The GUARD Act Will Not Regulate AI — It Will Regulate You

The GUARD Act Will Not Regulate AI — It Will Regulate You Every time the government wants to watch what you do online, they use the same framing: protecting children. The GUARD Act is the latest iteration. In April 2026, the EFF published a devastating analysis of the GUARD Act, legislation sold as AI safety that would actually require identity verification for ordinary internet use. After the initial backlash, lawmakers narrowed the bill in May 2026 to focus on "AI companions," but the EFF's follow-up analysis concluded that serious privacy and speech problems remain. What Is In The Bill Sen. Josh Hawley (R-MO) introduced S.3062, the "Guidelines for User Age-verification and Responsible Dialogue Act" (GUARD Act), in October 2025 with Sen. Richard Blumenthal (D-CT). The bill now has 19 cosponsors spanning both parties. It was unanimously approved by the Senate Judiciary Committee on April 30, 2026, and reported to the full Senate on May 11 with an amendment narrowing its scope. A companion House bill was introduced by Reps. Blake Moore (R-UT) and Valerie Foushee (D-NC). Mandatory Identity Verification: Users of AI companions must verify adult status through government ID, financial records, biometrics, or verified app store accounts Self-attestation (checking a box) is explicitly rejected as insufficient Periodic re-verification is required — this is not a one-time check Companies face fines of up to $250,000 per violation High-Risk AI System Definitions: The original bill defined "AI chatbot" as any system generating responses not fully pre-written — sweeping in search engines, customer service bots, and homework helpers The amended version targets "AI companions" that simulate emotional or interpersonal interaction But the line is blurry: a customer service bot saying "I'm sorry you're having this problem" could qualify as engaging in "emotional interaction" Companies facing existential liability will over-comply, restricting access far beyond the bill's stated targets Activity Logging: Platforms must log all AI interactions for minimum 3 years Accessible to law enforcement without warrant under national security carveout Your chatbot conversations, search queries, and AI-generated content all become investigable without judicial oversight Prohibited Anonymous Use: VPNs, Tor, and anonymization tools effectively prohibited for any platform using AI Financial penalties for platforms allowing unverified users What The EFF Actually Said The EFF's April 27 analysis called the GUARD Act what it is: a universal age-gating mandate that "trades away privacy, access, and useful technology in exchange for a blunt system that misses the mark." Their key arguments: The bill's broad definitions would require age gates for search engines using AI, meaning a high school student could be barred from asking a homework tool about algebra Mandatory ID verification creates databases of sensitive identity information that become "targets for breaches" — EFF pointed to multiple prior breaches of age verification providers The bill would push smaller developers out of the market entirely, as they cannot absorb compliance costs, leaving the largest companies more dominant "Anonymous or pseudonymous use of online tools becomes harder or impossible" Millions of Americans lack current government ID, and would be shut out of basic internet services When the bill was narrowed in May, the EFF followed up: the revised bill "still creates serious problems for privacy, online speech, and parental choice." The penalties actually increased from $100,000 to $250,000 per violation, creating perverse incentives to over-restrict access. The Fine Print on Law Enforcement Access The 3-year activity logging mandate contains a national security carveout that effectively grants law enforcement warrantless access to all recorded AI interactions. This means: Every conversation with ChatGPT, Claude, or any AI assistant is logged and potentially accessible Your search queries become part of a permanent, government-accessible record AI-generated content, therapy-bot conversations, and creative writing tools all feed the database The "national security" exception has no meaningful oversight mechanism This is the surveillance infrastructure that the bill's sponsors avoid mentioning in press releases. The logging mandate turns every AI platform into an informant. The International Pattern United Kingdom — Online Safety Act: Ofcom enforcement, age verification for adult content, "illegal content" duty of care. VPN blocking is under discussion. Australia — eSafety Commissioner: Content takedown powers, anti-trolling laws requiring platforms to disclose user identities. The eSafety Commissioner can force platforms to identify anonymous users. European Union — DSA + AI Act: Risk-based framework, transparency reporting, systemic risk assessments. Key difference: NO identity verification mandate. The EU approach regulates platforms, not users. India — IT Rules 2021: Traceability requirement that undermines encrypted messaging. Government can compel platforms to identify the "first originator" of any message. The pattern is identical across every jurisdiction: safety as justification, surveillance as implementation. The EU is the notable exception, proving that effective AI regulation does not require identity verification. Technical Feasibility Problems No existing identity verification system can be both universal and privacy-preserving. Here is why the technical premise of the bill is unsound: Government ID databases create single points of failure for mass surveillance and identity theft Companies storing identity documents and biometric data create new breach risks — age verification providers have already been hacked multiple times Biometric age estimation is notoriously inaccurate, especially for young people and people of color Millions of Americans do not possess current government-issued photo ID Victims of domestic violence and stalking have legitimate reasons to maintain online anonymity The system cannot distinguish between a teen and an adult engaging in protected anonymous speech Historical Parallels This pattern of expanding surveillance under the banner of safety has a well-documented history: PATRIOT Act (2001): Surveillance expansion sold as counterterrorism. Many provisions had nothing to do with terrorism and were used for ordinary criminal investigations. CALEA (1994): Required telecommunications companies to build wiretap capabilities into their networks, sold as public safety. Created infrastructure later used for mass surveillance. Communications Assistance for Law Enforcement Act (1990s): Pushed for backdoor communications access under the guise of helping law enforcement "keep up with technology." The GUARD Act follows the same playbook: take a legitimate concern, write the scope broadly, embed surveillance infrastructure, and dare anyone to vote against "safety." Why It Fails Mandatory identity verification does not stop harmful AI use: Resourceful actors use stolen credentials or foreign-registered accounts Journalists and activists in hostile environments cannot safely use real-name services Domestic abusers verify identities easily — the threat model is not addressed by the bill Bad actors will simply move to unregulated platforms outside US jurisdiction Alternatives That Would Actually Work The GUARD Act does not fund or require any of the following proven approaches: Independent AI auditing and red-teaming: Mandate third-party safety evaluations before deployment, not ID checks on users Model transparency and disclosure requirements: Require companies to publish safety evaluations, training data sources, and capability testing results Whistleblower protections for AI safety researchers: Current legal protections are inadequate. Researchers who identify risks at major labs need statutory protection from retaliation Open-source model evaluation frameworks: Fund public infrastructure for evaluating AI systems, so independent researchers can test models without corporate permission Data minimization requirements: Limit what data AI companies can collect, store, and process, rather than mandating MORE data collection in the name of verification None of these require you to upload a photo of your driver's license. None of them create a government-accessible database of your private AI interactions. What You Can Do The GUARD Act passed the Senate Judiciary Committee unanimously and awaits a full Senate vote. The companion House bill is also advancing. Contact your representatives and tell them to oppose mandatory online ID checks. Contact your representative: Use 5Calls to find your reps and call them. Support the opposition: EFF, ACLU, Fight for the Future Talking points for your call: "I oppose the GUARD Act because it creates mandatory identity verification infrastructure, not meaningful AI safety. It does not fund AI auditing, model transparency, or whistleblower protections. It creates warrantless law enforcement access to private AI interactions. I support targeted AI safety measures that do not destroy online anonymity." Nobody asked if you wanted to upload your government ID to use a search engine. They asked if you were against AI safety. The surveillance is in the fine print.