[Analysis] The Shadow of Mandatory Age Verification: How US KOSA and EU Chat Control are Accelerating the Digital Surveillance Regime

As of July 9, 2026, the global digital privacy landscape is reaching a major turning point. The Kids Online Safety Act (KOSA) in the US and 'Chat Control 2.0' in the European Union (EU) are attempting to introduce a powerful mechanism of 'mandatory age verification' under the pretext of child protection. This is interpreted as an attempt to dismantle anonymity—the fundamental premise of internet use—and place all users in an identifiable state, going beyond a mere technical measure.

As controversies surrounding message scanning and the introduction of encryption backdoors have intensified in recent years, legislators have begun to focus on the more 'quiet' method of age verification. However, experts warn that this approach will ultimately result in linking all web browsing activities to an individual's identity. This is why concerns are being raised that tools intended to protect children could transform into a global digital surveillance infrastructure.

This legislative trend also carries significant risks from a technical security perspective. The vast amounts of biometric information and identity data collected for age verification become highly attractive targets for cybercriminals. In particular, statistics showing that the frequency of cyberattacks reached an all-time high in the first half of 2026 serve as a wake-up call regarding the vulnerabilities of centralized identity databases.

In this article, we examine the current status of major legislation in the US and EU as of July 2026 and provide an in-depth analysis of the privacy violations and technical security threats that mandatory age verification will bring. Furthermore, we aim to forecast the future direction of the digital regulatory environment through the reactions of Big Tech companies and civil society.

Starting from the second week of July 2026, legislative procedures in the US and Europe have passed significant milestones. In the US, the latest amendment to KOSA (S.1748) was accepted on July 2, accelerating the administrative process for the bill's passage. The European Union, under the Cypriot presidency, also held the fifth and expected final trilogue on Chat Control 2.0 on June 29, aiming to reach a political agreement within July.

Age verification is a surveillance system that no one voted for. While both KOSA and Chat Control appear to be stepping back from their most criticized measures, they maintain mandatory age verification—a quiet mechanism that turns anonymous browsing into identified browsing for all of us. — Evin McMullen, CEO of Billions.

The U.S. Senate's S.1748 bill focuses centrally on research regarding the establishment of age verification systems at the device and operating system (OS) level. This research aims to review the types of information to be collected for age verification, the accuracy of the systems, and ways to improve accessibility. In particular, as the U.S. Supreme Court ruled in the 2025 case 'Free Speech Coalition v. Paxton' that age verification requirements for adult content websites are constitutional, these legislative attempts have secured legal legitimacy.

EU Chat Control 2.0: Evolution from Scanning to Identity Verification

The European Union is preparing a permanent regulatory proposal to replace the existing voluntary message scanning measures (Chat Control 1.0), which expired as of April 4, 2026. The Cyprus presidency aims to reach a political agreement within July 2026, which includes mandatory age verification for private messaging services. Although some provisions were modified due to public opposition to indiscriminate scanning, the core structure mandating user identity verification remains in place.

• Major Big Tech companies such as Google, Meta, Microsoft, and Snap have formalized their position to continue scanning private messages regardless of the legislative status.
• The United States Conference of Catholic Bishops (USCCB) supported measures to strengthen parental control, such as the right to opt-out of personalized recommendation systems and restrictions on geolocation sharing, in a March 2026 letter.
• Civil society groups are strongly protesting, claiming that age verification will effectively force all internet users to present digital identification.
• Technical experts are warning that the high error rates of age estimation tools and the risk of data breaches will accelerate privacy violations, urging for the development of alternatives.

According to a report by security firm Immunefi, cryptocurrency hacking incidents reached an all-time high of 207 cases in the first half of 2026. Although the amount of damage in the decentralized finance (DeFi) sector was only $972 million, a 74% decrease compared to 2022, the increased frequency of attacks is significant. This serves as strong evidence of how attractive and vulnerable a target centralized identity verification databases could become for hackers if established.

The future regulatory schedule is tightly packed. The Council of the European Union and the Parliament are expected to finally adopt the Chat Control 2.0 regulation in the second half of 2026, which is projected to fundamentally change the digital service environment in Europe. Furthermore, a revision of the MiCA (Markets in Crypto-Assets) regulation is scheduled for 2027, which is expected to expand regulations on foreign stablecoin issuers and further strengthen supervision over the digital asset and payment markets as a whole.