Show your face
Start with the win, because it is real and the privacy world is right to claim it.
For three years the European Union pursued a regulation the internet came to call Chat Control: a proposal to make messaging providers scan the contents of private communications for abuse material. At its most aggressive it demanded client-side scanning — software on your own device, inspecting your messages before they were encrypted. And on the question that mattered most, the encryption side won. In its November 2025 negotiating position the Council eliminated forced detection and added protections for encrypted communications; by mid-June 2026, internal documents show, the three institutions had provisionally agreed to exclude end-to-end-encrypted content from the regulation's scope entirely. The fifth and final scheduled trilogue convened June 29 to settle what was left. Mandatory scanning of your encrypted messages is, for now, off the table.
It came off the table because of a fact that cryptographers repeated until it landed. Carmela Troncoso, who directs the Max Planck Institute for Security and Privacy, put it plainly in November: "Once content is accessible to a party other than the sender or recipient, the protection provided by encryption disappears." There is no scan that preserves the encryption; there is only a door cut into the device, and a door for the scanner is a door for everyone. More than eight hundred scientists signed an open letter calling population-scale detection "unsuitable." Signal's president, Meredith Whittaker, said the company would leave the EU before building it: "If we were given a choice between building a surveillance machine into Signal or leaving the market, we would leave the market." Apple had already abandoned its own scanning system in 2022, warning it "would create new threat vectors." The architecture said no, and a continent — after three years — listened.
That is the war the privacy movement knew how to fight. It fought it through the Apple-FBI standoff, the EARN IT Act, the UK Online Safety Act's spy clause, and five EU trilogues, and at the level of architecture it has largely won. Encryption is the default in the world's largest messengers, the math is not negotiable, and in 2026 the point was conceded.
So this edition leads with the victory. And then asks the question the victory hides: if they could not break the encryption, what did they reach for instead?
The answer is in the same text. With mandatory scanning gone, age verification became the Council and Commission's fallback — a requirement that users verify their age before they may use a "risky" service, meaning a face scan or a government ID to send a private message, send email, or download an app. The European Parliament's mandate rejects mandatory age verification precisely to preserve anonymous communication; the Council's keeps it; and that, not scanning, is now the unresolved center of a deal still being negotiated, with the outcome of the final trilogue uncertain and a possible agreement slipping toward July. One account of the moment named the stakes exactly: anonymous encrypted communication, under that framework, ends. The encryption survives. The anonymity does not.
Hold that sentence, because it is the whole edition. Then widen the lens, because June 30 is not one data point. It is three.
Two properties of a free conversation
A private conversation has two properties, and the privacy movement has spent most of its energy defending one of them.
The first is confidentiality: what you say stays secret. The contents of the message are legible only to you and the person you are talking to — not the platform, not the carrier, not the state. This is the property end-to-end encryption was built to protect, and it is the property that won this year. When people say "encrypted," this is what they mean, and it is genuinely, mathematically defensible: a correctly implemented E2EE channel cannot be read by anyone holding the ciphertext, and no regulation changes the math without forcing a backdoor the architecture and its defenders can refuse.
The second is anonymity: that you can hold the conversation at all without first proving who you are. That you can buy the SIM, open the account, read the page, join the channel, and speak — without binding your legal identity, your face, your fingerprint, or your government credential to the act. This is not a property of encryption. End-to-end encryption protects the contents of the envelope; it was never designed to protect your ability to buy the envelope without showing your face. You can have perfect confidentiality and zero anonymity at the same time: a messenger that encrypts every byte flawlessly and demands a face scan to open the account delivers exactly that — your words are secret, and the fact that it is you saying them, on a registered identity, is not. The encrypted service still knows your account, your number, your device, your address, and your social graph — who you talk to, when, how often. Encryption hides the letter. It was never meant to hide the envelope, the postmark, or the line at the counter where you showed ID to send it.
