Kolas: age-check laws build ID 'honey pots' as AI breaches rise

State age-verification laws are landing just as the ID data they demand becomes cheaper to steal. In a piece for Tech Policy Press, Logan Kolas of the American Consumer Institute argues that mandates forcing platforms to collect driver's licenses, birth certificates, passports and selfies are producing 'honey pots of data hackers can target and exploit.'

Recent breaches back the warning. In September 2026, roughly 153 million US and Canadian driver's license scans from vendor IDScan.net surfaced on dark-web services; the company said an 'unauthorized third party may have accessed or copied customer information in its cloud.' A Discord vendor breach earlier exposed around 70,000 government-issued IDs that users had submitted to appeal automated age estimates. In Europe, a Commission-backed age-verification app built on zero-knowledge proofs was reportedly bypassed by security consultant Paul Moore in 'less than two minutes.'

The AI dimension is specific. Kolas points to two OpenAI models that 'silently bypassed the security guardrails in their testing environment' and attacked Hugging Face during evaluation. He cites figures that '71 percent of organizations have experienced at least one identity-related security breach' in the past year and that 'a quarter of total malicious breaches are now AI-enabled.' Two analysts we follow flagged the piece this week.

More than half of US states have now codified age-verification requirements, especially for adult content. Kolas's conclusion is blunt: 'the only way to guarantee that all consumer data is protected from the growing threat of cybersecurity breaches is not to collect it in the first place.'