Children Online: Pornography, Age Assurance, and Privacy

The position

Online child protection and adult privacy are one design problem. A rule that protects minors by making every adult identify themselves to every site creates a new surveillance and breach hazard. A privacy rule that bars any reliable age distinction can leave children inside services whose business model depends on attention, sexual content, or behavioral targeting. The answer is a graduated duty tied to the service and harm, with minimum disclosure at every layer.

Proposal 1: child-directed services owe protective design

Services directed to children should apply privacy protection to every user rather than collect more data to sort them. Covered duties should include data minimization, separate parental consent for third-party advertising, deletion limits, no sale of precise location, protective contact and messaging defaults, clear reporting, and independent assessment of engagement features.

Mixed-audience and general services may use proportionate age assurance when a legal duty changes with age. They may collect only what is needed to establish the age band and must delete source data promptly.

Proposal 2: a narrow adult-content rule

Congress should establish a federal safe-harbor framework for commercial services primarily engaged in distributing material obscene to minors. A compliant service may accept any approved age-assurance method meeting accuracy, privacy, accessibility, and security standards. The rule should not extend to a library, search engine, news outlet, health service, general social network, or site merely because some content discusses sex or identity.

Content classification needs written criteria, notice, and expedited judicial review. Government cannot convert “protect children” into a roving power to classify disfavored ideas as pornography.

Proposal 3: proof should be unlinkable

An age proof should answer one question: whether the user is above the threshold. The relying site should receive a signed token with short expiration and no stable cross-site identifier. The proof provider should not learn which adult content was requested. Biometric estimation, government-ID checks, payment confirmation, device-based parental controls, and other methods may qualify only after independent testing. No single method or vendor should become mandatory.

Proposal 4: measure whether the rule works

Regulators should publish method-level false acceptance, false rejection, demographic performance, accessibility, bypass, deletion, breach, and appeal data. NIST should maintain public evaluations and open testing interfaces. A method that collects sensitive identity but does not materially reduce minor access fails proportionality and loses approval.

Proposal 5: rights and remedies

Users need notice, a fast alternative when proof fails, correction, deletion, and a private remedy for unlawful retention, content-linked identity, sale, or negligent breach. Covered providers need clear federal rules rather than fifty incompatible identity systems. States may set stronger child- design duties that preserve the federal privacy floor.

Proposal 6: parents, children, and development

Parents ordinarily choose filters, device settings, and household rules. A child's privacy and voice should grow with maturity; a parent-control tool should not silently expose counseling, abuse-reporting, or other protected help-seeking. Product design should offer age-banded autonomy rather than one switch that treats a seventeen-year-old and a seven-year-old alike.

Trade-offs considered

Adult users will face friction and some will be wrongly excluded. Services and proof providers will bear compliance and security costs. Determined minors will evade some systems. Those costs do not defeat a narrow rule, but they control its architecture. Minimum disclosure, multiple methods, appeal, public testing, and automatic deletion are conditions of legitimacy, not optional privacy features.