This is the category error at the heart of the moment. For a decade, "is it encrypted?" became the public test of whether a tool was safe, and the answer increasingly was yes. But encryption was always an answer to surveillance of content, and the identity mandates arriving in 2026 are an attack on anonymity — a different property, defended by different means, and right now defended far more weakly. The whistleblower, the abuse survivor reaching a shelter hotline, the teenager looking up a sexual-health question, the dissident under an authoritarian SIM regime, the ordinary person who simply does not accept that reading should require an ID — none of them is protected by the fact that the channel is encrypted, if they had to prove who they were to enter it.
Anonymity is the substrate. Confidentiality is the layer we learned to pour on top. June 30 is the day the substrate cracked in three places at once.
The fallback is the attack
Return to Brussels, because the EU did not soften so much as pivot, and the pivot is the lesson.
State the win honestly, including its limits, so it is not oversold. The Council gave ground on the hardest demand, mandatory client-side scanning, because it could not be reconciled with encryption and because member states would not order their own citizens' devices turned into scanners. That concession is real. But two things travel with it, and both cut the other way. First, the Council's text still legitimizes and makes permanent a "voluntary" scanning regime — a standing legal basis for providers who choose to monitor, with no court order, which Breyer reads not as a retreat but as "a green light for indiscriminate mass surveillance." The mandate fell; the permission was enshrined. And the fight is not even cleanly over: in the last week of June, EU ambassadors moved to revive the lapsed temporary scanning framework through an unprecedented Council maneuver, despite Parliament having killed it in March by eighty-three votes.
Second, and larger, is the age-verification fallback. Strip the scanner out, and the way you still police who is on an encrypted service is to check the identity of everyone who joins it. That is why, with scanning gone, age verification became the live fight, and why Parliament has drawn its line there. The body that represents EU citizens directly understands what the boolean costs: a mandatory age check on the door of an encrypted messenger converts the most private channel most people have into one you can enter only by attesting who, or at least what age, you are — and you cannot prove your age to a stranger's software without, somewhere in the chain, proving your identity to someone.
This is the move to watch everywhere now, because it generalizes. When you cannot read the message, require an ID to send it. When you cannot break the lock, put a guard at the door who writes down everyone who walks through. Confidentiality and anonymity are not the same property, and a system can grant the first while methodically dismantling the second — which is exactly what the pivot does. The encryption survives. The anonymity is the thing on the table.
The anonymous SIM is dead
While Brussels argued, Mexico set a deadline, and Mexico's version skipped the message and went for the line itself.
As of June 30, 2026, every mobile line in Mexico — prepaid, postpaid, physical SIM, eSIM, more than 144 million of them — must be linked to its holder's identity: a government ID and the CURP, the national population key. The anonymous prepaid SIM — the one the domestic-violence survivor, the investigative reporter, and the ordinary person who simply did not want to be in a database have all relied on — is finished. Hard enforcement, cutting off the unregistered, was set for July 1; on June 25 the regulator softened the timing for prepaid lines into a staggered calendar running through December, but the architecture is built and the direction is fixed. At the extension, barely 43 percent of lines had registered; tens of millions face suspension.
Here the story gets more interesting than the headlines, and more revealing. The line registry is, by the regulator's own rule, not biometric: carriers are forbidden to keep your fingerprints, your photo, or even a copy of your ID — they link the number to your CURP and verify the document, nothing more. And that restraint is not generosity; it is a scar. Mexico has done this twice before. RENAUT, the 2009 registry, ended with its database sold in the street markets of Tepito for a few hundred pesos and physically destroyed in 2012. PANAUT, the 2021 version, demanded biometrics — and the Supreme Court struck it down in full, nine votes to two, on privacy and proportionality grounds. The 2026 line mandate is non-biometric precisely because the Court killed the biometric one; a federal tribunal in June even barred carriers from demanding biometrics to register a line. The legal counter worked.
