Statement | JRF Recommendations on the Ministry of Health and Welfare's Draft Amendments to the Protection of Children and Youths Welfare and Rights Act: Focusing on Age Verification and Restricted Access under Article 59

Freedom of speech, freedom of access to information, and the right to privacy are the foundations of a democratic society; at the same time, we must also consider the sound physical and mental development of children and youths as they grow up in the online world. Pursuant to Article 3 of the Convention on the Rights of the Child, the best interests of the child shall be a primary consideration in all actions concerning children undertaken by the State. Article 13 further guarantees the right of the child to freedom of expression (including the freedom to seek, receive and impart information and ideas of all kinds), and Article 16 protects the right to privacy. In light of this understanding, the Foundation considers that the "age identification mechanisms" proposed in Paragraphs 1 and 2 of Article 59 of the draft amendments to the Protection of Children and Youths Welfare and Rights Act, as well as the "restricted access measures" authorized under Paragraph 3 (for the full draft text, see the end of this article), raise significant concerns as follows:

I. Paragraphs 1 and 2 of Article 59: The Systematic Risk of Universal Age Verification; The Ministry of Health and Welfare Should Explicitly Stipulate Privacy by Design, Prohibitions on Secondary Use, and Data Minimization in the Draft

1. Mandatory age verification will no longer regulate platform operators alone, but will impact the fundamental rights of all users

According to the technical draft Age Verification Architecture[1] published by the Internet Engineering Task Force (IETF) in 2026, mandatory age verification will "no longer regulate only platform operators, but will regulate all users, requiring all users to pass verification before they can use application services"; this design "harms the privacy and freedom of expression of all internet users (not only children, and particularly including children themselves)."

2. Age identification mechanisms easily lead to internet real-name systems and the risks of excessive data collection and data breaches

Common age identification mechanisms in Taiwan include self-declaration, AI facial age estimation (which involves the collection of biometric data and carries the risk of systemic misclassification against specific racial, gender, and age-boundary groups[2]), uploading government identity documents, credit card verification, and mobile phone number real-name binding. The latter three are particularly sensitive in Taiwan—mobile phone numbers are required by law to be registered under real names, essentially leading to an internet real-name system and excluding digitally disadvantaged populations without phone numbers. Although the pathways of these mechanisms differ, their common feature is that they all require users to disclose their identity; even with Zero-Knowledge Proof (ZKP) solutions, doubts remain as to whether identity leakage can be completely prevented in actual operation[3].

J.Y. Interpretation No. 603 has explicitly stated that an individual's autonomous control over their own personal data constitutes the core of informational privacy and is protected under Article 22 of the Constitution of the Republic of China. Conversely, common age verification methods—such as uploading identity documents or facial images for verification—collect not only dates of birth, but also highly sensitive data including names, national identification numbers, registered household addresses, and facial biometrics. If the draft fails to explicitly stipulate data minimization, a prohibition on secondary use, and retention periods at the legislative level, it can hardly be said to meet the aforementioned constitutional standards.

3. International implementation experience: Australia faltered on day one, and backlash in the UK continues unabated

Australia's Online Safety Amendment (Social Media Minimum Age) Act entered into force in December 2025, yet widespread circumvention occurred on its very first day—children borrowed family members' faces, used VPNs, and there were even instances where an 11-year-old was misidentified as 18, and a 12-year-old girl passed verification simply by wearing makeup[4]. Subsequently, the civil society organization Digital Freedom Project, together with two teenagers, filed a constitutional lawsuit in the High Court of Australia in November of the same year, arguing that the act violated the implied freedom of political communication under the Australian Constitution; Reddit followed suit in December[5], and both cases are currently being heard jointly by the High Court. Meanwhile, the UK's Online Safety Act "Children's Code" has also triggered fierce opposition, with a petition for its repeal surpassing 550,000 signatures within days[6]. Digital rights organizations such as the EFF and EDRi have explicitly pointed out that such measures instead introduce surveillance risks to the speech and privacy of everyone (including children themselves)[7].

4. The Foundation's call: The Ministry of Health and Welfare should explicitly stipulate "privacy by design, prohibitions on secondary use, and the principle of data minimization" in the amended provisions

The government must confront the structural slippery slope from child protection to excessive data collection, and even to a de facto internet real-name system. Under the principle of statutory reservation, restrictions on people's rights or the regulation of important matters by the State must have a legal basis; further, under the framework of tiered statutory reservation, the higher the importance of a matter, the stricter the regulatory density requirement for the law itself, and blanket authorizations cannot serve as a substitute. The doctrine of essentiality also clearly points out that even if the legislature has authorized the competent authority to enact guidelines, all important substantive content must still be explicitly stipulated in the enabling statute, and authorization clauses must not be empty or hollow, thereby hollowing out the intent of statutory reservation.

