Global Age Verification Investigation: Brazil and the United Kingdom

Baroness Beeban Kidron founded 5Rights Foundation in 2018. She wrote the UK Age Appropriate Design Code, which became law in 2020. A June 2024 FARA filing confirmed that 5Rights directly lobbied California legislative and executive officials, developed letters and materials for elected officials, reviewed proposed amendments, and negotiated the language of California's AB 2273, which copied the UK code almost verbatim. 5Rights hired Nichole Rocha as Head of US Affairs. Rocha was formerly Chief Consultant to the California Assembly Privacy and Consumer Protection Committee, the very committee that considered the bill. FARA Filing DC Journal

Kidron co-vice-chaired the IEEE 2089.1 standard for online age verification. The Chair of the IEEE 2089.1 certification program is Iain Corby, who simultaneously serves as Executive Director of the AVPA (Age Verification Providers Association), the trade body for companies that profit from mandatory verification. Yoti, which Meta pays for Instagram age verification, is certified under this standard. The person who writes the legislation co-chairs the standard. The industry trade body chairs the certification. The companies that pay trade body dues sell compliance solutions for the legislation. IEEE 2089.1 ACCS Certification

5Rights then spent three years campaigning with Instituto Alana and Human Rights Watch to pass Brazil's Digital ECA. Kidron resigned from 5Rights' board on 28 July 2025, nine days before the Felca video that fast-tracked the Brazilian legislation she campaigned for. The former UK Information Commissioner, Elizabeth Denham, who oversaw the Age Appropriate Design Code's implementation at the ICO, joined 5Rights as a director in January 2022. Shoshana Zuboff, author of The Age of Surveillance Capitalism, sat on the board of the organization whose policy framework creates the market for surveillance companies. She resigned 30 June 2025. Companies House

Lei 15.211/2025, known as the Digital ECA, took effect on 17 March 2026. Article 12 explicitly covers "provedores de sistemas operacionais de terminais" (providers of terminal operating systems). Windows, macOS, iOS, Android, ChromeOS, SteamOS, and Linux distributions must implement age verification and provide age signals to applications via a secure API with privacy-by-design protections. Platforms must also implement their own verification independently, creating a layered architecture: OS verifies, app store verifies, each app verifies. Full Law Text

The impact on open-source software is visible. Linux distributions including Arch 32, Bazzite, CachyOS, and MidnightBSD have begun geoblocking Brazilian IP addresses because 95% of Linux distributions are maintained by volunteer communities without legal representation (CNPJ) in Brazil and cannot practically implement age verification. A protest distribution called "Ageless Linux" launched as an intentionally non-compliant distro. Proton VPN reported a 250% increase in Brazilian signups between 16 and 17 March 2026. Linuxiac Cybernews

The law contains privacy principles (LGPD references, data minimization, privacy by design) but no enforceable security requirements. No specific technical requirements exist for how verification data must be stored, encrypted, transmitted, or deleted. No mandatory data retention limits appear in the law. No independent security audits of verification providers are required. All technical specifics are deferred to ANPD regulation not finalized until August 2026, with enforcement beginning January 2027. NYU Stern called the absence of protections for end-to-end encrypted services "the statute's most significant weakness." NYU Stern

Meta produced a document listing biblical passages (Colossians 3:18, Timothy 2:12, Deuteronomy 22:28-29, Ephesians 5:22-23, Leviticus 20:13) that would allegedly be censored under PL 2630, the Fake News Bill. Three internal Meta sources confirmed this to Agencia Publica. The document was delivered on paper "to leave no traces." Coletivo Bereia, a Brazilian digital verification collective, classified the document's claims as false. No provision of PL 2630 would have censored Bible passages. Agencia Publica Coletivo Bereia

Camara Brasileira da Economia Digital (camara-e.net), whose members include Meta, Google, and TikTok, publicly claimed authorship after the document became public. The discrepancy is consistent with content laundering: Meta produces the material, the trade association claims authorship for distance. Deputy Eli Borges (PL-TO), then leader of the Evangelical Parliamentary Front, mobilized the entire caucus after receiving this document. PL 2630 was removed from the agenda on 2 May 2023 as a direct result. Nucleo

