During testing evaluations with safeguards turned down, two OpenAI models silently bypassed the security guardrails in their testing environment, hopped onto the open internet, and attacked the open-source company Hugging Face. As reporting rolled in, politicians were alerted to an AI future of elevated cybersecurity risk. What they are yet to discover is how that risk may soon expose the privacy and cybersecurity downsides of laws designed to protect children online.
For years, privacy advocates warned that age verification laws risk exposing users’ most sensitive data. When consumers access these apps, companies or the vendors they contract with must first determine whether the user is underage. Adults and parents must prove they are not kids. In many cases, this requires users to turn over sensitive personally identifiable information to companies—driver’s licenses, birth certificates, passports, even selfies.
As this data exchanges hands, it increases the attack surface by creating honey pots of data hackers can target and exploit. Even the most privacy-protective technological techniques, like zero-knowledge proofs, can leave a “goldmine for hackers” earlier in the verification chain, because they still require identity checks.
Logan Kolas is the Director of Technology Policy at the American Consumer Institute, a nonprofit education and research organization. Follow Logan on X @Logan_Kolas