The internet children use today is fundamentally different from the one lawmakers originally set out to regulate.
For years, online child safety has centered on a straightforward question: How do we keep children away from harmful content and interactions? Much of the policy response has focused on age verification, parental controls, and platform accountability. Those safeguards remain important, but artificial intelligence is rapidly changing the nature of the problem.
Generative AI has dramatically lowered the barrier to online fraud and impersonation. Criminals can now produce convincing fake identity documents, synthetic identities, deepfake videos, and sophisticated phishing campaigns at a scale that was nearly impossible just a few years ago. As
AI capabilities continue to evolve, distinguishing legitimate users from bad actors is becoming increasingly difficult for platforms and for the policymakers designing rules intended to protect children.
By the time many online safety laws take effect, they risk solving yesterday’s challenge.The challenge is no longer simply verifying someone’s age. It’s ensuring that the person behind a screen is authentic.
AI has changed the rules of online trust
AI has made digital interactions faster, more accessible, and more personalized. Unfortunately, it has also given malicious actors new tools to exploit online systems.
Fraud techniques once limited to experienced cybercriminals are now widely available through “fraud-as-a-service” marketplaces, allowing sophisticated attacks to be launched against organizations of every size. At the same time, users have grown accustomed to frictionless digital experiences, expecting to create accounts and access services in seconds. Platforms are increasingly asked to balance speed, convenience, privacy, and security, all while identifying more sophisticated deception in real time.
For platforms serving children and teenagers, those competing demands become even more significant. AI-generated identities and impersonation can undermine safeguards intended to verify age, obtain parental consent, or prevent harmful interactions. The technologies that support digital innovation are simultaneously making it harder to determine who is genuinely participating online.
Age verification remains important, but it cannot stand alone
Recent legislative proposals, including the Kids Online Safety and Privacy Act (KOSPA) and the KIDS Act, demonstrate growing bipartisan recognition that online child safety deserves greater
attention. Many proposals emphasize stronger age assurance requirements, parental controls, and increased accountability for online platforms.
These efforts represent meaningful progress, but legislation should recognize that age verification addresses only one piece of a much broader trust challenge. A system that accurately estimates a user’s age may still struggle if AI-generated identities or manipulated credentials can bypass existing safeguards.
Recent attempts to circumvent age checks show how quickly users can find ways around these measures. VPNs can disguise a user’s location, while borrowed credentials, manipulated images, advanced 3D models and even screenshots from low-resolution games can be used to deceive verification systems. These tactics will only become more sophisticated as AI develops, meaning any legislation that relies on a single check risks becoming outdated before it is fully implemented.
Platforms therefore need a layered approach that can adapt throughout the user journey. Depending on the level of risk, this could combine document verification, facial age estimation, liveness checks, and device and behavioural intelligence. A VPN or unusual device should not automatically identify someone as a bad actor, but it can provide an important risk signal when assessed alongside the wider context.
As AI becomes more capable of mimicking legitimate users, policymakers should consider whether regulations are solving for today’s threats or preparing for tomorrow’s.
Global policymakers are testing different approaches
Governments around the world are experimenting with different strategies for protecting children online, offering useful lessons rather than a single blueprint.
The United Kingdom’s Online Safety Act places greater responsibility on platforms to assess and reduce risks to children. Australia’s eSafety framework has paired stronger regulatory oversight with efforts to improve age assurance. Meanwhile, the European Union’s Digital Services Act focuses on platform accountability and systemic risk management rather than prescribing specific technical solutions.
Despite their differences, these frameworks share an important principle: they establish desired outcomes while allowing technology to evolve. That flexibility matters. AI capabilities are evolving far faster than legislation ever can. Regulations that lock organizations into today’s technologies risk becoming outdated almost as quickly as they’re implemented.
Technology-neutral policy will age better than technology-specific rules
Rather than prescribing one verification method, policymakers should establish clear performance standards for protecting children while allowing organizations flexibility in how
those outcomes are achieved. We already have a familiar model for this in the way Americans approach movie ratings.
The U.S. movie rating system focuses on the nature and maturity of the content, such as violence, nudity, language and substance use, rather than prescribing the technology theaters must use to enforce those standards. It also gives parents a clear framework for making decisions about what is appropriate for their children. Where age restrictions apply, such as for R-rated films, theaters can use identity checks to help enforce them.
The internet is far more dynamic than a movie theater, particularly when users can interact with one another and AI can generate or manipulate content in real time. But the underlying principle is useful: set clear expectations around risk and outcomes, give parents meaningful information and control, and allow safeguards to evolve with technology.
That same approach should guide online child safety. A risk-based model can require stronger protections where the potential for harm is greatest without imposing unnecessary friction on lower-risk experiences. It can also give platforms flexibility to respond to new threats, from deepfakes to synthetic identities, without requiring lawmakers to rewrite the rules every time the technology changes.
Protecting children effectively should not require collecting more personal information than necessary. The goal should be establishing an appropriate level of trust for the risk involved, not mandating a particular tool to achieve it.
Child safety and privacy should reinforce one another
Too often, discussions about online safety frame privacy and protection as competing priorities. In reality, the two objectives should strengthen each other.
Children deserve online environments that are both safe and respectful of their personal information. Achieving that balance requires solutions that minimize unnecessary data collection while providing confidence that users are authentic and appropriate safeguards are in place.
Rather than relying on more invasive verification processes across every platform, policymakers should encourage privacy-preserving methods that scale according to risk and evolve alongside emerging threats.
Protecting children in the AI era requires rethinking digital trust
AI has fundamentally changed the online trust landscape. The same technology driving extraordinary innovation is also making fraud, impersonation, and exploitation more sophisticated and accessible than ever.
But that doesn’t mean we need to reinvent every principle of child safety. The movie rating system offers a useful lesson: establish understandable standards around risk, give parents meaningful control, and create stronger safeguards as the potential for harm increases. What needs to evolve for the AI era is how those principles are applied.
Unlike a movie, an online experience can change in real time. A child may encounter another user, an AI-generated persona, a deepfake, or content that did not exist when they first entered a platform. That means safeguards cannot always end at the point of entry.
Platforms need layered systems that can respond to changing risk throughout the user journey. Depending on the context, that could include age assurance, document checks, liveness detection, behavioral signals and contextual risk analysis. The objective isn’t to verify every user at every moment, but to apply the right level of assurance when the risk warrants it.
Policymakers therefore don’t have to choose between established child-safety principles and entirely new rules for AI. They can build on what already works while recognizing that digital environments are more interactive, personalized and dynamic than traditional media.
Protecting children online will always require age verification. But in an internet increasingly shaped by AI, age alone is no longer enough. The next generation of online safety policies must also answer a more fundamental question: can we trust that the person on the other side of the screen is who they claim to be?
