'The death of anonymity online' – Proton boss Andy Yen attacks current age verification laws

Proton boss, Andy Yen, has warned current age verification proposals will result in "the death of anonymity online."

A wave of age verification laws has swept across the world, with noticeable legislation passed in the UK, US, and EU.

Yen is the CEO of Proton, which counts one of the best VPNs – Proton VPN – among its products. Writing in a blog post, he said the type of age verification legislation we are seeing is "far too broad in scope" and "we simply can't afford to get this wrong."

Both Yen and Proton stress the need to protect children online. But existing approaches risk the online privacy and safety of everyone, and only big tech companies stand to gain.

Proton believes "we need to consider the unintended consequences of these proposals and put the breaks on the rush to legislate before it's too late."

Cybersecurity risks

The cybersecurity risks of age verification are serious. Government IDs, credit card information, and selfies are just some examples of the data needed to be submitted as proof of age. Websites and platforms use different age check providers, so data may have to be handed over more than once. Privacy experts have called it a "disaster waiting to happen."

As Yen states, highly sensitive personal information is a prime target for hackers. He warned that "data gets leaked" and referenced the October 2025 Discord hack. This was the first "notable" hack relating to age verification checks, affecting users who had accessed its third-party customer support services – government IDs were part of a long list of data stolen.

Yen believes breaches will keep happening, and he described platforms lacking expertise as "easy prey."

"Governments cannot be trusted"

Governments are wilfully implementing age verification legislation. The UK's Online Safety Act came into effect in July 2025, and in December 2025, Australia's under-16 social media ban came into effect.

The EU launched the Digital Services Act in 2022 and has been working on an app to check people's ages. Despite claims the app meets the highest security standards, and is open-source, the app's protections were reportedly bypassed in under two minutes. The EU Commission has since said the app has been fixed, but this highlights the fragile security of age verification systems.

Yen highlighted the growing calls for age verification to be completed on device, by the likes of Apple, Google, and Microsoft – Apple has recently rolled this out in the UK.

However, Yen warned that these companies "have built their empires on collecting data" and engaged in anti-competitive practices. Big tech has paid billions in fines and Yen didn't think they should be given even more power. He asked if anyone seriously believed they wouldn't abuse it.

ID for everyone is terrifying

Yen argued that age verification will result in ID being required "for every single person going online," no matter their age or reason. He said this "should terrify us all."

Big Tech often colludes with governments and Yen questioned how far this would go. He asked how long it will take before every country joins the UK in asking Apple to tie accounts to IDs. Yen said, once these IDs are collected, "it’s a short leap to blocking access based on nationality or other factors."

He questioned how long before governments ask for the names of everyone who'd downloaded a certain app, and how long before certain individuals are blocked from the internet entirely. "Is this really a road we're prepared to go down?" he asked.

Yen argued that stripping away anonymity will reduce the number of whistleblowers, people in need won't ask for help, and "democracy itself suffers."

Alternatives are there

Yen was clear in saying "parents’ concerns are valid and sincere." He added that children shouldn't have "unfettered access" to the internet. But he put forward alternatives to existing age verification legislation, saying tech companies shouldn't "become gatekeepers" of adult internet access.

Many privacy and cybersecurity experts, including Yen, have pushed for improved parental controls. Yen said the controls "should be obvious and easy to use, not an afterthought scattered across hidden menus."

Yen called on tech companies to improve in-app and device-level parental controls, as well as arguing the scope of age verification must be limited to social media and sites hosting explicit adult content – where he said "the potential for harm is greatest."

As well as limiting scope, Yen said, if they exist, checks "must be done right." He said:

• Checks should be conducted client-side, on a user's device
• Facial scans should be used and instantly discarded – not ID submission
• Age determination must be fully anonymized, end-to-end encrypted, and free from identifiable information
• Code for age checks must be open-source

Yen said this is "non-negotiable" and "the only way" we can guarantee data won't be stolen. He said the best, and safest approach, is not collecting data at all.

"We certainly cannot entrust it to the same giants that have a proven track record of exploiting our private information," he said. Yen then stated "faceless new companies" and governments cannot be trusted either.

The "root cause" of online harm, Yen said, was advertising. Attention-based business models give companies "an incentive to spy" and keep everyone hooked on their products – including children.

"Age verification should not distract us from the real danger to children and adults alike," Yen warned. But he said age verification risked "locking in and reinforcing all the worst aspects of the internet," leading us to a "hellish place."