Taylor Lorenz’s Power User - The Govt Wants Your ID To Browse Online

Episode Date: October 2, 2026

AI agents are rapidly becoming the next major way people interact with the internet. They can browse websites, research topics, compare prices, schedule reservations, respond to emails, shop and increasingly take actions on our behalf. But as your agent is going off and scanning websites, or gathering information from government services, should it have to reveal who you are?SUPPORT MY WORK: Buy a paid subscription to my newsletter at https://www.usermag.co         Support my work on Patreon: http://patreon.com/taylorlorenz In this episode of Free Speech Friday, I speak with Shoshana Weissman, digital director and policy advisor at the Abundance Institute, about the growing fight over AI agents, online anonymity and identity verification. We discuss the proposed Stealth Bot Prohibition Act, why lawmakers are looking at AI agents and web scraping, how identity requirements could affect journalists, researchers, developers and ordinary internet users, and what happens if every AI agent eventually becomes tied to a person's real-world identity.We also talk about the difference between legitimate security requirements in areas like banking or healthcare and much broader systems that could create a new identity layer across the internet. As AI agents become more powerful and more common, the rules being written now could determine whether they remain private tools acting on behalf of users, or become another way to track what people research, buy, read and do online.Topics: AI agents, artificial intelligence, AI privacy, online anonymity, AI regulation, identity verification, web scraping, internet privacy, surveillance, government regulation, digital identity, the Stealth Bot Prohibition Act, the future of the open internet.

It would be this messy, ridiculous thing and it wouldn't really solve any problems, but just make us all less private. Recently, the entire AI landscape has been moving towards agents. Pretty much every single AI company and a ton of overhyped startups are promising to build agents for consumers that will browse the web, research topics, and complete everyday tasks on their behalf. But as we move towards this agentic future, governments are already building systems that could force these agents to disclose not only what they're doing online, but who sent them and why. ID verification laws for agents would effectively take this tool that's meant to expand human freedom and possibility and allow you to just get more stuff done,

do research, shopping, et cetera, into a powerful new surveillance layer. Shoshana Weissman is the digital director and policy advisor at the Abundance Institute, where she works on emerging tech issues, specifically around AI and identity verification. I'm so excited to have her here today to discuss why AI agents should be free to browse the internet without revealing your identity.

Hi Shoshana, welcome. Thank you so much for having me. So excited to have you here today. I'm such a huge fan of all of your work, although I think this is the first time you've come on the podcast. You wrote this great piece titled AI agents should be free to browse the internet without revealing your identity. And I kind of want to explain to people what's going on. I feel like we're moving towards this more agentic internet and AI landscape. And it comes with a host of, I think, pretty serious privacy concerns. So a chatbot, right, is something that you interact with within a system. So it's on a website. You're looking at it. You're on chat. GPT or Claude and you're interacting with the LLM that way. Agents are kind of like little computer programs, right? So they can sort of go

around your computer and take actions on your behalf. And increasingly, I feel like people are turning to agents for things like scheduling a restaurant reservation or replying to an email. But agents have a lot more autonomy to kind of act as like almost like a little digital assistant. Yeah, I think that's a really good way to put it. Like even in chat, JVT, you can log into some stuff and change some stuff, but there's a lot of stuff that you're not able to do. Like on your computer, you can't always move around files or if like you want to log in and record or DVR stuff.

That's something an agent can do and that a chat bot can't. I have been trying a bunch of agents. These third party ones, there's one called town AI. Instinct is the one that's really popular right now. Silicon Valley that's trying to raise a zillion dollars and it like texts you on iMessage every day and takes actions on your behalf. There's also Grockbot. It seems like these companies are definitely moving towards the agent version of AI because these agents can help scheduling. They help communicate, but they also can spend money for you increasingly. Like they can shop

for you. They can go off and use the internet and do a lot of things that maybe you might do. I used one recently to search for airline prices. So I had my agent like go off, scour the internet, compare all these different potential itineries because I'm going on this trip, and it found me a great deal, actually. Right now, it's doing it pretty anonymously. Obviously, you're logged in to Claude, et cetera, but for something like instinct, it's not necessarily entering my personal information unless I ask it to do that. How does the rise of AI agents create new questions about identity online? It kind of depends on which agent you're using, but a lot of them have, it's called a user agent string and it says like, oh, this is chat

GPT or this is Anthropic or whatever it is. So the website is like, oh, okay, like this is the guy interacting with us. Like it's through Anthropic or it's through chat GPT, but not all of them do that. Part of the problem is that there's laws in healthcare and there's laws in finance that like kind of make sure that the right person is doing the thing. So moving money or signing a document, there's rules about that stuff. So I can understand how those entities might not want. agents doing things there until the law is clear that they're allowed to because otherwise those

companies could face liability and that can add some complication there's lots of good things that can do like all the stuff you're talking about is exactly what agents are for making your life easier finding you deals and stuff like that but there are some uses of it that are a little bit of gray area and like highly regulated areas end up being that kind of space i think you're going to see more companies wanting to put limits on what agents can do for good and bad reasons like to limit consumers' ability to do good things, but also to keep themselves safe. So there's like a mix of energies around here for why you would want to block an AI agent depending on who you are.

