A hypothetical solution is often dressed up as “child protection.” But when the UK lowered the GDPR digital consent age from 16 to 13, the justification didn’t stand up to scrutiny. What it really did was hand Big Tech and the state three extra years of legally-sanctioned access to the personal data of millions of children. At 13, under UK law, a child can now consent to online services without a parent. In practice, that means their activity, preferences, networks, and even biometric signals can be collected, profiled, and monetised. Instead of needing parental oversight, platforms can treat them as fully fledged data sources. This is not a neutral choice. Most of Europe kept the threshold higher, at 15 or 16. The UK deliberately chose the lowest bar. The effect is simple: a wider net for harvesting data, and a longer window of surveillance during the most formative years of life. The move dovetails with a wider authoritarian trend. The UK government is pressing ahead with its digital identity agenda, despite fierce public resistance. A petition against digital ID gathered over 2.8 million signatures — yet was dismissed, its concerns brushed aside. Digital ID is being rolled out anyway, under the banner of “safety” and “efficiency.” Children are the entry point. By lowering the GDPR age to 13, the UK normalises the idea that even minors must submit to the same identity frameworks and surveillance regimes as adults. The rhetoric is protection, but the reality is control. The pattern is clear: digital consent laws, online safety legislation, and digital ID infrastructure are not separate policies. They are strands of the same web. Each step widens the scope of data collection, strengthens state and corporate leverage over citizens, and narrows the space for dissent. Far from empowering children, the UK’s GDPR shift disempowers them. It strips away parental safeguards and treats 13-year-olds as data assets to be mined. In doing so, it reveals the real priority: not protection, but profit and power.