Age-restrictions on the web and user privacy and safety

Web content restrictions and age verification has been in the news recently and the more I read about it, the more states that mandate it, the more conversations I have (e.g., at W3C’s TPAC 2025 a few months ago), the more thoughts I have on the topic of user privacy and user safety on the web. This is among the topics that were at the heart of the October W3C/IAB workshop on Age-Based Restrictions on Content, whose report is being prepared.

This post is neither a W3C statement, nor representative of the Workshop co-organizers. However, it is a topic I care about and I spoke with my colleague Tara Whalen, W3C’s Principal Privacy Specialist and I would like to share informed personal considerations, of which I think there are many, in both the problem and solution spaces.

The workshop approached the fact that regulation is being enacted in many jurisdictions to restrict online content based on age and that this has detrimental effects on technical architectures and users; and attempted to build a shared understanding of the properties of the solutions — focusing on the technical and architectural aspects, without debating the merits and mandates of online age-restrictions.

A few of the unintended consequences that we are collectively grappling with are privacy violations, gatekeeping, fragmentation, data breaches, anonymity violations, and increased phishing risk. It also seems important to caution that in the absence of rigorous testing and mature deployments, it is unsafe to assume that security measures like zero-knowledge proofs can guarantee the minimal disclosure of personal information. In many cases, the issues appear to be more than age-based, they are safety-based, privacy-based.

At the November 2025 W3C TPAC, Tara reported in front of W3C Members and all attendees —in-person and remote— on the W3C/IAB workshop on Age-Based Restrictions on Content. She highlighted that more discussion is needed and that more than one approach is likely required. She said next steps include publishing the workshop report but ultimately it is about providing clarity to policymakers, and figuring out the right technical policy and industry coordination and where to continue the discussions.

The 40 or so people who took part in the Workshop identified, I think, around 60 requirements, and that the most likely successful coordination needs to involve technologists, policymakers and stakeholders (both from the public sector and private sector), so it is a large issue and it is much larger than just W3C and the IAB/IETF and it needs to be figured out urgently. Again, many jurisdictions are enacting regulations and there isn’t one central place yet to guide people to.

Since then, the Team took the topic to the regular meetings of the session at W3C Breakouts day late March followed by a presentation and open discussion with W3C Members at their bi-yearly meeting last week. And we can do more. Please join the newly created W3C Community Group on online safety. We are happy to take advantage of our extremely flexible and powerful W3C Community Group infrastructure. Community Groups enable anyone to gather at W3C to socialize ideas, including topics that involve coordination as complex as this one. We are grateful that we are already involved and are honored to offer the necessary forum for the community to figure out where and when to take the next steps.