A wave of youth-addiction lawsuits, chatbot wrongful-death cases and state child-safety laws is forcing U.S. technology companies to answer a question they have largely avoided: Is the person behind the screen an adult or a child?
For Peter Horadan, CEO of identity verification company Vouched, the answer begins with a broader truth about the internet.
“Any workflow or any process really starts with identity, knowing who you’re dealing with,” Horadan said. “Up until now, the only real tool we’ve had for that is your physical ID that sits in your wallet.”
The legal pressure is becoming difficult to dismiss. As of June 1, the federal multidistrict litigation accusing Meta, Google, Snap, TikTok and other companies of designing addictive products harmful to young people included 2,664 pending cases. In March, a Los Angeles jury found Meta and Google negligent and awarded $6 million to a woman who said Instagram and YouTube contributed to mental-health injuries beginning in childhood.
[Related: Age Verification is Becoming the Internet’s Next Identity Fight]
AI companies are entering the same liability cycle. Character.AI and Google settled a lawsuit alleging a chatbot contributed to the suicide of a 14-year-old Florida boy. OpenAI also faces lawsuits alleging harmful chatbot interactions contributed to deaths and has introduced parental controls and an age-prediction system that applies additional safeguards when an account appears to belong to someone under 18.
Meanwhile, state legislatures are producing a patchwork of social media, adult-content, app-store and AI companion rules. More than 45 states and Puerto Rico considered at least 300 child online-safety measures in 2025, with at least 20 states enacting laws. The Supreme Court’s 2025 decision upholding Texas’ age-verification requirement for pornography sites also strengthened the legal footing for requiring online services to distinguish minors from adults.
That creates a collision between child safety and anonymity.
“The state has a real interest in ensuring that young people don’t see services that are not intended for young people,” Horadan said. “However, grownups who want to use those services, they don’t want to be identified, and they don’t want to be identified for a good reason.”
Today’s online substitutes for identification are clumsy, he said. Services send six-digit codes, ask questions drawn from credit reports or require users to click pictures of fire hydrants. Applied in the physical world, the rituals would seem ridiculous.
[Related: U.S. Digital ID Readiness Report]
“Imagine going to check into your hotel room, and they say, ‘Here’s four addresses that maybe you lived at. Could you tell me which address you lived at, and then I’ll give you your hotel room key?’” Horadan said.
Digital driver’s licenses could change that model. Stored in a phone’s secure hardware and unlocked with a live biometric, a mobile ID can send a cryptographically signed assertion to a website. More importantly, the holder does not have to transmit the entire license.
“You could send all the information, or you could send just your birthday or a property about your age, such as over 21, over 25,” Horadan said.
That selective disclosure could allow a social network, adult website or AI companion to confirm that a user meets an age threshold without learning the person’s name, address or exact birthdate. Horadan called it a solution that can serve both regulators and adults who want to remain anonymous.
The infrastructure is beginning to arrive. Horadan said California has issued about 2 million digital driver’s licenses and New York about 1 million. He estimates roughly 5% of U.S. adults already have one and expects adoption could reach 50% within several years, creating a tipping point for online use.
The U.S. rollout remains fragmented, however. States issue credentials under their own rules, while some restrict which businesses may accept them. Horadan said that state-by-state system is slowing a technology that could otherwise become a common privacy-preserving answer to age mandates.
Age assurance will not end disputes over addictive design, unsafe recommendations or emotionally dependent chatbot relationships. It does, however, determine which protections a platform applies.
The industry is moving toward an internet in which companies may not need to know exactly who every user is. But under mounting legal pressure, they increasingly will need to know whether that user is a child.
What follows is a lightly edited transcript of an interview with Peter Horadan, CEO of identity verification company Vouched.
SPB: Peter, welcome to Security Point Break. Please introduce yourself and tell us a little about Vouched.
Peter Horadan: Thank you. It’s great to be here. I’m Peter Horadan, CEO of Vouched.
We focus on identifying people remotely online so they can access life’s most essential services, such as banking or health care, where it is essential to verify identity. We make it as easy and secure to do remotely as it is in person.
SPB: I’ve been following Vouched’s work, and I want to cover some of the company’s technology. But first, I’d like to take a broader look at identity.
Age verification has been generating a lot of headlines, particularly as social media companies face pressure to determine whether users are minors. What is happening with digital age verification at the 10,000-foot level?
Peter Horadan: The world of identity is about to undergo some profound changes that are going to affect all of us, whether you’re a security specialist or not.
Any workflow or process starts with identity: knowing who you are dealing with. Until now, the only real tool we’ve had for that is the physical ID sitting in your wallet — the driver’s license or passport you pull out and show someone to identify yourself.