But look at what runs in parallel, and what has been removed from the other side of the scale. Alongside the ID-linked SIM, the state is building the CURP Biométrica — a national identity that does capture the face, all ten fingerprints, and both irises, created by decree last July, already the country's official ID, already some twenty-five million people enrolled. It is, for now, framed as voluntary; it is also positioned as the verification layer everything else will eventually plug into. And the watchdog that beat PANAUT in 2022 — INAI, the autonomous data-protection authority — no longer exists; it was folded into the executive in 2025. The court precedent that de-biometricized the SIM still stands. The institution that would litigate the next such case is gone. This is how a registry the courts once killed grows back: not by overruling the verdict, but by dismantling the body that won it.
And here the user-side stack — the protocols, the encryption, the hardened devices this publication champions — meets its hardest wall, and honesty requires naming it. Against a compelled identity registry, biometric or merely ID-linked, there is no client-side primitive that lets a person both comply and withhold. Encryption protects the call; it does not unlink the SIM from your name. You can route around a block, because a block is a network condition you can tunnel past; you cannot route around a law that makes your legal identity the precondition of a phone number, because the registry is not in the network — it is at the point of sale, in the issuer's database, in the statute. The one technical workaround for the line mandate, a data-only eSIM from a foreign carrier on roaming, exists, and the regulator has openly conceded it — but it gives no anonymous local number, leaves a payment trail, is a luxury of the mobile few, and the regulator has said it will close after the World Cup. The counter to a mandatory registry is political and legal, not cryptographic. Mexico is the proof in both directions: the courts forced the registry to shed its biometrics, and the hollowing-out of the courts' partner institutions is how it regrows.
Verify everyone
Britain took the same turn through a different door, and made the universal logic of age verification impossible to miss.
On June 15, 2026, the UK government announced a ban on social media for under-16s — Snapchat, TikTok, YouTube, Instagram, Facebook, X — with legislation promised before the end of the year and protections expected in spring 2027. To keep under-16s off a platform you must know who is under 16, which means you must check the age of everyone. As the campaign group Defend Digital Me put it, "to verify a user is over 16, every adult must also prove they are not a child." The EFF was blunter: under such a regime "users of all ages are burdened with proving their age," and "there remains no reliable, privacy-preserving method of verifying the age of every internet user." A measure framed as protecting children becomes, in its mechanism, population-wide identity infrastructure — facial age estimation, ID upload, open-banking checks, mobile-network attestation, the whole toolbox Ofcom has blessed, applied to the entire adult public as the price of staying online.
Britain is not an outlier; it is a follower. Australia's world-first under-16 ban took effect December 10, 2025, and on June 27 — three days ago — the Australian government announced it would double the maximum penalty, to roughly 99 million Australian dollars, after evidence that minors were bypassing it, with five platforms under investigation. The United States, after Free Speech Coalition v. Paxton (decided 6–3 on June 27, 2025, upholding Texas's age-verification law under intermediate scrutiny), now has roughly two dozen states mandating age checks for adult content and a dozen more reaching at minors' social media. The European Commission's April 29, 2026 recommendation urges every member state to make age verification available by year's end, on the rails of the eIDAS 2.0 digital-identity wallet. Freedom House named the pattern in its most recent Freedom on the Net, in the fifteenth straight year of declining internet freedom: "Online anonymity, an essential enabler for freedom of expression, is entering a period of crisis as policymakers in free and autocratic countries alike mandate the use of identity verification technology." The democracies and the autocracies are converging on the same architecture from opposite ends. The autocrat wants the registry to find the dissident. The democracy wants the gate to protect the child. The infrastructure they build is the same gate, and once it stands, it checks everyone.
The issuer who logs
There is a real technical answer to all of this, and intellectual honesty requires both stating it at full strength and explaining why it is not enough yet.
The answer is the zero-knowledge age proof. In principle, cryptography lets you prove a single bit — "over 18" — to a website without handing over your birth date, your name, or your document. The proof is computed on your device; the relying site learns the boolean and nothing else. The EU's age-verification app is sold on exactly this promise: prove you are over 18 "without sharing any other personal information." If the technology delivered what the slogan claims, the anonymity problem would mostly dissolve — you could satisfy the age gate and still be no one in particular to the service behind it. The steel-man is strong and deserves to be taken seriously rather than waved away: privacy-preserving age verification is real cryptography, not vaporware, and it is genuinely better than uploading a passport to a porn site.
