Age Verification Is Law. Your ID Is the Price. | Elacity
France just made age verification mandatory for social media. In practice that means handing a copy of your ID to every platform, and every copy becomes a breach waiting to happen.
Age Verification Became Law. Now Every Platform Wants a Copy of Your ID.
To prove you are old enough to open a social media account in France this month, you now have to hand a copy of your government ID to a company you will never meet, and trust it to delete a file it has every reason to keep.
On September 1, France began enforcing a ban on new social media accounts for anyone under 15, a rule the French parliament passed in July and President Macron made a flagship of his final term. It follows Australia's under-16 ban that switched on in December, and it lands as roughly half of US states now require some form of age check. Age verification stopped being optional. What almost no law says out loud is what age verification actually costs you.
The goal is right. The architecture is wrong.
Protecting children online is a real and urgent aim, and nobody serious argues otherwise. The failure here is not the intent. It is the mechanism the law quietly assumes.
To check an age, a platform or the vendor it hires collects a document, reads one fact from it, and then stores the whole thing. The law mandates verification. It never mandates forgetting.
Age verification quietly became a retention mandate
In October, Discord disclosed that attackers stole roughly 70,000 images of government IDs from a third-party support vendor. In February, researchers found the age-verification firm Persona had left part of its infrastructure exposed on the open internet. Security analysts now name the pattern directly: the breach wave is a retention problem, not an accuracy one. The documents were verified correctly. They were simply kept.
The copy is the vulnerability. Whoever holds it can lose it, sell it, be compelled to surrender it, or be breached for it. Multiply one stored file by every service a person signs up for, and a rule meant to protect people manufactures the exact database attackers want most. We have made this point before about passwords and keys: the vulnerability is storage itself. Age verification just handed the same flaw a legal mandate.
Proving a fact is not the same as surrendering it
A bouncer needs to know you are over 18. He does not need to photocopy your passport and keep it in a drawer forever. Online we do the opposite by default: we surrender the entire document so a server can read one field, and then the server holds the entire document.
This is the design flaw Elacity was built to remove, in a different domain first. If a secret never has to be handed over and stored to be useful, there is nothing to leak later.
Used, never owned: the pattern that leaves nothing to leak
Elacity's core primitive is that a secret is used, never owned. When a key signs, decrypts, or pays, the secret exists in the clear only for a split second inside a sealed sandbox, welded to that one action, then wiped. No app, no platform, no attacker ever holds the key at rest, because there is no key at rest to hold.
The custody that makes this possible is split across an owned quorum of independent machines, each re-checking your on-chain rights before it releases its share, and no single operator, Elacity included, ever assembles the whole secret in one place. There is no central copy to steal because the design refuses to keep one. That is a trust-minimised arrangement, not a magic one, but it removes the honeypot rather than promising to guard it.
What the law could borrow from ownership
Elacity is not an age gate, and I want to be exact about that. It is a working proof, running today for real content and real payments, that you can use a secret without any party storing it. The principle transfers cleanly. Age assurance should be able to answer over 15, yes or no, without a platform ever holding the ID that proves it, and without a vendor keeping a file it swore it would delete.
Passkeys already showed a smaller version of this is possible: a login no longer needs a stored password sitting in a database waiting to be copied. We wrote about what that fixes and what it leaves untouched. Age verification is the next place the same idea belongs, and the pattern is the same one Elacity treats as social architecture: design so surrender is never required, and a copy is never kept.
The law got the destination right and the map wrong. It asked for proof and accidentally asked for retention. A system that cannot keep what it verifies cannot leak it either. The next rule will demand more proof, not less. The only question left is whether it also demands a copy.
For more on building systems that prove without surrendering, follow Elacity on X.