Yeah. I think like if we're using agents for increasingly personal things, it makes sense for us to be giving up a little personal information if it can be used to do shopping for us, medical stuff for us. Obviously you want to make sure that an agent that's doing shopping for a person has the right to use a certain person's credit card, etc. But why should people have the right to use AI agents anonymously. Is using an AI agent fundamentally different from browsing the internet yourself? Why is it important for privacy to be preserved for these agents that are going out and doing these tasks? A lot of what we do online, it's just important to preserve anonymity. So whether it's like a person searching information, whether it's sensitive

or not sensitive, if they just don't want it to be known, you know, they can use VPNs, they can use browsers that have more layers of security. And it's important for people to be able to do that and to have access to tools like that and for the government not to get in the way of those kinds of tools. And the same goes for scraping. Like maybe you're trying to figure out which state to move to based on laws that might affect you. But maybe you don't want everyone to know that you're searching about that kind of stuff or that you're searching about divorce or health issues. There's tons of sensitive kinds of information that you might be interacting with that it makes a lot of sense to want some more privacy around. And this is just the next layer of it. So like you have at a basic level, you have people searching this information themselves with their own fingers, like on browsers and stuff.

And then you have the next layer of like scraping the internet, whether it's through code or through other tools, to be able to access information online or to, you know, alter information online if you're using code to even interact with forums or anything like that. And agents, it's just like the next step here where people are directing agents to find information on subjects. And some of those might be sensitive. It might have to deal with domestic abuse or childcare or all different kinds of things. And it's still the person trying to create, interact with read, information, access information,

and all of that kind of behavior is protected by the First Amendment. Right. So why are governments and companies pushing to identify AI agents and tie AI agents to the offline identities of specific users? So there's, I think, good and bad reasons here. Like, I understand financial companies that just want to make sure they're acting within the law and that they're being careful there. I know that there's complications for them.

Same for healthcare organizations. There have been other cases along those lines too, but you could see maybe there's a store that sells nail polish and a bunch of people say, okay, buy me pink nail polish. And then they don't like the shade and have mass returns. If a company runs into that, I can understand them being like, hold on. Maybe we don't want agents interacting with us and wanting stuff like that. But then there's a proposal in Congress that goes, oh, step further. And it kind of makes it hard for people to be able to scrape the internet or access websites.

Yeah, this is one of the laws that I want to talk to you about. today you wrote about the stealth bot prohibition act and you write that it would prohibit people from deploying a stealth bot software that scans indexes scrapes or accesses an internet source without disclosing its identity and purpose in a way likely to damage burden or impair the service basically it sounds like an anti scraping law and it makes sense that websites wouldn't want their information scraped but you just gave some really good examples earlier where I think actually a lot of users would want to scrape websites like a lot of what users are doing today

is not like malicious scraping to train their own massive AI systems or whatever. It's basically cutting down time that they would normally spend manually like clicking all of these websites and scanning all of these websites and getting this information in that more traditional fashion. Can you dive into this law and why you feel like it misses the mark? So it would make a lot of the stuff you were talking about doing earlier on lawful, which is ridiculous. You know, trying to find good deals on flights, I think is a totally good use of consumer tools and of like agents and,

I don't understand the full motivation here. I think the chunk of it is that like, oh, no, AI agents are using the internet and we don't know who they are. I don't know that that's really a problem all the time, every now and then it will be, but private organizations can handle that themselves. There's organizations working on, like, internet infrastructure that'll make that useful for companies, but we really don't need the government here.

But I think there's like this fear of anonymous internet use to a degree, but it's silly because the bill also prohibits regular scraping, if it burdens a website and if it's anonymous. Yeah, you write in your piece that the bill never actually defines what it means to burden or impair a website. So every website visit, even by Google's search crawlers, burdens a website to some degree. And you also write that the Computer Fraud and Abuse Act and other statutes also already prohibit a lot of forms of sort of malicious attacks that would like actually damage a website. So if the goal is to target cyber attacks, we already have laws that do that. I definitely feel like this could affect journalists as well.

