On June 18, a three-judge panel of the Sixth Circuit Court of Appeals upheld Ohio’s Parental Notification by Social Media Operators Act, reversing a district court injunction that had blocked the law since April 2025. The 2-1 ruling means Ohio can now require social media platforms and websites to verify the ages of users under 16 — and obtain parental consent before those minors can create accounts.

NetChoice, the tech-industry trade group that brought the challenge, argued the law violates the First Amendment. The majority didn’t buy it. Judge Alice Batchelder, writing alongside Judge Eric Clay, held that NetChoice couldn’t claim free-speech violations on behalf of minors and that the law functions as a parental-consent requirement — not a content ban.

Cue the familiar chorus: this is the “papers, please” internet. A surveillance state in miniature. The end of anonymous browsing. And yes, the privacy concerns are real. Handing over a driver’s license scan or a face scan to visit a website is not nothing. The data doesn’t vanish after verification — it pools somewhere, and somewhere has a breach, eventually.

But the privacy argument, for all its sincerity, is doing a lot of unacknowledged work. What it obscures is a simpler and less noble question: who makes money when nobody online has to prove who they are?

The Real Ledger: Unverified Users Are a Revenue Stream

Take a step back from the constitutional arguments and look at the balance sheets. The ad-tech ecosystem — the tracking, the real-time bidding, the cross-site profiling — runs on unauthenticated traffic. When a user arrives at a publisher’s page without logging in, the ad exchange doesn’t shrug. It fingerprints the browser, reads the cookies, consults the data broker, and serves a targeted ad anyway. That’s the business.

Age verification doesn’t just threaten anonymity. It threatens the economics of an open web that monetizes ambiguity. If platforms have to know who’s a minor, they have to know something about everyone. And once they start knowing, two things happen: the data becomes a liability, and the cost of compliance rises.

That second part is the one nobody in Silicon Valley wants to discuss on the record. Off the record, in a Slack DM this week, one product manager at a mid-size social platform put it bluntly: “We can’t build this. We don’t have the infra. We’d have to buy it from someone who does.”

“Someone who does” means the largest platforms — Meta, Google, Apple — which already have identity systems, photo libraries, and the engineering headcount to integrate verification APIs. The Ohio law doesn’t kill the internet. It kills the competitive internet.

The Incumbent Moat Nobody’s Talking About

This is the argument the digital-rights coalition tends to skip. They frame age verification as a privacy-versus-safety binary and hope you’ll pick privacy. What they don’t say is that the status quo — no verification, no friction, no identity gate — is also a regime with winners and losers. The winners are platforms with massive scale in ad targeting and data aggregation. The losers are smaller publishers, niche forums, and startups that can’t compete on data volume.

Ohio’s law, and the wave of similar statutes in states like Texas and Tennessee that followed the Supreme Court’s 2025 green light, reshuffles that deck. Now the moat isn’t data volume. It’s identity infrastructure. The companies that can verify a 15-year-old without hemorrhaging user trust or violating a thicket of state privacy laws are the companies that already have your photo, your phone number, and your payment card on file.

That’s not a distributed internet. That’s an oligopoly with better PR.

One veteran attorney who’s litigated these cases on the industry side acknowledged the dynamic — while waiting for an elevator at the Potter Stewart Courthouse in Cincinnati after the ruling — in terms his clients wouldn’t love: “We’re defending an open web that mostly exists to serve tracking pixels. The judges are starting to notice.”

The Honest Conversation

There is a version of this debate that takes both things seriously: the genuine privacy risk of mandatory age verification, and the genuine anti-competitive structure of the ad-supported internet that verification disrupts. The Sixth Circuit’s ruling forces that conversation, whether either side wants it or not.

If Congress were functional — a large if — it would pair any federal age-verification standard with a data-minimization mandate: verify, then delete. The technology exists. What doesn’t exist is a business reason to build it, because the companies loudest about protecting privacy are also the ones whose quarterly earnings depend on knowing everything about everyone.

Until that changes, the privacy panic will remain a tactical stance, not a principle. And the Sixth Circuit, whatever its flaws, just called the bluff.

Sources

  • The Statehouse News Bureau, “Panel of federal judges upholds Ohio’s age verification law on social media, websites,” June 18, 2026
  • U.S. Court of Appeals for the Sixth Circuit, NetChoice, LLC v. Yost, Opinion No. 26a0177p.06, June 2026
  • Electronic Frontier Foundation, “The Year States Chose Surveillance Over Safety: 2025 in Review,” December 2025
  • Internet Society, “Dangerous US Supreme Court Decision for Online Privacy and Security,” July 2025

Sources