Age verification laws are rapidly expanding across the US, mandating selfie or government ID submissions for accessing online platforms like gaming and social media. This patchwork of state-by-state regulations creates compliance chaos for platforms and significant privacy risks for users. Technologies range from on-device AI facial estimation to full ID scans, with data retention periods varying from immediate deletion to several years. While some platforms aim to minimize data collection, the sheer volume of verified identities processed by vendors creates lucrative targets for hackers, as evidenced by Discord’s data breach. These systems risk creating comprehensive surveillance profiles, linking immutable personal data to online activity, with potential for government access and a chilling effect on free expression online.