Age-Gating Laws and Smart Wearables Pose Growing Threats to Digital Privacy

Featured image: Photo by Ron Lach on Pexels.

In an increasingly interconnected world, the landscape of digital privacy is constantly shifting, presenting new challenges to individuals’ control over their personal information. Two distinct yet converging trends stand out as significant threats: the proliferation of age-gating laws designed to restrict online access based on age, and the widespread adoption of smart wearable devices that continuously collect highly sensitive personal data. Both phenomena, while often presented with benevolent intentions, carry profound implications for anonymity, security, and the fundamental right to privacy for internet users of all ages.

The Expanding Reach of Age-Gating Legislation

The push for age-gating on the internet is gaining momentum, with various legislative efforts aiming to require users to verify their age to access certain online content or services. While proponents often cite the protection of minors as the primary goal, the methods proposed to achieve this introduce substantial privacy and security risks that extend to everyone. Such laws invariably push operating systems and app stores to collect users’ ages, categorize them into brackets, and then block access to lawful speech and services based on these age determinations [1].

Consider the situation in California, where A.B. 1043, effective January 2027, mandates such age collection and content blocking. The law imposes significant liability, including fines of up to $7,500 per affected child for violations. This creates a powerful incentive for services to implement age verification methods. In practice, this could lead to a surge in demands for ID checks, biometric scanning, and other invasive data collection techniques, forcing individuals to link their offline identities to their online activities. This process not only creates barriers to lawful speech but also increases the risk of sensitive personal data being leaked, hacked, or misused [1].

While legislative bodies sometimes reconsider the most problematic aspects of these laws, the underlying framework remains a concern. For instance, California’s legislature recently stepped back from expanding A.B. 1043’s age-gating framework to browsers and websites, and also exempted open-source operating systems from some requirements. This partial retreat acknowledges some of the harms, but the core issue of requiring age verification for internet access persists [1]. At the national level, proposals like the “KIDS Act” in Congress similarly aim to control online content, raising concerns that such measures prioritize surveillance over genuine privacy protection [3]. The principle that no one should have to provide or verify their age to access the internet is crucial for maintaining online anonymity, privacy, and security [1].

Smart Wearables: Constant Surveillance by Design

Beyond legislative mandates, the ubiquitous presence of smart wearables—from fitness watches and rings to health bands—introduces another layer of digital privacy challenges. These devices, marketed for health and fitness monitoring, collect an astonishing array of personal data, including heart rate, sleep patterns, steps taken, and even precise location [2]. Despite their intimate connection to personal health, the data gathered by these commercial devices often lacks the stringent privacy protections typically associated with medical records.

The companies manufacturing these wearables frequently collect vast amounts of this sensitive information. Many of them then proceed to share this data with third parties for various purposes, such as marketing or influencing insurance rates. They may also utilize the data for their own internal processing and development. This raises significant concerns about who has access to our most personal health metrics and how that information might be leveraged outside of our direct knowledge or consent [2].

Moreover, data from wearable devices is increasingly becoming a target for law enforcement and government investigations. Information about an individual’s heart rate or movement patterns can be used to determine their whereabouts or activities at specific times, proving critical in legal cases. Surveillance companies even identify fitness trackers as an “overlooked source” for law enforcement due to their ability to reveal movement patterns and physiological changes. Law enforcement agencies can seek access to this highly personal data through subpoenas or warrants, highlighting the vulnerability of this information [2].

The Critical Absence of Transparency and End-to-End Encryption

Two fundamental privacy safeguards that are alarmingly absent in most smart wearable devices are comprehensive transparency reports and robust end-to-end encryption for stored data. These features are essential for users to understand and control how their sensitive health information is handled.

Transparency reports detail how often companies receive and respond to government requests for user data. While such reports have become a standard expectation in many areas of the tech industry, they are remarkably rare among fitness gadget manufacturers. Of a survey of ten major wearable companies, only Apple and Google (which includes Fitbit) currently publish transparency reports. A few others, like Oura and Suunto, have either recently updated their policies to indicate openness to such reports or expressed an intent to evaluate them [2]. Without these reports, users remain in the dark about the extent to which their personal health and movement data is accessed by law enforcement or government entities. Any company handling data of interest to governments has a responsibility to publish transparency reports and, when legally permissible, notify users of such requests [2].

Even more concerning is the scarcity of end-to-end encryption (E2EE) for the health data collected and stored by wearables. E2EE ensures that only the user can access their personal data, meaning the company itself cannot view or utilize the information stored in the cloud. This level of encryption is common in secure messaging apps and password managers, and there is no technical reason it cannot be applied to wearable data. However, among popular consumer health wearables, only data stored in the Apple Health app from an Apple Watch offers end-to-end encryption by default, provided two-factor authentication is enabled. This protection, however, does not extend to data shared with third-party apps or other non-Apple wearables [2].

The vast majority of wearable companies instead rely on encryption “in transit and at rest,” which, while offering some security, still allows the company to see and use the data. This industry standard falls short of true user privacy. The general lack of E2EE or more robust local-storage options, where data remains solely on the device or phone without cloud syncing, represents a major privacy oversight. While implementing E2EE can present technical challenges and may affect certain features, companies should offer it as an option, allowing users to choose between convenience and maximum privacy for their highly personal health data [2].

Protecting Our Digital Rights

The combined pressure from age-gating laws and the data-hungry nature of smart wearables presents a formidable challenge to digital privacy. Age-gating mandates threaten to fundamentally reshape the internet into a less anonymous and more surveilled space, while wearables turn our most intimate health data into a commodity potentially accessible by third parties and governments. Users are not powerless, however. It is imperative to challenge these invasive laws and demand higher privacy standards from technology companies. Asking for transparency reports and advocating for end-to-end encryption or robust local-storage options on wearables are crucial steps. Protecting digital rights requires vigilance and a collective effort to ensure that technology serves us without compromising our fundamental freedoms.

Key Takeaways

• Age-gating laws, like California’s A.B. 1043, risk mandating invasive age verification methods such as ID checks and biometric scans, threatening online anonymity and security for all users.
• Smart wearables collect highly sensitive health and movement data, which is often shared with third parties or used in law enforcement investigations, despite lacking special privacy protections.
• Most wearable companies fail to provide transparency reports on government data requests, leaving users unaware of potential access to their personal information.
• End-to-end encryption for wearable health data is extremely rare, with Apple Watch’s Health app being a notable exception, meaning most companies can access users’ sensitive data.
• Users should advocate for stronger privacy features, including transparency reports, end-to-end encryption, and local-only data storage options from wearable manufacturers.

Sources

1. [1] California Steps Back From Dangerous Expansion of its Age-Gating Law (www.eff.org)
2. [2] Most Smart Watches, Rings, and Bands Lack Basic Transparency Reports and Key Privacy Features (www.eff.org)
3. [3] 🚫 Don't Let Congress Age-Gate the Internet | EFFector 38.13 (www.eff.org)

StealthAnon is a news and analysis site covering cybersecurity, privacy, web analytics, anonymity, and tech tools.