That has created an interesting world. When you identify yourself in person, whether you are getting on an airplane, checking into a hotel room or buying a beer, you show your ID and don’t think anything of it.
Online, it is very rare to show an ID. It happens mostly in regulated contexts. Instead, we have invented all these proxies for verifying identity, such as sending six digits to your cellphone or showing you information from your credit report: Which of these addresses did you previously live at?
We even use proof-of-personhood tests such as showing someone pictures and asking them to circle the fire hydrants.
If you did any of that in person, it would seem absurd. Imagine checking into a hotel and being shown four addresses and asked which one you lived at before they give you a room key. Or imagine being handed nine pictures and being told to circle the fire hydrants before receiving your key.
These online proxies are very poor substitutes for looking at a person’s ID. That is about to change.
One of the big changes coming to identity is the digital ID. You may have seen a sign at an airport TSA checkpoint saying digital driver’s licenses are accepted. Most people haven’t encountered that yet, but it is coming.
California has already issued 2 million digital driver’s licenses, and New York state has issued 1 million. We estimate that about 5% of U.S. adults already have a digital driver’s license. We think that could reach about 50% within the next couple of years, which would be a tipping point.
How does that affect age verification?
A digital ID lives on your phone, inside its secure enclave. It is not a regular file. To use it, you need to provide a live biometric on your phone, such as your face or fingerprint.
The technology is native to the browser, so it will be easy to use online. You might be visiting a retailer or social media platform that needs to verify your age. The site could ask you to share your digital ID.
Your phone would come online and ask whether you want to share your ID with that site. You would provide your fingerprint, facial scan or another biometric. A secure exchange would then take place between the phone and browser, with a signed attestation going back to the site.
What is particularly interesting for age verification is that you do not have to share your entire ID.
When you show someone a physical ID today, you hand over the whole thing. That person can read all the information on it. With a digital ID, you can selectively choose what you share.
You could share just your name or the state where you live. You could share all the information, your birthday or simply a property related to your age, such as whether you are over 21 or over 25.
SPB: Social media companies are facing lawsuits and proposed laws tied to younger users accessing their platforms. Where do you see this going? Will everyone need to verify their age to use Facebook or other social platforms?
Peter Horadan: It is an interesting conflict.
The state has a legitimate interest in ensuring that young people do not access services that are not intended for them. Laws already apply that principle in the physical world. There are establishments young people cannot enter, and there are good reasons for that.
However, adults who want to use those services may not want to be identified, and they may have good reasons for wanting to remain anonymous.
That is true even with social media. We do not have to be talking only about services specifically intended for adults. Not everyone using a social media site wants to be identified.
A significant group of people believes debate and speech would be chilled if everyone using social media had to disclose their identity.
Social media platforms take a range of approaches. Some require a specific identity. LinkedIn is a good example. It strongly encourages you to use your real identity. On many other sites, however, people use usernames that have nothing to do with their real names and remain more or less anonymous.
SPB: What you are describing sounds like selective disclosure or a zero-knowledge proof: the ability to prove something about yourself, such as your age, without revealing where you live or other unnecessary information. Is that where we are going?
Peter Horadan: Yes. That is part of why we are so excited about this.
It is a solution that meets the needs of both groups. It meets the state’s need to prevent underage people from accessing material or services intended for people above a certain age.
At the same time, it allows adults who want to remain private to prove their age without identifying themselves. It is a very strong solution for both groups.
SPB: The United States is approaching digital identity state by state, while the European Union is rolling out a more unified digital identity wallet. How do those approaches differ, and what challenges does the U.S. model create?
Peter Horadan: In the United States, it is state by state and territory by territory.
Seven states are already issuing digital IDs, and 30 have announced plans to issue them. We do not yet know what the remaining states will do.
Each state is making its own rules. States are also producing their own apps. If you live in Louisiana and want a Louisiana digital ID, you install the Louisiana app on your phone.
Each state may also have its own regulations governing who is allowed to view those IDs.
Many of us look at that and say, “You don’t need a license to look at a physical ID. Why should you need a license to look at a digital ID?”
Those restrictions are slowing the rollout of something that could provide significant benefits.
The European Union has handled it differently. The EU has said all 27 member states will support digital identity wallets. They are supporting a common format.
Other countries in Europe are moving in the same direction. The United Kingdom has also announced plans for its own digital ID. We are beginning to see this happen around the world.
SPB: Are we approaching a critical mass or inflection point at which digital IDs become something everyone has to deal with, either for convenience or out of necessity?