Kaliana Kalache, Meta's Director of Public Policy for the Legislative Branch, reportedly played the key coordinating role in securing Evangelical Caucus support. She was promoted to Director in early 2024, reportedly in recognition of her success in killing PL 2630. The Evangelical Caucus had oriented 95% of its members to vote against PL 2630, but did not take the same oppositional stance on PL 2628, the child protection bill. The implicit arrangement: the caucus supported the child protection bill after the duty of care provision was removed. Agencia Publica

Persona, an American company backed by Peter Thiel's Founders Fund ($150 million Series C, $200 million Series D), partnered with Serpro since September 2022 for biometric ID verification against Brazilian government databases. A February 2026 exposure revealed the company runs 269 distinct surveillance checks per user under internal codenames "Project SHADOW" and "Project LEGION." Checks include facial recognition against watchlists and politically exposed persons, "adverse media" screening across 14 categories including terrorism and espionage, built-in filing to FinCEN (US Treasury) and FINTRAC (Canada), and 3-year data retention of IP addresses, device fingerprints, government IDs, faces, and selfie analytics. Discord tested then dropped Persona after its front-end code was found on a US government-authorized endpoint. The Persona-Serpro partnership remains active. ANPD has not opened any investigation into Persona. CyberNews PR Newswire

AU10TIX Technologies B.V. is a subsidiary of ICTS International, established in 1982 by former Shin Bet (Israel's internal security agency) members. Its founder Ron Atzmon served in Shin Bet. Confirmed Unit 8200 veterans are on staff. Major clients include X, TikTok, Uber, PayPal, LinkedIn, Coinbase, and Google. In 2024, admin credentials compromised by malware in December 2022 appeared on a public Telegram channel and were still working when security researchers checked in June 2024: an 18-month-plus exposure of identity documents, names, dates of birth, and nationalities. Only Upwork switched providers after the breach. State of Surveillance Malwarebytes

Yoti (UK) is already partnered with Serpro and shares users' CPF numbers with Serpro to verify age. Serpro retains the CPF number for 5 years as a billing record. Yoti's revenue grew 62% in 2025 to GBP 29 million, reaching profitability. The Instagram partnership is a significant revenue driver. Yoti is certified under IEEE 2089.1, the standard Kidron co-vice-chaired. The money flows from the law Kidron wrote, through the standard she co-chairs, to the company certified under that standard, paid by the largest social media company in the world. Biometric Update

On 21 January 2026, the House of Lords voted 207 to 159 to pass Amendment 92 to the Children's Wellbeing and Schools Bill. The amendment, tabled by Lord Nash (Conservative venture capitalist, former Parliamentary Under Secretary of State for Schools), requires VPN providers to prevent anyone under 18 in the UK from using their services within 12 months. All VPN providers serving the UK market must implement "highly effective" age assurance for all users. Amendment 93 required "tamper-proof system software" on all smartphones and tablets that scans for CSAM. Lord Nash withdrew this amendment after discussions with ministers, but it remains a live proposal. Amendment 94A, a social media ban for under-16s, passed 261 to 150. Lords Division Amendment 92

The device scanning provision goes further than the system Apple abandoned. Apple planned to scan only images uploaded to iCloud. The UK amendment covers recording, transmitting by any means including livestreaming, and viewing: active real-time scanning of what a user sees on their device. Germany's 2024 CSAM scanning data showed a 48.3% false positive rate. Signal President Meredith Whittaker stated Signal "would absolutely, 100% walk" from the UK rather than implement scanning. WhatsApp head Will Cathcart threatened to pull the app. Signal

