Your ID Is Already Leaked – The Data Breach That Should Have Stopped Age Verification in Its Tracks

The TEA App Breach: A Warning We Ignored

On July 25, 2025, a massive data breach exposed roughly 72,000 images—including verification selfies and government IDs—from the TEA app, a dating safety platform marketed to women. These files weren’t properly secured. When the database was discovered, people all over the world began downloading and sharing its contents.

What makes this particularly alarming is that TEA’s own privacy policy stated in black and white: “Selfies and government ID images will be deleted immediately following the completion of the verification process.” Yet here we are. Over 72,000 images are now circulating online, scraped from an open Firebase bucket.

The breach included IP addresses of users, and people started making maps showing exactly where these women lived. You might never have said anything nasty on the app and were simply using it because you worried about your safety. Now your face, government ID, and home address were all being eagerly shared. This is particularly concerning those who are using this platform, who have done this to avoid domestic abuse and predatory stalking.

This is exactly what security experts have been warning us about for years. And now, as governments worldwide mandate age verification systems that require the exact same data, we’re building these vulnerabilities into the very infrastructure of the internet.

The Global Age Verification Wave

Over the past few weeks, a fundamental shift has occurred across the global internet. One by one, major platforms have begun rolling out mandatory age verification systems. To listen to certain music on Spotify, you now need to provide a government ID or biometric verification to a third party. To access certain Reddit communities, users must verify their age through a third party—even longtime users. YouTube is experimenting with AI systems that calculate your age based on behaviour, viewing habits, and engagement history.

This sudden wave of ID checks across major platforms wasn’t a coincidence. It was the result of a global wave of government mandates that has come to a head, marking the start of a new era for the internet. This isn’t just a new login screen or a more annoying signup flow. It’s a fundamental shift in how the internet works, transforming it from a system built on openness to one built on surveillance and control.

The Global Regulatory Landscape

United Kingdom: The Online Safety Act

The UK’s Online Safety Act quietly changed the rules for what the internet is allowed to be. The law marks a fundamental shift—you now need to verify your identity simply to watch a video, share a website, or share your thoughts. It mandates strict age checks for any platform deemed to host harmful or adult content, but that definition is deliberately broad. It includes anything with user-generated content, which basically means every social media site, forum, messaging app, and video platform.

Under this system, users are now being asked to submit government ID or facial scans just to browse, communicate, or participate online. The law passed in late 2023, but Ofcom, the UK’s communications regulator, gave platforms until mid-2025 to implement these systems. That’s why we’re seeing everything change now.

European Union: Chat Control and the Digital Services Act

In the EU, a law known as “chat control” has been quietly advancing for years. It would require platforms to automatically scan all private messages, emails, and stored files—including encrypted messages, which would effectively eliminate end-to-end encryption across Europe. The proposal was first introduced in 2022, but progress stalled until 2024 when Hungary took over the rotating presidency of the Council of the EU and brought the law back. A new version was introduced with Denmark’s backing, and the law is now headed for a final vote in October 2025.

Additionally, the Digital Services Act in the EU requires certain platforms hosting user-generated content to implement strict age verification, giving companies a 12-month window to comply.

Australia: The Under-16 Ban

In Australia, access to YouTube and social media is now banned for anyone under 16. The government mandated that users submit face scans and government IDs to use these platforms, and they plan to expand these controls to search engines, embedding identity checks into everyday browsing.

Canada: Bill C2

Canada’s Bill C2 expands surveillance powers to allow police warrantless access to your identity, login history, and online activity. It mandates backdoors in apps and platforms, giving authorities real-time access to user data and communications.

Switzerland and the United States

In Switzerland, a new surveillance law would force VPNs, messaging apps, and online platforms to log user identities, IP addresses, and metadata for government access. Companies like Proton have announced they will relocate if the law is passed.

In the US, dozens of states are pushing new laws that mirror these restrictions, forcing people to verify their identity, prove their age, and give their real name just to use basic online services.

Why Platforms Are Complying Globally

This is why Spotify is suddenly asking for your ID and why YouTube is experimenting with AI-driven age enforcement. Platforms are rolling out global policies anyway because it’s simpler and cheaper to have a single policy everywhere. This forces every country into the same restrictive policies whether they wanted them or not.

Some people suggest that this sudden global crackdown on privacy must have been a coordinated and deliberate strike. But a simpler explanation is that the time was right. For years, platforms have slowly adopted these changes which normalised the idea. Each small change felt minor and tolerable. So by the time governments introduce a legal mandate, almost no one pushes back. The norms have already shifted. The world was primed, and now a wave of regulation has swept in almost unopposed.

The Hidden Dangers of Age Verification

1. Normalisation of Surveillance

We’re normalising identity checks just to participate online. This isn’t really about protecting children—that’s just the justification. What’s being built is a system where anonymity is treated as a threat and participation requires permission.

2. The KYC Problem

KYC (Know Your Customer) was formalised as a standard for verifying financial accounts. But we rarely talk about the liability that comes with collecting and storing this kind of sensitive data. These databases are breached constantly, and when they are, they don’t just expose financial information—they make people targets for harassment, extortion, or worse. KYC isn’t protection; it’s exposure.