However, the latter part of Paragraph 2 of Article 59 of the draft published by the Ministry of Health and Welfare delegates all standards, methods, exceptions, practical guidelines, and technical requirements for age identification entirely to the communications regulatory authority in consultation with the digital affairs regulatory authority, without clearly setting forth any substantive regulatory content in the enabling statute. Given that age verification mechanisms implicate multiple fundamental rights dimensions, such as child protection, informational privacy, informational self-determination, and freedom of expression, their importance is self-evident. The Foundation urges that the Ministry's draft should explicitly stipulate at the legislative level that privacy by design be implemented throughout the entire lifecycle of verification data, and impose strict regulations on core matters such as the prohibition of secondary use and the data minimization principle, so as to comply with the requirements of tiered statutory reservation; otherwise, it risks constituting a blanket authorization.

II. Paragraph 3 of Article 59: The Ministry of Health and Welfare Should Delete the Provision Authorizing Competent Authorities to Directly Block Websites

1. Website blocking should not leap from a last resort to the front line of speech control

The latter part of Paragraph 3 of Article 59 of the draft amendments stipulates that the competent authority "may, when necessary, notify internet access service providers to take restricted access measures." This provision reveals not merely the technical details of an individual regulation, but the structural dilemma of our current internet content governance: in the absence of comprehensive platform liability regulations, the government has chosen access blocking as an alternative content management tool, causing website blocking to leap directly from theoretically ultimate punitive measures to the frontline tool for handling suspected illegal content. In a reasonable governance framework, website blocking (a common method in Taiwan being DNS RPZ) ought to be a measure of last resort to be invoked only after exhausting all normal legal channels; however, the design logic of this draft is the exact opposite—it unilaterally creates a legal basis to block entire platforms without requiring prior or subsequent review by a third party, authorizing administrative authorities to independently determine the "necessity of prompt action" and block entire websites or platforms.

2. The website blocking procedure favored by the government shockingly lacks due process of supervision and remedy

The absence of due process highlights the danger of this legislative model. "When necessary" serves as a threshold for initiation, yet lacks concrete criteria for judgment, substantially granting administrative authorities an almost boundless discretionary space. Existing regulations neither require notifying the parties concerned, nor provide an objection procedure for interested parties, nor involve independent third-party prior or subsequent review, nor require the competent authority to publish a list of blocked websites for public inspection—all these institutional omissions threaten to make this draft a severe breach in Taiwan's internet freedom.

3. Countdown to 2 years! The movement to legalize website blocking is underway

According to Point 7, Explanation (4) of the Reference Procedures for Handling the Discontinuation of Resolution for Illegal Websites Using the DNS RPZ Self-Regulatory Mechanism[8] formulated by the Ministry of Digital Affairs in 2025: "The competent authority shall, within the time limit prescribed in Point 12, Paragraph 4 (i.e., within 2 years), refer to the provisions of Article 42 of the Fraud Crime Hazard Prevention Act, and stipulate in the respective laws that the competent authority may order IASPs to cease resolution or restrict access to illegal websites, so as to facilitate practical implementation."

The legal validity of these Reference Procedures is likely shaky under the test of statutory reservation; nonetheless, driven by practical operations based on administrative unity, the two-year countdown has begun, and a wave of large-scale legislative campaigns is unfolding: in December 2025, the Executive Yuan drafted amendments adding Article 4-1 to the National Security Act and Article 64-1 to the Social Order Maintenance Act[9], stipulating that when there is a necessity for prompt action, the Ministry of the Interior may directly order internet access service providers to cease resolution or restrict access. Paragraph 3 of Article 59 of this draft is a concrete manifestation of this legislative wave.

To take a step back, even setting aside the numerous due process flaws of Article 42 of the Fraud Crime Hazard Prevention Act itself—a provision that enabled the government to directly block 49,211 websites in 2025, accounting for approximately 64% of the year's total RPZ blocking records (76,930)[10]—this draft actually takes this inherently unreasonable model as a template and replicates it in the field of child protection, further exposing legislative rashness.

4. The Foundation's call: Website blocking should be strictly restricted as a last resort and implemented only after due process is fully established

The Ministry of Health and Welfare should delete the provision in the latter part of Paragraph 3 of Article 59 of this draft: "may, when necessary, notify internet access service providers to take restricted access measures." Before our country has established platform liability regulations centered on people's rights that incorporate platform accountability, due process guarantees, and effective remedies, any authorization empowering administrative authorities to directly block entire website platforms will expose freedom of expression to unchecked administrative discretion. Website blocking should return to its role as a measure of last resort rather than serving as a shortcut bypassing platform accountability mechanisms.

III. Conclusion

The Foundation affirms the Ministry of Health and Welfare's efforts to confront the impact of the online environment on the physical and mental development of children and youths, a concern that is itself worthy of appreciation. However, mitigating online harm to children and youths is fundamentally an incremental, multi-stakeholder collaborative endeavor, and can by no means be accomplished overnight through age verification or website-blocking mechanisms. A more resilient form of governance would deploy diverse, bounded mechanisms compliant with privacy-by-design principles across different layers of the internet architecture, ensuring that no single actor centrally holds information on all users. More importantly, the best interests of children and youths should not come at the cost of sacrificing everyone's fundamental rights: age verification lacking data minimization safeguards will lead to mass surveillance; restricted access systems lacking due process will bypass judicial review and erode universal freedom of speech—what both construct is not a protective net for children, but a failing system that erodes democratic freedom.

