"It's a smokescreen" – Alexandria Ocasio-Cortez and NordVPN become unlikely allies as they blast age verification laws

Alexandria Ocasio-Cortez has sharply criticized proposals to introduce mandatory online age verification, warning the measures could pave the way for mass data collection and online surveillance.

Speaking during a markup of technology bills in the House Energy and Commerce Committee, the congresswoman said the policies risk exposing large amounts of personal data without meaningfully protecting children online.

"It's being used as a smokescreen for what Big Tech lobbyists want," Ocasio-Cortez said. "What they want is a national surveillance program where they can harvest the personal and private data of every American with zero actual protections for people and their privacy."

Her comments come as debate around online age verification intensifies in the United States. At the same time, NordVPN has raised concerns about a new law in Utah that could require websites to verify the age of users even if they appear to be connecting from outside the state through a VPN or proxy.

Privacy advocates say the proposals could change how people access parts of the internet, while raising new questions about how identity checks would work in practice.

Outcry not limited to congress

Concerns about online age verification are also being raised outside Washington. NordVPN – which tops our rankings of the best VPNs – has warned that a newly passed law in Utah could create major technical and privacy challenges for websites.

The legislation, Utah Senate Bill 73, requires online services to verify the age of users physically located in the state. But the law goes a step further by applying the rule even if a user appears to be connecting from somewhere else through a VPN or proxy.

According to NordVPN, that requirement creates what it calls an "unresolvable compliance paradox." Websites can't reliably tell whether someone is physically in Utah if they're using tools that mask their location, and blocking VPN traffic entirely would be extremely difficult in practice.

VPN companies frequently rotate and add new IP addresses, meaning there is no comprehensive list websites could use to filter VPN users. Attempting to block them could also disrupt access for legitimate users who rely on VPNs for privacy, security, or work.

NordVPN warned that the only guaranteed way for websites to comply would be to verify the age of every visitor globally. That, the company said, could expose millions of users to identity checks they are not legally required to undergo, raising significant privacy concerns.

Why age verification laws are gaining attention

Age verification laws are increasingly being discussed by lawmakers who say they are trying to protect minors from harmful online content. These measures typically require websites to confirm a user's age before allowing access to certain platforms or material. Laws have come into force in the UK, and a number of US states such as Wisconsin and Arizona.

Supporters argue stronger safeguards are needed as children spend more time online. Critics, however, say the systems often rely on identity checks that require users to submit sensitive personal data, raising concerns about privacy, security, and how that information might be stored or shared.

Those concerns were echoed by digital rights group Fight for the Future, which has long opposed mandatory online identification systems.

"It was actually so refreshing to hear a member of Congress explicitly detail why ID checks for the internet are a surveillance nightmare that wouldn't protect kids," said campaign director Sarah Philips, praising Ocasio-Cortez's remarks during the committee discussion.

The debate highlights a growing tension between attempts to regulate online platforms and warnings from privacy advocates that new safeguards could unintentionally reshape how people access the web.

What this means for internet users

For now, the Utah law is not yet in effect. The legislation is expected to take effect in May 2026, meaning there is still time for lawmakers to revisit the rules or clarify how websites are expected to comply.

Even so, the debate highlights how age verification requirements could affect everyday internet use if similar laws spread to other regions. Systems that rely on ID checks could require users to submit personal information before accessing certain websites or online services.

Privacy advocates warn this could create new risks if sensitive data is collected and stored by third-party verification systems. Others argue the rules could push more people toward privacy tools if they want to avoid sharing identification details online.

NordVPN says lawmakers should work with technologists, legal experts, and privacy specialists before introducing rules that could create new privacy risks for internet users.