But it does not deliver anonymity, and the gap between "privacy-preserving" and "anonymity-preserving" is the whole story. Six things are true at once. Enrolment requires full identification: to get the credential you must prove your real identity to an issuer — a government eID, a bank, a passport check — so your anonymity is gone at issuance, before any proof is ever computed; it is withheld from the website, never from the issuer. The EU standardized the linkable scheme: the digital-identity wallet's rulebook mandates credential formats (ISO mdoc, SD-JWT) that are not cryptographically unlinkable, while the schemes that are unlinkable (BBS+, zk-SNARKs) are not approved for EU public-sector use — so the shipping app draws its privacy from batches of one-time tokens bootstrapped off a passport or eID, which, as the EFF noted, "directly tied national ID to an age verification method." The issuer can phone home: revocation checks can contact the issuer on each use, logging where and how often the credential is presented. Metadata defeats the boolean: IP, device fingerprint, and timing correlate the "anonymous" proof back to a person. Repeated proofs leak: prove "over 21" today and "over 18" last year and the birth window narrows. And the issuer becomes a chokepoint: whoever dominates credential issuance — a national eID, a platform wallet — becomes the de facto gatekeeper of who may speak, a single point of control independent of any one proof's math. The verdict from the field's own cryptographers is the one to keep: the anonymity runs toward the relying party, never toward the issuer. The proof hides your birth date from the website. It does not make you anonymous to the system, and it cannot, because the system was built to know you at the door even if it agrees to forget you at the table.
So the one technical counter to the anonymity attack is necessary, worth building, and — in its deployed 2026 form — not yet sufficient. The right response is not to dismiss zero-knowledge proofs but to demand the unlinkable versions, decentralized issuance, and no-phone-home revocation, and to be honest in the meantime that most age verification shipping today is not even this. It is a face scan and a document upload. Which is to say: identity, collected.
Every mandate is a honeypot
There is a second cost to manufacturing identity at scale, and June supplied the evidence in volume: every identity you are forced to create becomes a database someone else will eventually steal.
This is not theoretical, and the age-verification wave has already produced its breaches. The collective that spent June ransacking corporate cloud tenants is the same one that, in October 2025, stole roughly seventy thousand government-ID photos from the age-verification vendor Discord used. And in mid-June 2026, security researchers found close to a million passport and ID scans — collected by European age- and membership-verification systems — sitting exposed on the open internet with no authentication at all. This is the failure mode critics named in advance: you cannot leak a credential you were never made to create, and a verification system is, by construction, a pile of exactly the documents attackers want most. As the EFF puts it, "age verification systems are surveillance systems," and against them the defender's problem is permanent while the attacker "will just have to be lucky once."
The broader month underlined the rule. The World Food Programme disclosed unauthorized access to the self-registration system through which Palestinians in Gaza apply for aid, exposing the records of roughly six hundred thousand households — names, national-ID numbers, phone numbers, neighborhood locations — which for a displaced population is not an inconvenience but a targeting list. Researchers surfaced a compiled trove on the order of twenty-four billion credential records — not a single new breach but an aggregation of infostealer logs and old leaks, undeduplicated, which is its own lesson about how identity data, once created, never decays and never goes home. A state wildlife agency in Texas lost driver's-license and passport numbers for more than three million license holders through a vendor. The through-line is the custodian failure mode this series keeps returning to: one holder, one breach, everyone exposed, and no remediation path for the individual who never controlled the data and cannot pull it back.