Peter Horadan: First, there needs to be education.
When many people hear “digital ID,” they think, “I don’t want to be tracked. I don’t want the system phoning home to the state every time I show my ID at a bar.”
The good news is that, under the way these systems are being implemented, there is no phone-home mechanism. The W3C standard and other digital ID standards do not include one.
We need to help consumers understand that digital IDs can provide significant benefits.
One benefit is protection against deepfakes. Deepfake fraud is already approaching billions of dollars. A convincing version of a real person can call someone and persuade that person to take a fraudulent action.
When you are concerned about a deepfake, you could simply say, “I’d like to see your ID.”
You send a request, and a deepfake cannot produce a valid digital ID. The credential has to be created and signed by the state, and the person has to provide a live biometric.
Digital IDs can also address the age-verification problem we have been discussing. You can prove your age while remaining anonymous.
There are many other potential benefits, including reducing retail fraud.
Fraud is a major issue for e-commerce vendors. When a merchant is concerned about an order, it could ask the customer to provide an ID.
If that happened in a physical store, nobody would think twice. The person would pull out an ID, the merchant would compare it with the credit card, and the customer would be on the way. The same thing will become possible digitally.
There are going to be many benefits, but we have to educate people. Adoption has been slower than many of us would like because the industry is still working through these concerns.
SPB: Where does MCP-I provide the most value in terms of fraud prevention, privacy and audit trails? Who is most likely to adopt it?
Peter Horadan: Identity is key to preventing fraud in the enterprise.
When we talk to CISOs, we tell them that they may not realize their employees have already given usernames and passwords to software agents. They are allowing those agents into corporate systems where they can access sensitive company information.
Organizations need to put a stop to that.
Consider a salesperson who wants to become more effective. The salesperson asks an AI, “What should my next move be?”
The AI responds, “Let me into your sales management system. I can review your accounts and make recommendations.”
The salesperson gives the agent a username and password. Now a third party is inside the company’s sales data. It has the prospect list and knows who the company sells to.
Even when it is a reputable AI vendor, that information could become subject to a subpoena. OpenAI was famously subpoenaed in litigation involving The New York Times, and user chats unrelated to that dispute were swept into the discovery debate.
That is an intolerable situation.
CISOs need to ensure employees understand that they should not be using external agents on internal systems without authorization. Organizations also need identity systems that can identify and block unauthorized agents as they attempt to enter.
There are several ways to do that. We have a product that addresses it, and other companies do as well. But every CISO needs to ask: Who is using agents on our internal data right now?
SPB: When something goes wrong, where does the liability lie?
Peter Horadan: Are you asking about age verification or agents?
SPB: Both. Whether we are talking about age checks or AI agents, where does accountability sit when something goes sideways?
OAuth, passkeys, mobile ID wallets and verifiable credentials are not foolproof. When you examine the chain of custody and try to determine what failed, how do you establish accountability?
Peter Horadan: With Know That AI, we are building a community site where every agent has a self-assigned identity and a cryptographic credential. The agent can prove that it owns that identity.
The community can then report on the agent’s behavior.
Accountability is tied broadly to the reputation that the agent creates through its own actions.
SPB: There are many competing standards being introduced by payment companies, card networks and technology vendors. What should we expect over the next several years as those standards compete and begin to shake out?
Peter Horadan: There are a lot of standards, and they all have slightly different footprints.
Payment companies and card networks, for example, have introduced standards focused on how an agent can make a payment. But there is much more to the full life cycle of the work an agent may perform.
Consider an airline. Can an agent see Peter’s itinerary? How do you express that permission?
Payment standards do not address that.
With MCP-I, we have tried to cover the entire life cycle of the work people perform. But you are correct: A lot of standards have been proposed. It seems as though every other day another company announces how it believes this should be done.
There is going to be a shakeout, and I am not sure exactly how it will be resolved.
We need standards bodies. I am very excited about the work the FIDO Alliance and W3C are doing. NIST is also looking at this.
We need standards bodies to say, “These are the approaches we endorse.” Then, within a few years, the industry will settle on a standard approach.
I like to say there is a new chapter in the CISO playbook.
The playbook already has chapters saying you need a firewall, a password-rotation policy and security training. There is a well-established framework for how CISOs should do their jobs.
We have just added a new chapter called “How to Deal With Agents,” and that chapter is almost entirely blank.
We are all going to fill it out together as an industry.
SPB: Peter, thank you for your time. It has been a pleasure learning more about Vouched and getting a glimpse of how the identity market is developing.
Peter Horadan: It has been a pleasure. Thanks so much.
