Roblox announced this week that it will require age-verified accounts for users under 16, complete with restricted chat features and expanded parental controls. The stated goal is child safety. The unstated implication is that one of the largest online platforms in the world is moving toward mandatory identity verification for all users.
The company's announcement frames this as a natural evolution of its safety infrastructure. Parents will have more granular control over who their children can interact with. Chat features will be limited based on verified age brackets. On its face, this sounds reasonable. Roblox hosts over 70 million daily active users, and a significant portion of them are children who deserve protection from predators and inappropriate content.
But the mechanism matters as much as the outcome.
The KYC Creep
Know Your Customer requirements started in banking, spread to cryptocurrency exchanges, and are now colonizing social platforms. The logic is always the same: bad actors exploit anonymity, therefore anonymity must be eliminated. This reasoning has a seductive simplicity that obscures its costs.
When you require government ID to participate in online spaces, you create databases of identity information that become targets for hackers and surveillance states alike. You exclude people who lack official documentation. You make it impossible to participate in public discourse without leaving a permanent, linkable record of your activity.
The question isn't whether children need protection online. They do. The question is whether protecting them requires building infrastructure that could easily be repurposed for authoritarian control.
A Third Path Exists
Zero-knowledge proofs offer an alternative that the tech industry has been curiously slow to adopt. The cryptographic technique allows someone to prove they meet certain criteria, like being over 13 or over 18, without revealing their actual identity or age. You verify the attribute without collecting the data.
This isn't theoretical. ZK proofs are already deployed in various blockchain applications and could be adapted for age verification with sufficient investment. A user could prove to Roblox that a trusted third party has confirmed their age bracket without Roblox ever seeing their driver's license or passport.
The obstacle isn't technical feasibility. It's incentive structure. Platforms like Roblox benefit from collecting identity data. It improves ad targeting, reduces fraud, and satisfies regulators who prefer simple solutions. Privacy-preserving alternatives require more engineering effort and offer fewer commercial advantages.
The Precedent Problem
What Roblox implements today, other platforms will copy tomorrow. If mandatory age verification becomes the norm for gaming platforms, it will spread to social media, then to forums, then to any online space where minors might theoretically appear.
This isn't paranoia. The UK's Online Safety Act already pushes in this direction. Australia has proposed banning minors from social media entirely. Each new restriction builds on the last, and the ratchet only turns one way.
Parents have legitimate interests in controlling their children's online experiences. But those interests should be served through tools that parents control, not through surveillance infrastructure that corporations and governments manage.
China's approach to online identity should serve as a warning, not a template. The same systems that protect children can suppress dissent, track minorities, and chill free expression.
Roblox's new policies will probably make its platform marginally safer for kids in the short term. The longer-term consequences depend on whether the industry treats identity verification as a blunt instrument or develops the privacy-preserving alternatives that already exist. The technology is there. The will to use it is not.