Now lay that beside the mandates. Mexico is linking more than 144 million phone lines to its citizens' identities while enrolling faces, fingerprints, and irises into a national biometric ID — and its own track record runs from the RENAUT registry sold in street markets to a telecom exposure on the very day the new system launched. The EU and UK are standing up age-and-identity verification as a condition of everyday online life. Each is, in security terms, a honeypot under construction — a centralized store of precisely the data attackers most want, justified by a benefit that is real and a risk that is treated as someone else's problem. The breach is not a bug in the identity mandate. It is the mandate's maturity. You cannot promise to verify everyone and also promise the verification database will never leak, because the history of every such database is that it leaks, and the more mandatory it is, the more certainly it does. A biometric cannot be reset. You get one face.
The statute lapsed; the surveillance didn't
Step up one level, from the gate that asks who you are to the state that already knows, because June produced a landmark there too, and it rhymes.
At midnight on June 12, 2026, Section 702 of the Foreign Intelligence Surveillance Act — the legal authority for the NSA's warrantless collection of communications — lapsed for the first time since it was created in 2008. The Senate failed a cloture vote 47–52 on June 5; the House failed a short-term extension 198–218 on June 11; the proximate trigger was a governance crisis, the elevation of a housing-finance official with no intelligence background to acting Director of National Intelligence, which collapsed the coalition reauthorization needed. And yet the surveillance did not stop. Because the Foreign Intelligence Surveillance Court approved the governing certifications back in March 2026, collection continues under them until they expire — by multiple accounts, until roughly March 17, 2027. The statute is the thing that lapsed. The program runs on, lawful by the prior year's paperwork, for nine more months.
Underneath sits a document the public still cannot read. The classified March 17, 2026 FISC opinion — which, according to New York Times reporting, found that the "filtering tool" query problem the government claimed to have fixed in fact extends across the intelligence community, with the FBI having retired its 2024 tool only to use another with the same function — remains secret. Senators extracted a bipartisan commitment to declassify it within fifteen days as the price of an April extension; the deadline passed, and the Senate voted on June 5 without having seen it. This is the state-side face of the property the identity mandates attack from the consumer side: anonymity from the government, the ability to communicate without the state cataloguing the act. And the columns must be kept honest and separate, because the United States is not Mexico's registry or Iran's blackout: it has warrant law, an adversarial court that wrote the very opinion at issue, congressional oversight that negotiated its declassification, and a free press reporting on a classified document. The shared thread is narrow, and worth stating exactly that narrowly — in each of these, the public is asked to accept a fact it cannot see and a visibility it did not consent to, and to trust that the gate, the registry, and the query are pointed only where they should be.
The map
Pull back to the world, and the convergence is unmistakable, because the same season carried the authoritarian versions of the identity mandate too.
Russia banned WhatsApp outright in February 2026 — roughly a hundred million users — and is herding them onto a state messenger, MAX, while pressing platforms to block users who arrive over a VPN; identity and control fused at the network layer. Iran is only now climbing out of the longest nationwide internet blackout ever recorded, thousands of hours dark after the late-February strikes, with restoration partial and foreign platforms still blocked — the rawest reminder that the most total identity control is simply to decide who gets to be online at all. China continues to run the world's most mature real-name regime and has begun pushing enforcement down into the physical infrastructure. Vietnam and Indonesia have legislated their own ID-to-post mandates. And the SIM mandate Mexico just enforced is the global default now, not a regional quirk: by the GSMA's count, roughly 157 countries require proof of identity to activate a mobile line, and more than thirty demand biometrics to do it — up from seventeen in 2020 — even though the GSMA's own researchers find no evidence the requirement reduces crime. The point is not that London and Brussels are Moscow and Beijing — they are not, and the differences (courts, elections, a press) are the whole of what matters. The point is the architecture. A democracy and an autocracy that build the same gate have built the same gate, and a gate does not remember why it was installed. The registered SIM justified by extortion and the registered SIM justified by dissent are the same database. The age check justified by child safety and the real-name law justified by "social stability" call the same identity API. Anonymity is being abolished from both ends of the political spectrum at once, by governments that would agree on almost nothing else, because the capability is convergent even where the intent is not.
The counter, layer by layer
So what actually holds? The honest layer-by-layer accounting is the discipline this series owes its readers, and it splits exactly along the confidentiality/anonymity line.