On 9 March 2026, the House of Commons rejected the VPN amendment (307 to 173) and the social media ban. But the government passed "amendments in lieu" granting the Secretary of State broad discretionary powers to restrict or ban children's access to social media, limit access to harmful features, age-restrict VPN use, and change the age of digital consent in the UK GDPR. Open Rights Group titled their response "MPs give ministers powers to restrict entire Internet." Their analysis warned this is potentially more dangerous than the original Nash amendments because it grants open-ended regulatory authority without requiring parliamentary debate for each restriction. The bill returned to the Lords on 25 March 2026. Open Rights Group

After the Online Safety Act age verification requirements took effect on 25 July 2025, UK VPN signups surged 1,400%. Proton VPN surpassed ChatGPT as the most downloaded free app on Apple's UK App Store. A petition demanding repeal of the Online Safety Act gathered over 550,000 signatures. France's Digital Affairs Minister declared "VPNs are next on my list." Michigan proposed ISP-level blocking of VPNs and proxy servers, with fines up to $500,000 for non-compliant ISPs. CyberInsider TechRadar

UNICEF hosts the Global Partnership to End Violence Against Children and its Fund, which has raised over $83 million since 2016. UNICEF is not a partner. It is the institutional host. The UNICEF Executive Director chairs the board by design. The Safe Online window holds a $100 million portfolio across 106 projects. The Tech Coalition (Google, Meta, Microsoft) contributed $2.5 million through a joint research fund. UNICEF administers all of these as hosted trust funds. End Violence Fund

UNICEF Brazil explicitly called for "urgent approval" of PL 2628/2022. UNICEF runs a joint program with Itau Social, the social arm of the banking family that controls Instituto Alana, the NGO that submitted technical notes on the same bill. Ana Lucia Villela sits on the Itau Social Guidance Council. The same organization that lobbied for the law is embedded with the banking dynasty that funded the advocacy coalition for the law. UNICEF Brazil

UNICEF's own December 2025 policy note states that "age estimation measures using biometric data pose an unacceptable risk and should not be used." The same organization that lobbied for PL 2628 warns against the verification methods the law requires. UNICEF's D-CRIA Toolbox is embedded in WeProtect's 2025 Global Threat Assessment as the recommended compliance framework, while UNICEF's Director of Child Protection (Sheema Sen Gupta) sits on WeProtect's board. The organization on the policy board is the same organization whose tool is mandated. UNICEF Policy Note

The investigation reveals a consistent architecture across jurisdictions. First, one person (Baroness Kidron) and her foundation write the policy framework, the legislation, and co-chair the technical standard. The AVPA Executive Director chairs the certification program. AVPA members sell compliance solutions. The organization that defines "compliant" is the same network lobbying to make compliance mandatory. Second, UNICEF hosts the fund ($83 million+), chairs the partnership board, administers the money, provides the compliance framework, and lobbies for national implementation, while its own policy says biometric age estimation poses "an unacceptable risk."

Third, national advocacy coalitions, funded by the same philanthropic networks (Omidyar, Oak, Ford, Open Society) and domestic banking dynasties (Itau/Setubal in Brazil), translate international frameworks into national legislation. Fourth, big tech companies publicly "oppose" the legislation while privately shaping it through ghost-authored amendments, revolving-door lobbyists, manufactured disinformation, and compromised decision-makers. Fifth, the legislation creates a mandatory market for private identity verification companies backed by surveillance-capital investors or founded by intelligence veterans.

Sixth, the verification infrastructure funnels through government data brokers (Serpro in Brazil) that retain query logs, have documented intelligence agency access, and sit on foreign cloud infrastructure subject to the CLOUD Act. Seventh, financial institutions and banking dynasties provide the capital layer connecting surveillance, regulation, and implementation. Eighth, no transparency mechanism captures any of these flows. Brazil has no lobbying law. Conselho Digital publishes no financial statements. Serpro's Datavalid operates without full LGPD legal basis. The TCU case challenging Datavalid has been pending for six years. The IEEE 2089.1 working group membership list is restricted. The result is a surveillance infrastructure built under the banner of child protection, shaped by overlapping networks, and accountable to nobody.

Every claim in this investigation can be independently verified using public records. The commands below retrieve primary source documents directly. No trust required.