Draft Provisions

Article 59 of the Protection of Children and Youths Welfare and Rights Act (Draft Amendment)

1. Paragraph 1: To prevent children and youths from accessing internet content harmful to their physical and mental development, protect their personal data and privacy rights, and ensure that children and youths can grow up safely in a digital environment, the central communications regulatory authority shall convene relevant target-business competent authorities and commission civil society organizations to establish a content protection agency to handle the following matters:
   
   1. Observation of internet usage behavior by children and youths.
   2. Establishment and implementation of grievance mechanisms.
   3. Promotion and review of content protection mechanisms.
   4. Education on internet safety and advocacy for online privacy protection among children and youths.
   5. Establishment and promotion of age-appropriate identification and online privacy protection measures for children and youths.
   6. Promotion of self-regulatory mechanisms established by internet platform providers, internet application service providers, and internet content providers.
   7. Establishment and promotion of other protection mechanisms.
      
2. Paragraph 2: The providers referred to in Subparagraph 6 of the preceding paragraph shall, on their own or in accordance with self-regulatory codes established by relevant trade associations, unions, or the internet content protection agency, adopt age-appropriate identification or feasible necessary measures. Standards, methods, exceptions, practical guidelines, and technical requirements for age identification shall be prescribed by the communications regulatory authority in consultation with the digital affairs regulatory authority.
   
3. Paragraph 3: Where the internet content of the providers referred to in Subparagraph 5 of Paragraph 1 is harmful to the physical and mental development of children and youths, the competent authority or target-business competent authority shall notify them to first remove it or restrict browsing by children and youths. When necessary, it may notify internet access service providers to take restricted access measures.
   
4. Paragraph 4: Internet platform providers referred to in the preceding three paragraphs mean those who provide various internet platform services after connecting to the internet, including providing storage space on the internet, or utilizing the internet to build websites to provide information, value-added services, and web page linking services and other functions.
   

---

Footnotes

1. IETF, Age Verification Architecture, Internet-Draft draft-ietf-aveco-architecture-00, March 2026, §2–§3.
2. Clapés et al., "From Apparent to Real Age: Gender, Age, Ethnic, Makeup, and Expression Bias Analysis in Real Age Estimation," Royal Society Open Science (2018); Harvard Journal of Law & Technology, "Why Racial Bias is Prevalent in Facial Recognition Technology" (2020).
3. Over the past two years, massive identity verification data breaches have occurred successively at AU10TIX (2024), Tea App (2025), and Discord's outsourced verification vendor 5CA (2025), cumulatively affecting hundreds of thousands of users. This demonstrates that such incidents are not isolated cases, but rather structural risks endogenous to centralized verification architectures. See: 404 Media, "ID Verification Service for TikTok, Uber, X Exposed Driver Licenses," June 2024; Electronic Frontier Foundation, "Hack of Age Verification Company Shows Privacy Danger of Social Media Laws," June 2024; 404 Media, "Women Dating Safety App 'Tea' Breached, Users' IDs Posted to 4chan," July 2025; TechCrunch, "Tea app disables DMs after second data breach exposed over a million private messages," July 29, 2025; TechCrunch, "Discord suffers data breach impacting at least 70,000 users," October 9, 2025; SecurityWeek, "Customer Service Firm 5CA Denies Responsibility for Discord Data Breach," October 2025.
4. The Guardian / News.com.au, "Australian children dodging social media age check on day one," December 10, 2025; Fortune, "Most Australian teens admit the social media ban isn't working as they try to sidestep age verification blocks with face masks and their parents' IDs," April 25, 2026.
5. Digital Freedom Project & Ors v. Commonwealth of Australia, High Court of Australia, filed November 2025; Reddit Inc. v. Commonwealth of Australia, filed December 2025.
6. UK Online Safety Act 2023, Part 3; Ofcom, "Protection of Children Codes of Practice," effective July 25, 2025; UK Parliament Petition: "Repeal the Online Safety Act," debated 15 December 2025; Ars Technica, "Death Stranding photo mode bypasses Discord and Reddit face-scan," July 25, 2025.
7. Electronic Frontier Foundation, "Age Verification Mandates Threaten Everyone's Speech and Privacy," 2025; European Digital Rights (EDRi), Joint Open Letter on Age Verification, signed by 63 civil society organisations and experts, 2024–2025.
8. Ministry of Digital Affairs, Reference Procedures for Handling the Discontinuation of Resolution for Illegal Websites Using the DNS RPZ Self-Regulatory Mechanism (2025), Point 7, Explanation (4).
9. Draft amendments announced by the Executive Yuan in December 2025, which respectively add Article 4-1 to the National Security Act and Article 64-1 to the Social Order Maintenance Act, stipulating that when there is a necessity for prompt action, the Ministry of the Interior may directly order internet access service providers to cease resolution or restrict access.
10. TWNIC, 2025 RPZ Transparency Report (published in 2026). The statistical scope covers RPZ blocking records from January to December 2025. Link: https://rpz.twnic.tw/.