A Dozen Threats, One Destination

Cyberbullying. Child protection. Fraud. Terrorism. CSAM. In the past year, at least a dozen governments have passed or proposed laws that name a different digital threat — and converge on the same response: identity-verification or data-collection infrastructure that extends well beyond the vulnerable population invoked to justify it. The mechanism is sharpest in Turkey. After a school shooting, parliament banned social media for users under 15. Then Justice Minister Akın Gürlek announced a forthcoming regulation requiring all citizens to verify their identity through the e-government portal to access social platforms ^[1].

We are living in a period where some digital sharing applications are corrupting our children's minds and social media platforms have, to put it bluntly, become cesspools. — Recep Tayyip Erdoğan

A law that began as protecting children had, in a single step, become universal identity verification. The opposition CHP said the laws prioritized state surveillance over individual rights ^[1]. The same pivot appears under different labels elsewhere, though the machinery varies. China's draft cyberbullying law, released July 29, mandates real-name verification for all users and requires platforms to report cases involving minors to authorities ^[2].

This approach with Chinese experience will enrich global digital governance rules and advance the vision of building a community with a shared future in cyberspace. — Wang Zhiqin

South Korea now requires real-time facial recognition for every mobile SIM activation, framed as combating voice phishing ^[3].

By comparing the photo on an identification card with the holder’s actual face on a real-time basis, we can fully prevent the activation of phones registered under a false name using stolen or fabricated IDs. — Ministry of Science and ICT

France's under-15 social media ban, signed in July, requires platforms to integrate government-approved age-verification tools ^[4].

France is leading the way in Europe in protecting our children and our teenagers. — Emmanuel Macron

India's Supreme Court has proposed using Aadhaar, the national biometric ID system, for age verification — bridging child safety directly to the country's existing digital identity infrastructure ^[5]. California's Digital Age Assurance Act requires every operating system to collect users' dates of birth and share them with app developers through a real-time API ^[6]. Other laws expand state access to data or channel users onto state-controlled platforms rather than building identity checks. Kenya's Cybercrimes Amendment Act, defended as protecting "youth from online terror and psychological harm," grants the government authority to block websites and requires service providers to share user data ^[7].

We are talking about the meaning of religious extremism. It brings us harm, just like what we experienced in Shakahola. We have to stop it. — William Ruto

Russia blocked WhatsApp and throttled Telegram, citing "criminal and terrorist purposes," while directing citizens onto Max, a state-owned messenger ^[8].

As before, Russian law is not being observed, personal data is not protected, and there are no effective measures to counter fraud and the use of the messaging app for criminal and terrorist purposes. — Roskomnadzor

The EU's Chat Control 1.0 regulation authorizes mass scanning of private messages on unencrypted platforms to detect CSAM ^[9]. The UK announced a national digital ID scheme in May, mandating digital IDs for right-to-work checks ^[10]. Cambodia's Law on Combating Online Scams extends the safety frame to crime enforcement ^[11]. Australia's under-16 social media ban imposes fines up to $49.5 million even as teens routinely bypass its age-verification system ^[12]. The variety of threats and mechanisms might suggest governments are responding to genuinely different problems with genuinely different tools. But the direction of travel is uniform: each law expands the state's ability to identify, track, or channel users online, and each one reaches past the vulnerable population it names. The question is whether this convergence was necessary. The US Senate's unanimous passage of COPPA 2.0 in March suggests it was not ^[13]. That law uses the same "protect children" rationale but cuts the opposite way.

This bill expands the current law protecting our kids online to ensure companies cannot collect personal information from anyone under the age of 17. — Chuck Schumer

It restricts what platforms can take from children rather than building infrastructure to identify every user. The same rationale, the opposite output. COPPA 2.0 does not disprove the sincerity of the threats other governments cite. But it does establish that "digital safety" can lead toward privacy protection as easily as toward surveillance. The dozen other laws all took the second path. The same rationale produced the opposite output. That is what makes the global convergence a choice.