That is until recently, when a social media platform’s ill-kept privacy files surfaced on the public internet and an increasingly litigious group of people decided to take matters to court. Now, in an attempt to work proactively to keep underage users safe online and also ensure the privacy of everyone’s collected data, companies are pursuing new methods to verify the age of their users online. But the lack of federal regulation is also fueling this paradoxical directive and fostering the conflict: social media companies can collect the data of users of all ages, to keep children safe. 

The Federal Trade Commission (FTC) released a statement this week allowing social media companies to collect children’s personal data without parental consent in the name of age verification, carving out an exception to the Children’s Online Privacy Protection Rule (COPPA), which decisively names children under 13 as untouchable for data collection, until now. Considering that COPPA was designed to protect sensitive data, the FTC is all but giving social media companies carte blanche to collect any information it deems necessary in the name of age verification.

“Privacy can sometimes be two sides of a coin,” said Johnny Ayers, the CEO and founder of the AI-powered identification software company Socure. “There is a very dangerous naivety that [comes with] identity fraud, liveness, deep fake detection.”

“You can’t collect biometrics on a kid,” he told Fortune. “And so how do you verify someone is 13 without verifying, without collecting a thing, that they’re 13?”

The FTC is calling this policy change a move in the right direction, but psychologists and privacy experts alike warn it’s allowing companies to overreach in data collection, underscoring any pseudo-privacy measures, and the damage to children has already been done.

“These platforms were developed for adults. They were developed for adults, but kids are on them. It was never purposeful, like, what’s the product for kids? It was an afterthought, which then means we’re trying to plug holes,” Debra Boeldt, a generative AI psychologist at the family online safety company Aura, told Fortune. “A lot of these companies right now are trying to help, but don’t have the resources to put towards it, or the evidence-based, trained individuals to think about it and plan for it.”

She oversees the clinical research team at Aura, an online safety solution for individuals and families to protect their identities—and that of their children’s—in an increasingly digital landscape. The company uses AI to monitor families’ online activities and can even recognize keyboard inputs to denote if a child is using a harmful language or platform.

Boeldt is a clinical psychologist with a background in child development. Her team found that nearly one in five children under the age of 13 spend four or more hours online daily, and that’s leading to increased depression and anxiety levels among the internet’s youngest users. 

The findings go as far to coin the phrase “compulsive unlocking,” referring to when children usually get up—around 7 a.m., mirroring a biological clock that resembles that of a smoker’s—and check their phone almost religiously. The company also girls were 17% more likely to experience anxiety as a result of pressures regarding one’s digital availability and connection.

Kids are playing digital whack-a-mole

Efforts by social media companies to remove children from their platforms will prove difficult, simply because they know how to get around them.

“This is just their normal space, where they connect,” Boeldt said, adding any attempts are “going to be kind of like whack a mole,” in which underage users will simply move on to the next platform.

“Maybe your TikTok’s taken away. But then you go on Roblox. Or you go on Discord and you start talking to people there,” she said. “That’s one of the things that is challenging…kids are super savvy, and so they’ll get around things.”

Boeldt referenced Instagram’s recent announcement that it will soon start monitoring accounts it believes to belong to children for any self-harm language. Parents would receive an alert should their children repeatedly search for suicide or self-harm terms on the platform. The move comes as Instagram’s parent company, Meta, is currently on trial for claims of creating a social media environment that intentionally harms and causes addiction in young users. 

“These alerts are designed to make sure parents are aware if their teen is repeatedly trying to search for this content, and to give them the resources they need to support their teen,” the company said in a release.

However, kids already get around censors on social media platforms like TikTok and Instagram, using words like “unalive” or referring to the “PDF files” to mean other, more sinister objects. 

This poses a problem, Boeldt said, as any attempt to stop children from using certain terms will just invent and breed a new set of vocabulary that in turn will then force a new set of attempts to monitor that language, inevitably becoming a never-ending cycle. 

“When I saw this stuff on Instagram and self harm, my brain immediately goes, ‘how good is their model? How well are they going to be detecting this?’” she added. 

Boeldt believes government regulation is the only way to truly force companies to ensure the safety of their users online. “These companies aren’t held to a certain standard” that would stop children from accessing their platforms—not least of all, something these companies “benefit from with kids on their platform. More people, more ads.” 

“At the end of the day, that actually takes a lot of money and resources to do this.”