What changed

New Zealand's government introduced a bill on August 24 that would prevent children under 16 from using social media. The duty would fall on platforms, which would have to take reasonable steps to confirm users' ages; the proposal includes fines of up to 10% of global revenue for noncompliance.

This is not a ban in force. Coalition partners have announced their opposition, so passage through Parliament remains uncertain. Even so, the bill makes a wider debate more concrete: stating a minimum age is not enough when a service has no reliable way to apply it.

Age assurance is the process of estimating or proving whether someone is above an age threshold. It may use information already held in an account, a digital identity, formal identification, or facial age estimation. Each option reduces some risks but can create others, especially if sensitive evidence is retained too long or reused for advertising and profiling.

Why it matters

The goal of protecting children is clear, but the gate affects everyone. To distinguish minors from adults, a platform may ask millions of people for information they never had to provide simply to communicate, learn, or create online. The challenge is to confirm only what is necessary without building a database more intrusive than the problem it is meant to solve.

Consider a teenager mistakenly classified as an adult, or an adult blocked because facial estimation failed. Without a simple review path, technology merely exchanges one risk for another. If document copies or facial images are centralized, a security incident also becomes far more consequential.

A stronger design separates proof of identity from proof of age range. NIST's digital identity guidance uses this exact example: in many cases, the service only needs to know whether a person is above or below a threshold, not their exact birth date. That distinction may sound small, but it changes both the amount of exposed data and the possible harm when something goes wrong.

Brazil is already facing the same choice

Brazil's Digital Child and Adolescent Statute has been in force since March 17, 2026. It requires reliable mechanisms for restricted content, limits age-check data to that single purpose, and says social media accounts held by children and teenagers up to 16 must be linked to a legal guardian. It also requires the most privacy-protective settings by default.

On August 21, Brazil's data protection authority, ANPD, began monitoring 22 organizations, including social networks, public areas of messaging apps, app stores, and generative AI tools. The authority is examining governance, transparency, risk management, reporting channels, and user protections. Compliance will therefore be measured by processes and outcomes, not merely by the presence of a button.

This is where data hygiene moves out of the back office. Missing ages, duplicate accounts, inconsistent family links, and records with unclear origins can block the wrong people or admit users who should be restricted. Before automating a decision, an organization must know what data it holds, where it came from, how long it should exist, and who can correct it.

What companies can learn

The answer does not belong only to legal or security teams. Product, data, user experience, customer support, and operations must jointly define how protection works, how mistakes can be challenged, and what evidence is available for an audit. A Technology Cell can bring those capabilities together around the full journey, from account creation to human review.

The most useful principle is straightforward: child safety and privacy must advance together. The strongest solution is not the one that collects the most signals, but the one that meets its purpose with less exposure, measures errors, and makes correction possible.

• Map where minors can access the service and the concrete risks in each user journey.
• Collect the minimum and prevent age-check evidence from being reused for advertising or profiling.
• Test false positives and false negatives across audiences, devices, and conditions.
• Offer an accessible review route for users and guardians, with clear deadlines and ownership.
• Audit verification providers and delete sensitive evidence when its purpose has ended.

The debate has moved from software to infrastructure

On August 24, Reuters reported that political opposition to artificial intelligence data centers had begun to affect investor sentiment toward technology companies. The shift shows that AI expansion is no longer assessed only through model capability: power availability, grid infrastructure, and relationships with local communities have entered the decision.

In Texas, the state government ordered an audit on August 3 of projects waiting to connect to the grid. The official statement says the queue considered by ERCOT exceeded 474 gigawatts, more than five times the system record demand. That amount represents connection requests under review, not contracted consumption, but it reveals the scale of the task of separating viable projects from proposals that have not yet been demonstrated.

Power, water, and local costs are now part of the product

The standards announced by Texas require new data centers to demonstrate that they can meet connection conditions, protect grid reliability, and avoid transferring required infrastructure costs to residents. The state also included water conservation, noise, and neighborhood impact among the assessment criteria.

ERCOT preliminary forecast places total demand near 367. 8 gigawatts in 2032, compared with the historical peak of 85. 5 gigawatts recorded in 2023. The forecast covers all economic growth in the state, not data centers alone, but it helps explain why large loads must be verified before entering system planning.

At a national level, the International Energy Agency estimated that data centers consumed about 180 terawatt-hours in the United States in 2024 and that consumption may grow by roughly 240 terawatt-hours by 2030. Digital expansion therefore depends on physical decisions made long before a person opens an AI tool.

What changes for companies that use artificial intelligence

For most companies, the conclusion is not to build a power plant or stop AI projects. It is to include infrastructure, cost, and continuity in the value assessment. Larger models are not always necessary for simple tasks, and poorly designed processes can consume more capacity without producing a better result.

Supplier selection also brings new questions: where the service operates, how it handles demand peaks, what commitments it makes about power and water, and how it maintains availability when the grid is constrained. These factors are no longer only environmental topics; they can affect price, schedule, reputation, and operational continuity.

How to grow without turning scale into waste

A responsible strategy connects every AI workload to a verifiable outcome and considers efficiency from the design stage. The goal is not to restrict innovation, but to ensure scarce capacity is used where it creates real value.

• Use a model suited to the task rather than always choosing the largest option.
• Measure cost, time, consumption, and quality for each automated process.
• Plan peaks, contingency, and continuity before expanding the workload.
• Require supplier transparency on location, power, water, and availability.
• Review data and workflows to avoid reprocessing, duplication, and calls that produce no useful result.

Artificial intelligence is moving beyond a conversation window

On August 25, Google introduced a version of Gemini Enterprise designed for legal work. Reuters reported that the platform combines integrations with legal systems and agents that can support routine and complex tasks, including research, document preparation, and process administration.

The announcement points to a broader change: enterprise AI is moving from isolated use into workflows where documents, rules, people, and decisions already meet. For companies in any industry, value no longer comes only from producing text quickly. It depends on how the tool accesses information, respects permissions, and delivers work that can be verified.

Speed without context can simply produce mistakes faster

Google says the solution was designed to work with the data and controls already used by law firms and legal departments. These include user permissions, information isolation, and traceable references. That matters because legal documents cannot circulate like ordinary content: a contract, case, or strategy may contain confidential data and specific obligations.

The American Bar Association says professionals need to understand AI limitations, protect client information, and review analyses and citations before using the result. The guidance reinforces a principle that also applies to finance, healthcare, human resources, and operations: automation does not transfer responsibility for a decision.

What this change teaches other companies

Legal work is a demanding test for enterprise AI adoption. If technology must preserve confidentiality, history, rules, and professional responsibility in this environment, the same controls can help any organization that handles important data.

Before connecting an agent to contracts, email, records, or internal systems, a company needs to define who can access each piece of information, which sources are trusted, which actions require approval, and how every result will be recorded. Without that foundation, the company may gain speed in a task while losing trust in the process.

• Start with bounded tasks whose benefit and risk are clearly identified.
• Connect AI only to organized, current, and authorized sources.
• Keep human review for decisions with legal, financial, or operational impact.
• Record sources, versions, and approvals to support audits.
• Measure quality and reduced rework, not only the number of answers.

The advantage is not replacing specialists

The most consistent opportunity is to free professionals from repetitive searches, document comparison, and initial preparation so they can spend more time on interpretation, negotiation, and decision-making. AI can expand capacity, but business knowledge still defines what is correct, relevant, and acceptable.

Organizations that treat adoption as a data and governance project, rather than simply buying a tool, are more likely to build safer results. The differentiator will be combining speed with context, traceability, and human responsibility.