3. The “Temporary Storage” Fallacy

Companies and government agencies claim they’re protecting you, but in reality, they’re collecting sensitive data with almost no accountability. It’s marketed as protection, but what it delivers is exposure. Users are rarely told where their data goes, how long it’s kept, or who has access to it.

At TSA checkpoints in the US, travellers are now being asked to scan their faces. The official line is that the images are deleted immediately. But how do we know who verifies that? There’s no public access to these systems, no independent audit, no transparency. We’re simply asked to trust.

4. More Breaches Will Follow

The TEA app breach is not an isolated incident. We’ve seen countless crypto-related businesses get their databases hacked and as a result there’s been a surge in related kidnappings and extortion attempts across the world as criminals now have the home addresses of those who own Bitcoin. There have been dating websites that collect real names and billing information that were hacked and the user data leaked online. People have been blackmailed and publicly outed because of this data. People have even taken their own lives in the aftermath of such breaches.

Even the IRS has been hacked many times. In one data breach, hundreds of thousands of taxpayers had their full financial history exposed, including income, employment records, home addresses, and family details. This kind of information leads to devastating identity theft and fraud that can financially ruin people.

Security experts agree that it is not “if” but “when”, all services will be breached, so there is no “safe storage” for any personal data.

What This Means for Your Digital Future

Show-your-papers is not a healthy default for a free society, especially not on a network that was originally designed for openness, collaboration, and the free exchange of information without gatekeepers.

Our greatest platform for free expression has become our greatest instrument of control. We can’t accept this shift passively. The normalisation of mandatory identity verification is deeply harmful. Privacy isn’t suspicious or criminal—it’s normal.

Trying to protect children, or keep anybody safe, is simply not a valid justification when the opposite is true, as history is now showing us.

Actionable Steps: Protecting Yourself Going Forward

1. Use Decentralised Platforms

Decentralised infrastructure breaks the gatekeeper model. It distributes control across many independent participants, which makes it inherently resistant to coercion and significantly harder for governments to impose censorship.

Messaging Alternatives:

• Bit Chat: A Bluetooth mesh messaging network that enables peer-to-peer communication among nearby devices without requiring internet access
• Meshtastic: Uses small radio devices to create local mesh networks independent from the internet
• Simple X: A serverless peer-to-peer messaging app with no identifiers or phone numbers required

Social Media Alternatives:

• Mastodon: Decentralised social media platform
• Bluesky: Distributed social network
• Matrix: Decentralised communication protocol
• Nostr: Decentralised social networking protocol

Storage Alternatives:

• IPFS: A distributed file storage system where files are split and stored across independent nodes with no single point of failure

2. Use Encrypted Services

Encryption disrupts the core mechanics of surveillance. It makes it harder to monitor users, inject backdoors, and enforce ID checkpoints. Consider using:

• End-to-end encrypted messaging apps (Signal, Telegram, etc.)
• Encrypted email services (Proton, Tuta, etc.)
• Privacy-focused browsers (Brave, Librewolf, etc.)

3. Minimise Data Collection

The safest database is the one that never existed. Where possible:

• Use pseudonyms instead of real names
• Avoid platforms that require phone number verification
• Use privacy-focused search engines (Brave, DuckDuckGo, etc.)
• Clear cookies and browsing data regularly (or better still turn off these features in your browser)

4. Advocate for Change

• Challenge laws that mandate identity systems
• Challenge platforms that collect unnecessary identification data
• Support organizations fighting for digital privacy rights
• Educate others about the risks of centralized data collection

5. Build Resilience

As more people learn to run their own servers and nodes, decentralised networks will become stronger, more resilient, and much harder to censor. Consider learning how to:

• Run your own server or node
• Use self-hosted alternatives to mainstream services
• Support open-source privacy tools (as shown on this website)

The Fight Has Just Begun

Yes, the past few weeks have been scary. Yes, we’ve reached a major inflection point in the evolution of the internet. Control, surveillance, and censorship are now part of the infrastructure itself. Identification is the default. No ID, no entry. No selfie, no account.

KYC culture has spread far beyond finance into social platforms, community forums, and dating apps. But that doesn’t mean we’ve lost. It means that a new fight has just begun.

Decentralisation and encryption disrupt the core mechanics of surveillance. These tools are still growing, but we need them now. The more people who use them, the stronger they become and the harder they are to shut down.

We need to build, support, and spread these alternatives. This is a landslide of lost freedoms, and it happened in mere weeks. This transformation wasn’t an accident. It was the inevitable result of complacency and quiet normalisation. But it will become permanent if we don’t resist.

The best path forward is to reimagine the internet—not as a landscape of checkpoints and control, but as the free and open network it was always meant to be. It’s time to move full speed into the next generation of the internet. The future is decentralised.

Note: This article summarises concerns about age verification mandates and surveillance infrastructure. Readers are encouraged to verify specific regulatory developments in their jurisdiction and consult privacy experts for personalised guidance.