The SCREEN Act: A Sweeping Proposal Threatens Online Anonymity, Privacy, and Security

The United States Senate Committee on Commerce, Science, and Transportation is slated to deliberate on S. 737, colloquially known as the SCREEN Act. This comprehensive piece of legislation proposes a mandatory age-verification system for online services, requiring platforms to confirm users’ ages before granting access to any sexually explicit content. Critics argue that if enacted, this bill could compel millions of adult internet users to surrender their anonymity, privacy, and digital security simply to access lawful speech. The bill’s broad scope extends beyond traditional adult content sites, potentially impacting a wide array of online services, including major streaming platforms and social media networks, should they host even a single piece of adult material.

Background and Legislative Intent

The SCREEN Act emerges in a climate of increasing concern among lawmakers regarding the online safety of minors. Similar legislative efforts have been observed at the state level, often sparking vigorous debate and legal challenges. However, proponents of S. 737 posit that existing state laws are insufficient and that a federal mandate is necessary to create a uniform and effective framework for age verification. The stated intent behind such legislation is to shield children from potentially harmful content and to hold online platforms more accountable for the material accessible to underage users. Yet, the mechanisms proposed by the SCREEN Act have drawn sharp criticism for their potential overreach and the unintended consequences they may impose on adult users.

The Broad Reach of Age Verification

Unlike many state-level age-verification laws, which often tie requirements to websites predominantly featuring explicit content deemed harmful to minors, the SCREEN Act’s threshold is significantly lower. The bill mandates age verification for nearly any service that hosts even a single piece of sexually explicit content. This definition could encompass a vast spectrum of the internet, including, but not limited to, popular adult content platforms like PornHub and OnlyFans, as well as mainstream services such as Netflix, Amazon Prime Video, and social media giants like Reddit, Discord, and Bluesky, if any adult material is present. The implication is that millions of adult users seeking to engage with lawful content will be subject to age verification processes.

Beyond Simple Attestation: The Invasive Nature of Verification

The SCREEN Act explicitly states that "requiring a user to confirm that the user is not a minor shall not be sufficient." This provision signals a move away from simple self-attestation, which has been the standard for many platforms. Instead, the bill necessitates methods that tie users’ real identities to their online access. In practice, this means platforms would likely need to implement robust identity verification systems.

The process of providing proof of age online is fundamentally different and significantly more invasive than presenting identification in the physical world. When an individual shows an ID to a bartender or a bouncer, the physical document is briefly examined, its authenticity confirmed, and it is immediately returned to the user. The data captured is minimal, and the transaction is ephemeral.

Under the SCREEN Act, however, the "bouncer" would be a digital age-verification service. These services would likely collect and store substantial personal information, including potentially sensitive data such as names, dates of birth, and possibly even copies of identification documents. This information would then be stored in databases for an "unspecified amount of time," according to critics, creating a significant risk of data breaches and misuse. The Electronic Frontier Foundation (EFF) has highlighted this disparity, noting that digital verification methods can lead to the creation of extensive databases of personal information, a stark contrast to the limited, on-the-spot checks performed in physical establishments.

Unintended Consequences for Adult Users

The SCREEN Act’s ramifications extend beyond its intended targets. If websites and applications are compelled to reliably identify teenagers, the burden will invariably fall upon adult users to prove their age. This creates a scenario where a vast majority of internet users, who are adults and engaging in lawful activities, will be subjected to invasive verification procedures. The EFF argues that this creates a chilling effect on free expression and access to information, as users may opt out of accessing content altogether to avoid the hassle and privacy risks associated with age verification.

A Privacy and Data Security Nightmare

The collection and storage of personal identifying information by third-party age-verification services present a substantial privacy and data security risk. While the SCREEN Act includes a provision requiring services to take "reasonable steps to protect the data collected and to not maintain for longer than is necessary," critics contend these protections are woefully inadequate. They argue that these stipulations lack concrete collection, use, or retention limits, leaving ample room for the exploitation of sensitive user data.

Third-party verifiers could potentially gather extensive personal information beyond what is strictly necessary for age confirmation. The bill’s vague language regarding "reasonableness" could allow companies to utilize this data for various purposes, provided they can justify their actions. Furthermore, the allowance for companies to retain this compelled information for "as long as is necessary" raises significant concerns about data longevity, increasing the potential for security breaches and privacy violations over extended periods. A data breach involving such sensitive information could have devastating consequences for individuals, including identity theft and financial fraud.

Targeting VPNs: Undermining Privacy Tools

The SCREEN Act also includes provisions that directly impact the use of Virtual Private Networks (VPNs) and proxy servers. The bill mandates that covered websites verify users’ ages based on their IP addresses unless the service can ascertain that the user is located outside the United States. Crucially, it specifically requires age verification for traffic originating from known VPN addresses.

This provision is particularly concerning for individuals who rely on VPNs for legitimate privacy and security purposes. VPNs mask a user’s real IP address, routing their internet traffic through a remote server. This effectively hides their physical location and encrypts their online activity, offering a layer of protection against tracking, surveillance, and cyber threats. Millions of individuals utilize VPNs for a variety of reasons, including:

• Protecting Personal Privacy: Preventing internet service providers (ISPs) and other entities from monitoring browsing habits.
• Securing Public Wi-Fi: Encrypting data when using unsecured public Wi-Fi networks in cafes, airports, and hotels, thereby preventing malicious actors from intercepting sensitive information.
• Safeguarding Journalists and Activists: Providing a secure channel for communication and information dissemination for individuals operating in sensitive or restrictive environments.
• Preventing Data Tracking: Limiting the ability of websites and advertisers to build detailed profiles of users based on their online behavior.

By targeting VPN traffic, the SCREEN Act effectively discourages the use of these privacy-enhancing tools. It forces users who are intentionally taking steps to protect their anonymity and security to reveal their identities. This is akin to requiring individuals to remove their cloaks of invisibility before entering a public square, thereby negating the very purpose of the cloak. The EFF notes that this requirement is particularly galling, as it penalizes users for employing technologies designed to enhance their digital privacy.

Broader Implications for the Internet Ecosystem

The SCREEN Act, as currently drafted, presents a multifaceted threat to the digital landscape. Its broad application could fundamentally alter how millions of adults interact with the internet, eroding their expectation of privacy and anonymity. The potential for widespread data collection and storage by third-party verification services creates a significant vulnerability that could be exploited by malicious actors.

Furthermore, the targeting of VPNs undermines the principles of online privacy and security, which are increasingly crucial in an era of pervasive surveillance and data collection. The legislation risks creating a tiered internet, where enhanced privacy and security measures are viewed with suspicion and actively discouraged.

The long-term implications of such a bill could include:

• Chilling Effect on Free Speech: Users may self-censor or avoid certain online discussions and content for fear of their personal information being compromised.
• Reduced Innovation: Platforms may be hesitant to develop new services or features due to the compliance burdens and privacy risks associated with age verification.
• Increased Risk of Data Breaches: The aggregation of vast amounts of personal data creates lucrative targets for hackers.
• Erosion of Trust: Compelling users to hand over personal information to access lawful content could erode trust between users and online platforms.

As the Senate Commerce Committee prepares to review S. 737, it faces a critical juncture. The proposed legislation, while perhaps well-intentioned in its aim to protect minors, carries significant risks for the privacy, security, and freedom of all internet users. The debate surrounding the SCREEN Act will likely highlight the ongoing tension between online safety concerns and the fundamental rights to privacy and free expression in the digital age.

This article is a revised and expanded version of reporting originally published by the EFF Deeplinks blog.