I mean, you mentioned developers, researchers, businesses, hobbyists. Scraping is not inherently bad. It seems like this proposed legislation is just written in a very broad way that could sort of define a stealth bot as like anyone's useful tool and basically capture a lot of activity that users are already engaged in manually today. To put a fine point on how this looks when you're doing it. One thing I do is for my organization is I have like a bunch of media monitoring stuff that feeds into an audience.

and then it scrapes those posts. But the reason is I have a colleague Neil Chilzen. And if he's mentioned somewhere in the article, it's like nice to pull that out and know like, oh, okay, so Neil's mentioned in this one. It's like not Taylor. So I scrape all these websites as they come in to find out what's in them and to see if it's something that I need to track

or something that I don't. And it just goes into a spreadsheet. Like a lot of people do this kind of stuff manually or use other tools for it, but it's like scraping a bunch of websites and it's nothing malicious. It's just trying to track media mentions of my organization. I'm an associate. fellow at the Sloth Institute as well. And we track when USDA Aethus inspects zoos and other facilities

that have sloths. And it's a lot of work to do, but I figured out how to automate it with scraping. I just scrape like the USDA Aphus tracker and upload it there and just double check the data. So government research can be organized this way. And this law could could punish that in circumstances. Programmers all over the world would be affected. People scrape across, you know, country borders, of course. If they're scraping government websites, if they're just trying to find information, media monitoring, if you're trying to like track new additions to all trails, like new trails in your area and you're scraping them, you would be affected by this. There's tons of good things you can do with this and it's frustrating to see lawmakers write something so broad.

That just doesn't make any sense and would prohibit tons of normal activity there, but also agents. So if you're using agents to access stuff, that'll affect you too. If you're watching this video and you like my work, please support me on Patreon via the link below or by a page paid subscription to my tech and online culture newsletter at usermag.co. That's usermag.com. I don't have any long-term brand partnerships and a lot of my content is effectively demonetized. I've lost major brand deals for speaking out on certain issues and for challenging power. As you can imagine, advertisers are not exactly eager to work with somebody who covers a lot of the topics that I cover and talks about the things that I talk about. These videos I make are

entirely funded by you and I can't continue to make them without your support. So if you get any out of the videos that I create and you want me to be able to create more. Please support me on Patreon or Substack via the links below. On Patreon, I do bonus episodes, monthly Q&A live streams, and post frequent updates about my work. My Substack newsletter gives you a bi-weekly roundup of everything that I'm seeing and reading and paying attention to online. You can also get my newsletter on Patreon. Once again, the links to everything are below in the description. Every dollar of your support makes such a difference.

I think it's really concerning especially. You mentioned government websites and scraping government websites. scraping government websites. And if we create this identity infrastructure for agents where every agent has to be tied to a user's offline identity, I feel like suddenly governments would have agent identity records to monitor journalists, activists, anybody sort of seeking information from these websites. And that seems pretty different from how we use the internet now. I mean, can you talk about the difference between what this sort of paradigm would look like versus the internet today? I mean, because a lot of people will be like, well, we're already tracked and surveilled everywhere online today. What's the difference. So if you're researching a government website, I would have to announce for the a fifth example, like I am Shoshana's scraper and I'm trying to find out if people are abusing slavs and the USDA, this isn't handling it properly. That's not something you should have to do to access any information, let alone government information. And right now, the government doesn't collect your information, right? Like right now when you go to view a website, like obviously Google is

monitoring stuff, I guess, like whatever your browser is and is probably tracking your browser history, but there's not this clear, like, identity layer, right? Where it's like a record of you consuming certain information. Yeah, exactly. Like, you can get more detailed analytics and you can tie data together to like learn more about people. But the purpose of why someone's visiting a site, let alone scraping a site, that's not a thing you need to do.

Programmers don't program in like, I am accessing your site for this reason, for this person. That's not how the internet works. And if we had to do that, I don't even know how programmers would build that like into all the code that's already existing. Even for media monitoring software, they're scraping websites too, doing the same kind of thing. And for them or for people monitoring government or just tons of things that people scrape across the whole internet, even Google shopping, Google shopping would have to announce

by their scraping websites to announce products. It would be this messy, ridiculous thing. And it wouldn't really solve any problems, but just make us all less private. Well, yeah. And I understand even regulations on like corporations on like corporal. doing mass scraping or whatever, I think that it's probably a slippery slope and I wouldn't probably support it. But I can understand like why people would want that. But to me, it's like so concerning that as we're moving to this world where everybody's going to have AI agents working

and navigating the internet on their behalf, that companies like corporations could use agent identities to build even more detailed profiles of users or employers, insurers, lenders, et cetera, could obtain information about like what someone's agent research, the type of data that people are seeking, it seems like it's moving more and more towards this system of ID requirements to just browse the internet. Do you think that's fair? Oh, totally. And I think one thing that would tie this home a little bit too is that if you have your AI agent look up resources for people who are victims of domestic abuse because you're a victim of domestic abuse, that would become records. Like, hi, I'm an AI agent looking for this person because they say they're a victim of domestic abuse or even

to learn more about domestic abuse. Like, that really kind of tells you a lot more about the person than someone in that sensitive situation would want to know. And like you say, too, all this is kind of tied into the larger we can just identify people. Like we can just get their ages or we can just get their identities to access information online. And this is definitely in that same strain of thought, even though it looks a little bit different. And I'm expecting that we're going to see stricter identity verification proposals for AI agents. Like, oh, you need to have your identity fully tied to your agent. so we know exactly who you are.

