Online Privacy Under Siege: Age Verification Laws, Data Brokers, and Corporate Accountability

Featured image: Photo by Miguel Á. Padriñán on Pexels.

In an increasingly interconnected world, the digital footprints we leave behind are more extensive and revealing than ever before. While the internet offers unparalleled opportunities for connection and information, it also presents significant challenges to personal privacy. From the proliferation of age verification laws designed to protect children but often compromising the privacy of all users, to the shadowy operations of data brokers compiling and selling personal profiles, and the persistent failures of corporations to safeguard sensitive information, online privacy is under constant siege. Understanding these threats is the first step toward reclaiming control over our digital lives and advocating for stronger protections in the digital public square.

The Double-Edged Sword of Age Verification Laws

The push for age verification laws on websites and services, often framed as a measure to protect minors from harmful content, has gained traction in various jurisdictions, including the UK, California, New York, and Illinois [3], [4]. While the intent may be laudable, the implementation of such mandates introduces a host of complex privacy implications for everyone. These laws typically obligate platforms to confirm a user’s age, often requiring the disclosure of personal information that can be misused or exposed [3].

Different methods of age verification carry varying degrees of privacy risk. Facial age estimation, for instance, involves analyzing a photo or video of a user’s face to estimate their age. While some services claim to delete images immediately, others upload them to servers, raising concerns about potential leaks or long-term retention. Similarly, photo-ID matching, which compares a user’s selfie to an official document like a driver’s license or passport, is considered highly sensitive due to the wealth of personal data contained on such documents. Instances of past systems exposing user IDs in data breaches underscore the inherent risks [3].

Other methods include open banking, where a service confirms age through bank information without sharing the full date of birth, and credit card checks, which infer age based on the minimum age to obtain a card. Email verification and mobile operator checks also exist, each with its own set of data aggregation and privacy concerns. In all these scenarios, critical questions arise: What specific data is collected? Who has access to it during and after the verification process? How long is it retained? Are there independent audits to ensure compliance? And does the process build a profile of the user based on their verification attempts across different platforms [3]?

For vulnerable populations, such as LGBTQ+ individuals, these privacy risks are amplified. The data collected during age verification could inadvertently reveal sensitive information about a person’s sexual orientation, gender identity, or other personal details. Such information, if leaked or accessed by bad actors, could lead to harassment, discrimination, or even violence from employers, governments, or family members. The absence of a truly privacy-preserving age verification method, combined with broad restrictions on online access, threatens to limit access to lawful speech, vital online communities, and cultural resources for many users, including minors who rely on the internet for support and information [3], [4]. Organizations like the Electronic Frontier Foundation (EFF) actively oppose these broad age-gating mandates, arguing they dismantle online anonymity and restrict constitutionally protected speech [3], [4].

The Pervasive Threat of Data Brokers

Beyond government mandates, a significant and often invisible threat to online privacy comes from data brokers. These companies operate by collecting vast amounts of personal information from various sources, repackaging it, and then selling it to the highest bidders [1]. This information can be incredibly detailed, encompassing everything from your address, phone number, and email to details about your family members, purchasing habits, and online activities. Much of this data is compiled without your direct knowledge or explicit consent, making it a particularly insidious privacy challenge [1].

To understand what information data brokers might hold about you, a simple first step is to conduct a self-audit. Using a private browsing window or a separate browser to avoid skewed results from being logged into your own accounts, search for your name, nicknames, handles, email addresses, and phone numbers. This can reveal publicly available information that data brokers might have aggregated [1].

While it’s impossible to completely erase one’s digital footprint, there are actionable steps individuals can take to minimize the information available for purchase by data brokers and similar entities. One crucial measure is to establish a strong security baseline: use unique, complex passwords for all online accounts, ideally managed with a password manager, and enable two-factor authentication wherever possible. Deploying tracker-blocking tools, such as Privacy Badger, can help prevent web trackers from compiling data about your browsing habits for advertising purposes and for data brokers [1].

Furthermore, actively requesting data brokers to delete your personal data is an option. While this can be a time-consuming process to do manually, some professional services like EasyOptOuts and Optery specialize in helping individuals minimize their online presence from these sources. For residents in California, the Privacy Protection Agency offers a tool for this purpose. It’s also possible to remove certain types of personal information from Google Search results through their “Results about you” page, though it’s important to remember this only removes it from Google’s index, not from the internet itself [1]. Regularly auditing your social media and forum accounts to review public-facing content and privacy settings is also vital for managing your digital footprint [1].

Corporate Accountability and Misuse of User Data

The responsibility for protecting user data also lies squarely with the corporations that collect and manage it. However, a history of privacy violations and a perceived lack of accountability have eroded public trust. The case of X (formerly Twitter) provides a stark example of corporate failures and the ongoing struggle for oversight [2]. The company has faced multiple orders from the Federal Trade Commission (FTC) for misrepresenting its data protection measures and misusing private user information. In 2022, X was fined $150 million for using phone numbers and email addresses, provided by users for account security, for targeted advertising [2].

Despite claims of corporate restructuring and a renewed commitment to privacy, evidence suggests a pattern of continued disregard for user data protection. Even with changes in leadership, the corporate entity remains bound by its privacy obligations. Organizations like EFF and their allies argue that these obligations do not dissolve with personnel changes and that strong safeguards and eagle-eyed oversight are essential when data is abused for profiteering ventures [2].

Companies sometimes argue that compliance with privacy orders diverts resources from innovation. However, the cost of compliance is often negligible compared to a company’s overall valuation, suggesting that such arguments may be a means to escape accountability. The continued misuse of user data, whether through secondary uses or data breaches, highlights the critical need for regulatory bodies to reject petitions that seek to waive or prematurely end privacy compliance orders [2]. Without consistent pressure and robust enforcement, corporations may continue to prioritize profit over the fundamental privacy rights of their users, leaving individuals vulnerable to data exploitation and misuse.

Key Takeaways

• Age verification laws, while well-intentioned, often create significant privacy risks by requiring users to disclose sensitive personal information.
• Various age verification methods exist, each with different implications for data collection, access, retention, and potential for misuse.
• Data brokers extensively collect, repackage, and sell personal information, making it crucial for individuals to actively manage their digital footprint.
• Users can take steps to minimize data broker access, including requesting data deletion and utilizing privacy tools like tracker blockers and strong password practices.
• Corporate accountability for user data protection is vital, as evidenced by ongoing issues with companies like X and the need for strong regulatory oversight.
• The erosion of online privacy through these mechanisms poses threats to anonymity, free speech, and access to essential online communities, particularly for vulnerable groups.

Sources

1. [1] LGBT Q&A: How Can I Wipe Online Data That Points To My Queer Identity? (www.eff.org)
2. [2] EFF and Allies: X’s FTC Petition to Waive Privacy Violation Order Should be Rejected (www.eff.org)
3. [3] LGBT Q&A: What Data Are Companies in the UK Collecting When Verifying My Age? (www.eff.org)
4. [4] EFF to Gov. Pritzker: Veto Illinois’ HB 5511 (www.eff.org)

StealthAnon is a news and analysis site covering cybersecurity, privacy, web analytics, anonymity, and tech tools.