use as a proxy for age. If a service only needs to reduce exposure to harmful content, there is no need to build a database that can later be repurposed. These distinctions, however small, matter. In Utah, which passed State-Endorsed Digital Identity (SEDI) legislation, Cardano Foundation-built Veridian has already shown that digital identity can be delivered in a privacy-preserving way, allowing users to prove that they are over or under a specific age without exposing any other data. It’s a working model of what responsible verification can look like and shows trust does not require unnecessary disclosure. Privacy can be designed into the system from the start. That is the standard bills like KIDS or KOSA should favor. If the goal is to protect children, the tools should be narrow, purposeful, and minimally invasive. Broad mandates that push every platform toward more data, more retention, and greater dependence on identity are too blunt and risk creating a multitude of other problems alongside the ones they claim to solve. A better approach is straightforward. Build for data minimization, limit retention, and use privacy-preserving verification where verification is truly needed. If digital trust can be established without exposing personal data, lawmakers should prefer that path. If safety can be improved without turning the internet into an identity checkpoint, that should be the only option. Children deserve protection online. But they do not need a policy framework that makes everyone more visible in order to make the internet, and the companies that thrive on it, more accountable. The right standard is simpler: protect minors, limit data, preserve privacy, and build trust without unnecessary disclosure. That should be the test for KIDS, because you can build safety without surveillance. Note: The views expressed in this column are those of the author and do not necessarily reflect those of CoinDesk, Inc. or its owners and affiliates . Latest Crypto News 1 High-level White House meeting said to be planned to hash out Clarity Act ethics section 22 minutes ago 2 South Korea to modify 76-year-old law to classify cryptocurrencies as national assets 24 minutes ago 3 Open USD poses biggest threat yet to Circle's USDC, CoinShares says 55 minutes ago 4 A timeline of the Ethereum Foundation's ongoing shakeup 1 hour ago 5 BlackRock's crypto assets fall 39% despite $15 billion of net inflows 2 hours ago 6 The launchpad that fueled Robinhood Chain's memecoin boom just gave away all its revenue 2 hours ago 7 Japan reclassifies crypto as a financial asset, paves way for tax cuts 2 hours ago 8 Strategy feels 'very secure' until bitcoin reaches $8,000-$10,000, says CEO 2 hours ago 9 Bitcoin rally cools as investors digest inflation data, oil clouds outlook 3 hours ago 10 Crypto steadies as Middle East tensions counter U.S. inflation report boost 3 hours ago Latest Research Gate Leads Spot Market Share Gains as CEX Volumes Rise for First Time in Five Months Gate Leads Spot Market Share Gains as CEX Volumes Rise for First Time in Five Months CEX trading volumes rose for the first time in five months in June, with spot climbing 15.3% to $1.11T and RWA perpetual volumes surging to a record $311B. By CoinDesk Research Jul 13, 2026 CEX trading volumes rose for the first time in five months in June, with spot climbing 15.3% to $1.11T and RWA perpetual volumes surging to a record $311B. Why it matters : CEX trading volumes rose for the first time in five months in June, with spot climbing 15.3% to $1.11T and RWA perpetual volumes surging to a record $311B. View Full Report More From Opinion The Clarity Act isn't a ticket to sanctions evasion, actually The UK has finally shown it’s serious about crypto Age verification is the surveillance nobody voted for