And that's just not how the internet should work. Like the Linux Foundation is trying to create this infrastructure on top of like kind of how websites work and how we know people are interacting with websites. But that's like more standard internet stuff, not like you have to know exactly who everyone is, which is like a very different kind of thing and very frightening that the government's looking at it this way. Yeah. Well, I mean, you've done so much great reporting on these like age verification laws that

are basically ID verification laws. And it seems like the government is really seeking. to create this sort of blueprint for identity verification online. And they're looking for all these different ways in. They've been looking for ways in through adult content, you know, saying, oh, this content is adult. So that's why we have to verify it. They've been looking for a way in through online safety,

saying, oh, you know, Instagram is so harmful. So that's why we have to verify your identity, make sure you're not a child. And it seems like AI agents and the rise of AI could be another way in for the government to create this identity infrastructure online, where now they're going to be like, oh, well, it's your AI agent. And surely you should be able to tie this to your government ID or whatever,

whatever. And it's like before you know it, agents are now the new way that we interact with the internet. And now we've lost total and complete anonymity on the internet. Yeah, totally. I mean, I was expecting age verification laws for AI generally. And we've seen some proposals like that. But this is like a whole other level, like you're saying. Like it's explicit identity verification that I think we're going to start seeing more of.

But also more other layers of it. Like having people have to identify their agent and identify who it belongs to and what they're doing, that's wild. That is just not how the internet works or how it should work. But I think we're going to start seeing a lot more proposals up this alley because lawmakers are looking, it seems like they're looking at AI agents as the next like risk online in a way that doesn't quite make sense where they're like, oh, well, you should have to know who's acting where online. You know, Estonia has a proposal too that isn't quite clear how it would work. Some people have said that it would just be about interacting with government services for the person, which would make a little more sense. But it would tie their digital identity to their AI agent in a way. And like if they're keeping it narrow, I'm a little bit more open to it.

You know, and if it's for government services, I get it. But I wouldn't want to go beyond that where it's like your agent needs an ID. And also people create and delete agents all the time. Like you're testing out different ones, which makes sense that you want to try and find the right one for you where it wouldn't make any sense to have your ID. to that and to all the ones you're trying out. Yeah, so I think we're just going to see a lot more of this alley. Who is the sort of political coalition pushing this or fighting against it? One thing I worry with these types of laws is that, especially on the left,

there's so much justified anger at AI. People want to ban AI. They want to do the pause AI stuff, et cetera, et cetera. And so I feel like a lot of the more like left-leaning people like Bernie Sanders, et cetera, they're not as engaged on these nuanced issues around speech and use of agents because they're just like, well, you shouldn't be using an agent anyway. You know, you shouldn't be using AI anyway. And then on the right, it seems like they're also don't seem to care about privacy. So I guess is there anyone in Congress that is fighting against this type of regulation or

voicing concern about it? Yeah. So this is a newer proposal and it hasn't gotten much traction, thankfully, which I'm very, very thankful for. But if it did rise up, I think we would see people like Ron Wyden in the Senate really go against it. Wyden is usually really, really good when it comes to software thinking he's like the only one he's the only one he's always out there which I appreciate and then when it comes to the next generation of proposals that I'm expecting of real explicit identity verification for agents I don't know what the coalitions there are going to exactly look like because the people who even you know opposed age verification sometimes also don't like AI so I think we could see some weird coalitions on that side but I would hope that lawmakers or enough

lawmakers, but at least to understand this is not how we go about this. Like, we shouldn't have to upload our government ID in order to use an agent and have that idea attached to it the whole way through the internet, you know? Yeah, that totally makes sense. Well, Shoshana, thank you so much for your work covering this issue. I will drop the link to your piece in the description below and appreciate you coming on. Thank you so much for having me. All right.

That's it for this week's episode of Free Speech Friday. If you like my work, please, please buy a paid subscription to my substack newsletter at usermag.co. That's usermag.com or support me. me on Patreon via below. You get basically the same content on my substack or my Patreon. I do a monthly bonus episode. I send a weekly newsletter with everything that I'm reading and following online. And most of all, you're ensuring that this show can continue because I have zero long-term advertising partnerships, zero. And I literally self-fund this show. So truly every single dollar of your support

makes such a difference. Please, please subscribe to my substack usermag.com. And I'll be back next week with a brand new episode of Free Speech Friday. See you then.