This is the fork worth fighting over, and it is being missed because the debate is stuck on the wrong axis. Legislators frame the choice as safety versus freedom; critics frame it as protection versus privacy. Both accept a false premise, that keeping children out of adult spaces requires identifying the adults. It does not. The real choice is between two ways of verifying age: one that minimizes data and forgets you the instant you pass, and one that maximizes data and remembers everyone forever. Only the second is surveillance, and only the second is currently the path of least resistance.
The window to insist on the first is now, while these bills are still moving. The KIDS Act heads to a skeptical Senate. Chat Control 2.0 is targeting political agreement in July. In both cases the principle, that platforms should be able to tell adults from children, has effectively been settled. What has not been settled is whether that capability is built on privacy-preserving proofs or on a mountain of uploaded passports. That is a technical decision with civil liberties consequences, and it is being made, right now, largely by default.
There is a larger reason to settle this well, and settle it now. The old sorting of internet traffic into “bot or human” is already breaking down: a verified third category is arriving, AI agents acting, with authorization, on behalf of people, companies and governments, and they will soon need to prove what they are permitted to do without unmasking whoever stands behind them. “Know Your Agent” will demand the very same privacy-preserving architecture we are arguing over now for people. Decide it well for human age checks, and we set the pattern for everything that follows. Decide it badly, and we hard-wire surveillance into the identity layer of the internet, for humans and machines alike.
