Freedom House • Governments should avoid imposing age restrictions on VPN use, despite legitimate concerns about protecting children. Such policies risk being emulated by authoritarian states with weak rule-of-law institutions, potentially enabling even more severe violations of fundamental rights in repressive contexts. • Governments should resist mandates that would require VPN providers to log user activity and VPN providers should resist these demands from governments. Similarly, such requirements would likely be replicated by authoritarian regimes to unmask human rights defenders and journalists. SAFEGUARD PRIVACY ONLINE Protecting privacy online is essential to safeguarding free expression in repressive contexts. Without strong privacy protections, journalists and human rights defenders may self-censor out of a fear of reprisal. Rapid advances in AI—and the growing threat of automated vulnerability exploitation—heighten these risks, leaving civil society organizations increasingly vulnerable to sophisticated cyberattacks. Build accountability mechanisms and normative frameworks to disincentivize the misuse of surveillance tools. Commercial surveillance technologies are increasingly used by authoritarian governments to surveil human rights defenders, journalists, and political dissidents. Without meaningful consequences, surveillance vendors and their government clients face few disincentives to curb these abuses. • Governments should use visa restrictions, financial sanctions, and entity listings to hold surveillance firms accountable when human rights are violated through the misuse of a surveillance tool. • Export control officers should improve end-use monitoring of surveillance technologies and intermediary country oversight to address technology transfer loopholes. • Democratic governments should support international norms that seek to combat the misuse of AI to surveil human rights defenders, journalists, and political dissidents. Assess age-assurance measures for their privacy and security impacts. Online child safety requires urgent attention. However, age-assurance or “age-gating” measures pose privacy and security risks and may introduce barriers to free expression and access to information, particularly those aimed at social media platforms. Policymakers should carefully assess the rights impacts of age-gating and pursue a whole-of-society approach to child safety. • Funders should invest in technical research to develop age-assurance methods that are truly privacy preserving and mitigate cybersecurity threats. • Governments should require platforms that allow children to create accounts to make them private by default, and to alter algorithmic recommendation systems to limit children’s exposure to harmful content. • Platforms that permit children to create accounts should provide strong privacy and security safeguards and engage civil society in developing child-protection measures that respect children’s rights. • Policymakers should strengthen child-specific protections in privacy laws and dedicate additional resources toward addressing online child abuse. Improve digital security safeguards. Journalists and human rights defenders are frequent targets of sophisticated digital attacks, yet many lack access to the tools and expertise needed to detect and respond to these threats. Strengthening digital security safeguards, from device-level threat notifications to emergency response support, can help close this gap. • The private sector should ensure that users receive a device notification when their phone is compromised. Apple’s threat notifications are a best practice that should be emulated by other companies and providers. • Donors should continue to support digital security training and rapid-response help lines for journalists and human rights defenders operating in high-risk environments. freedomhouse.org 25