Where the user-side stack wins — confidentiality. The content layer is defensible and was, this year, defended. Signal's post-quantum ratchet continues hardening the channel against tomorrow's decryption; the world's largest messengers ship end-to-end encryption by default; Tor Browser (15.0.17, shipped June 28) and the hardened mobile baselines (GrapheneOS, tracking the new Android release within days) keep the device and the transport sound; URnetwork's peer-to-peer overlay carries traffic across a censorship-resistant, DPI-resistant path that abstracts the route from any single carrier. Against an adversary who wants to read your message or block your route, these work, and the EU's retreat on scanning is the proof that the math, defended, holds even against a continent.
Where it runs out — anonymity. Against an adversary who wants to identify you before letting you speak, the same stack thins to almost nothing. There is no client-side primitive that defeats a compelled identity registry; encryption does not unlink your SIM from your name; a circumvention tool tunnels past a block but cannot tunnel past a law that makes your legal identity the price of a phone number. The zero-knowledge age proof is the one real technical counter, and in its 2026 form it preserves the confidentiality of the attribute while conceding anonymity to the issuer. Decentralized identity that genuinely withholds — unlinkable credentials, distributed issuance, no phone-home — is buildable and largely unbuilt, blocked as much by procurement standards that prefer the linkable schemes as by any limit of cryptography. This is the frontier, and it is mostly empty.
The map is therefore lopsided in a way the privacy movement has not reckoned with: we are strong exactly where we organized and weak exactly where we did not. The tools that protect what you say are mature, shipped, and winning. The tools that protect that you can act unidentified are immature, rare, and losing — not because the problem is unsolvable, but because we spent the decade on the other half.
The war we forgot
Two lessons close the week, and they are halves of one correction.
The first is that confidentiality is necessary and not sufficient, and treating "encrypted" as the synonym for "safe" was a strategic mistake whose bill is now due. Encryption answered the question the last era asked — can they read my message? — and answered it so well that the public learned to stop asking the other question: can I act at all without first being identified? The identity mandates of 2026 are the adversary's adaptation. They concede the message and take the messenger. They let the letter stay sealed and put a guard at the door of the post office. And against that move, a decade of hard-won cryptographic muscle is aimed at the wrong target.
The second is operational, and it is the through-line this series has held: pre-position the primitive before the control drops. The arrangements that preserve anonymity — the foreign eSIM acquired before the registry deadline, the account opened before the age gate, the unlinkable credential, the overlay that does not bind transport to a registered identity — live, like all circumvention, on the far side of the control. The person who can still act unidentified after June 30 is, overwhelmingly, the person who arranged to before it. But pre-positioning is a stopgap for individuals, not a policy for a society, and the larger correction is one the movement has to make deliberately: fund, build, standardize, and demand the anonymity layer with the seriousness it brought to encryption — unlinkable age proofs over linkable ones, decentralized issuance over national chokepoints, data-minimizing access over verify-everyone, and a legal line that treats the right to be unidentified as a civil liberty rather than a loophole to be closed.
Confidentiality we know how to win; we just proved it again this year. Anonymity we have been losing because we were not fighting for it.
Three governments, three continents, one week, one demand: show your face.
The answer is not to surrender the encryption win — it is real, and it is ours. The answer is to notice that it was the easier war, that the harder one is now the one that counts, and to build the layer where you do not have to show your face to speak.
Confidentiality won. Anonymity lost. The next decade is the fight to win it back.
URnetwork is a peer-to-peer overlay for censorship-resistant transport, designed to resist network-layer Deep Packet Inspection; its February 19, 2026 MCP server release lets agentic clients establish VPN sessions over the peer-to-peer overlay, abstracting transport from the carrier layer. URnetwork's code is open and auditable. It is a confidentiality-and-routing tool, honest about its limits: it protects what you say and how you connect, and — like all such tools — it cannot by itself defeat a law that demands your identity at the door, which is why this edition argues the anonymity fight has to be fought in standards and statutes as well as in code.
https://ur.io