Shoshana Weissmann, digital director and fellow at the R Street Institute think tank, said the age-verification rules could force companies to either collect more personal data, such as government-issued identification, or biometric data, including by scanning users’ faces. 

“Age-verification technology is really invasive in its current form,” she said.

While users may be able to use VPNs to avoid getting shut out by sites, companies could still be on the hook for letting them evade the rules, Weissmann and Jain said.