The app Tea is a kind of digital whisper network for women. No men are allowed to join. Those who wish to be members must submit evidence, including selfies, in order to prove that they are women. Once they’ve been admitted, users have access to profiles of men annotated with information such as background checks and dating reviews; men with shady dating histories are rated with red flags. After launching in 2023, the Tea app got little attention for two years. Then, in July, thanks to TikTok and Instagram videos testifying to the app’s effectiveness at sussing out creeps, it reportedly gained more than two million new user requests. This might have been just another triumphant startup story, except that, on July 25th, the app suffered a data breach, and users’ selfies, I.D. photos, posts, and direct messages began appearing on the anonymous message board 4chan. Tea is meant to delete users’ documents after it verifies them, but it clearly had failed to do so. (The company has said that all of the leaked material was years old, which for victims of the breach must be cold comfort.) A Gen Z online-privacy activist named May, who asked that I leave out her last name, watched the leak happen and feared what it meant for the women who’d assumed that they were communicating within a protected space. “People can go and see that you’ve posted something about a guy,” May said. “He can now go after you.” (Tea did not respond to requests for comment.)

The Tea spillage is emblematic of what’s at risk when we attach our real-life identities to our online activities. Yet the tethering of identity to digital access is precisely what is prescribed by a new wave of laws going into effect around the world and in bills under consideration in the U.S. On the same day that the Tea leak was discovered, the Online Safety Act (OSA) rolled out in the United Kingdom. The act mandates that online platforms implement age verification in order to block underage users from “harmful and age-inappropriate content,” such as pornography and material that might encourage eating disorders, bullying, hate, or substance abuse. In theory, such laws protect minors, but in practice they affect all users’ experience of the internet. In order to verify who is a child online, after all, sites must also determine who is not. Adults in the U.K. now have to upload photos of their I.D.s showing their dates of birth or submit to other tests—facial-age estimation (from a selfie, say), a bank-account evaluation, a credit-card check—in order to watch certain music videos on Spotify or create unrestricted new social-media accounts. Eric Goldman, an associate dean at Santa Clara University School of Law, who has been studying online age verification, told me that these changes are about to dismantle what remains of the open web, which was predicated on anyone being able to access almost anything. “We’re witnessing the real-time destruction of the internet as we know it,” he said.

It is up to publishers to enforce these rules and determine what counts as “harmful.” Reddit has been particularly aggressive in complying with OSA in the U.K., requiring age verification for access to subforums on subjects including Alcoholics Anonymous, medical cannabis, and menstruation. The chat app Discord requires U.K. users to verify their age if they want to make certain changes to their moderation settings such as turning off message requests. X, Grindr, and Bluesky are rolling out forms of verification, too. Users, meanwhile, are devising ways to get around the barriers without giving up their identities. Virtual private networks, or V.P.N.s, can make it appear as though someone is browsing from another country; one V.P.N. provider reported an eighteen-hundred-per-cent increase in daily sign-ups from the U.K. after OSA age-verification rules went into effect. Other people are using A.I.-generated images or video-game screenshots to falsify their identities.

Shoshana Weissmann, the director of digital media at the R Street Institute, a libertarian-leaning think tank, told me that these regulations might superficially seem similar to a liquor store or a night club requiring patrons to show I.D.—just another minor annoyance that we accept as routine. A store clerk glancing at an I.D., however, is very different from a website storing personal data or tracking users’ activities. As the Tea leak demonstrated, any age-verification system that stores user data comes with vulnerabilities and risks compromising users’ privacy. In short, the new safety laws eliminate the relative anonymity that we have continued to expect online even as social media has collapsed the boundaries between our physical and digital lives. Some users will surely decide that it’s not worth sacrificing privacy for access to online material, which means that fewer people who may benefit from a putatively sensitive space, such as an online A.A. community, will ultimately access it. As Goldman put it, “Age-authentication mandates shrink the internet for adults.” The chilling effect will be felt especially among those who lack proper identification credentials and among publishers who can’t easily afford verification software, without which they risk incurring steep fines.

More such laws are coming. Australia is attempting to ban those under sixteen from social media, including from YouTube, and is set to roll out age-verification mandates even for search engines. France began mandating age verification for adult content in April, and, in June, President Emmanuel Macron proposed banning children under the age of fifteen from social media. In the U.S., the Kids Online Safety Act was reintroduced with bipartisan support this year. The bill originated in 2022, inspired, in part, by the leaking of internal Facebook documents showing that the company was aware of its products’ negative impacts on minors. If passed into law, it would in some ways give young users more agency over their internet experience, including the right to delete their data and to opt out of algorithmic recommendations. But, like OSA, it also includes age-verification measures that will be impossible to implement without compromising all users’ access to the internet. Many tech companies, including Apple, have come out in support of KOSA, hinting at the way increased surveillance might hurt individuals more than businesses, which never shy from collecting user data. YouTube is already rolling out automated, A.I.-driven age-verification tools to restrict certain content from American minors.

May, the Michigan activist, has been following developments in online regulation since the passage of the FOSTA-SESTA laws, in 2018, under Donald Trump, which pushed sex workers offline by holding digital platforms such as Backpage liable for hosting their content. In 2022, May started a Discord chat for people seeking to fight back against KOSA’s proposed policies; it now has more than three thousand members working on campaigns and petitions. The vengeful and draconian tactics of the second Trump Administration have caused many people from marginalized groups to be more fearful of making their personal identities public. As May put it, “You have queer people fleeing from Texas and Florida, and now you want my government I.D. attached to what I look up as an adult?” Put another way, if protecting underage users from harmful content means implementing blanket surveillance, have you made the internet safer or less so? May has noticed that younger members of her Discord seem particularly worried that they won’t be able to access digital spaces as safely as they did before: “The prospect of them losing their online communities—for a lot of these young people, that’s all they have.” Then again, those of us who are most reliant on the internet have tended to undervalue our anonymity, giving it up easily to the likes of Google and Meta in exchange for smoothly customized communication. Even now, prospective new Tea users are clamoring in the app’s Instagram comments to have their identities verified. ♦