Age verification (AV) laws are proliferating across the United States, with approximately half of all states enacting such regulations. Federal proposals like the **KIDS Act** and the **Kids Online Safety Act (KOSA)** are also gaining traction. Globally, the **European Union** is moving towards a centralized age verification app by year-end, and **Australia** has implemented broad restrictions. Despite their widespread adoption, most AV laws consistently fail to achieve their primary objective of restricting minors' online access. Crucially, they pose substantial threats to individual privacy. A perceived solution among proponents is the use of **Zero-Knowledge Proofs (ZKPs)**. While **ZKPs** were previously discussed in the context of age verification, recent practical deployments demonstrate that ZKP-focused AV schemes are vulnerable to exploitation and not the universal remedy some claim. ## ZKPs in Age Verification Would Only Centralize Power and Create More Harms Establishing a single point of failure for internet access fundamentally contradicts the principles of a free and open internet. **ZKPs** in AV schemes present an existential threat to digital rights. The underlying mechanism involves issuing a “token” that verifies age upon login, creating a persistent link back to the verifying entity. This allows the token issuer to track every instance of credential usage, generating a dangerous trail of metadata. Such a centralized issuer could face pressure from authoritarian governments to revoke a user's access to services, effectively isolating them from the internet. Without robust oversight, this approach centralizes critical internet infrastructure in the hands of a few powerful actors. ## How ZKPs Work **ZKPs** are powerful cryptographic tools, though not originally designed for age verification. They enable a computer to prove the validity of a statement to another computer without revealing the underlying private data. Essentially, **Computer A** (the user's device) can prove to **Computer B** (the website server) that a piece of information is true without disclosing its contents. **Computer A** creates a "commitment" to the information. **Computer B** then generates mathematical "challenges" that can only be correctly answered if the information is true. Traditionally, this involves multiple challenges to eliminate doubt. For internet speed, a non-interactive, instant version called **zk-SNARK** (Zero-Knowledge Succinct Non-Interactive Argument of Knowledge) is preferred for age verification. In this method, the answer is hashed into a fixed, tamper-resistant string of characters. Ideally, **ZKPs** would attest to a person's age status without revealing other private information. Only one entity would collect this private data, typically on the user’s device, rather than every website or app. However, recent real-world testing indicates that **ZKPs** are not the panacea that AV law proponents hoped for. ## EU’s AV Rollout Reveals How Broken It Is By late 2026, the 27 **European Union** member states are expected to integrate age verification infrastructure into a "mini-wallet" app within the **EUDI (European Digital Identity) Wallet**. This initiative has garnered significant criticism from digital rights experts. Early deployments of the "mini-wallet" promise functional **ZKPs**, but recent analysis reveals that the ZKP features are not active in the public version of the app, only in a closed demo/prototype inaccessible to most users. Furthermore, a security researcher successfully bypassed the app's system using a simple **Chrome** extension. This extension tricked the app into repeatedly accepting the same "over-18" token without requiring fresh verification. Over 400 security researchers signed an open letter asserting that age assurance checkpoints, even with privacy considerations, would cause more harm than good. Their primary concern, echoed by many, is that a centralized identity verification system creates a single point of failure highly vulnerable to both cyberattacks and authoritarian overreach. Once the "mini-wallet" is fully integrated into the **EUDI Wallet**, these failures are likely to replicate, potentially on a much larger scale, encompassing sensitive information such as passports, driver's licenses, travel, and financial data. ## ZKPs Aren’t The Magic Bullet Repeatedly, it has been demonstrated that no online age verification method is truly privacy-protective, fully accurate, and universally applicable without introducing severe security risks. Lawmakers advocating for age verification mandates must understand that **ZKPs** are not a magic bullet. They do not resolve the inherent paradoxes of age verification; instead, they defer the burden of trust, relying on technical naivety and unrealistic expectations of internet functionality. Mandatory online age verification, in any form, remains a dangerously flawed concept. It's imperative to inform lawmakers of these critical security and privacy concerns.