Age Verification Technology
How ID Uploads, Facial Age Estimation and Device Signals Are Rewiring the Web
On 25 July 2025, something quietly unusual happened in Britain. Millions of adults opened websites they had visited for years and were asked, for the first time, to prove how old they were. The Online Safety Act's age verification duties had come into force overnight, and the old honour system, the little checkbox that asked "are you over 18?", was suddenly illegal as a compliance method. Within hours, Proton VPN reported a 1,400 percent spike in hourly signups, and by the weekend UK downloads of VPN apps had jumped by as much as 1,800 percent, with several topping the App Store charts. Whatever you think of the policy, the reaction told you everything about the stakes. Age verification is no longer a fringe idea debated by campaigners. Backed by new online safety laws in the UK, the European Union and more than half of US states, it has become one of the biggest infrastructure projects the consumer internet has ever attempted, and the technology doing the work, from document scans to facial age estimation, deserves a clear-eyed look.
The policy logic is simple enough. Governments want children kept away from pornography, gambling, and in some cases social media, and they have concluded that asking nicely does not work. In June 2025 the US Supreme Court settled the constitutional question in Free Speech Coalition v. Paxton, upholding Texas's age verification law 6 to 3 and ruling that requiring proof of age to access sexual material places only an incidental burden on adults' speech rights. Justice Thomas, writing for the majority, leaned on the analogy of a bricks and mortar shopkeeper checking ID before selling a magazine; Justice Kagan's dissent warned that the majority had applied the wrong legal test to a law that burdens protected speech. Either way, the decision removed the biggest legal obstacle in America, where around 25 states now have age verification laws for adult content, most of them copy paste versions of the Texas model. Brussels published an age verification blueprint under the Digital Services Act, with pilot apps in Denmark, France, Greece, Italy, Spain, Cyprus and Ireland. Britain's regulator Ofcom began issuing fines. The debate has moved on from whether age checks should exist to how they should work, and that is a technology question with genuinely hard tradeoffs.
Four ways to prove you are an adult
The oldest and most trusted method is the ID upload. You photograph a passport or driving licence, take a selfie, and a vendor such as Yoti, Persona or Incode checks that the document is genuine and that your face matches it, usually with a liveness test to defeat someone holding up a photo. Done properly, this is the most accurate approach, because it anchors the check to a government record. It is also the most invasive. You have just handed your name, date of birth, document number and face to a company you have never heard of, to visit a website you may not want associated with your identity. The risk is not theoretical. In October 2025, Discord disclosed that attackers had breached a third party customer service vendor, 5CA, and accessed the government ID photos of roughly 70,000 users, images that had been submitted to review age related appeals. The attackers claimed to have taken 1.6 terabytes of data. Every ID collected for age assurance is an ID that can leak, and identity documents are among the most valuable prizes in the breach economy. The problem compounds as checks spread beyond adult sites to dating apps, gaming platforms and live streaming services, each with its own vendors and retention habits. A person might verify their age five times in a month, at five different companies, for five different purposes, and the security of the whole chain is only as good as its weakest subcontractor.
The method regulators are most excited about is facial age estimation, and it works nothing like facial recognition. Recognition answers the question "who is this person?" Estimation answers a much narrower one: "roughly how old does this face look?" You glance at your phone camera, an algorithm analyses the image, estimates your age, and the image is discarded. No name, no document, no account. The accuracy numbers are better than most people expect. The US National Institute of Standards and Technology runs ongoing evaluations of these systems, and in its January 2026 round the best model, Yoti's, posted a mean absolute error of 2.14 years across millions of test images, while the worst of 37 models was off by more than ten. For the age bands regulators care about most, the error shrinks further, to around 1.1 to 1.3 years for teenagers in vendors' own testing. What matters is that systems are not deployed at the legal line. A site that must keep out under-18s sets a threshold of 21 or 25, the same logic as the "Challenge 25" policy in British shops, so that the error margin falls on adults who get asked for a second check rather than on children who slip through. At a threshold of 25, Yoti reports a false pass rate of about 0.1 percent for 13 to 17 year olds. The trade is visible in the numbers: raise the buffer and fewer minors get through, but more young adults get bounced to a document check they may resent.
The third family of methods piggybacks on credentials people already have. Credit card checks assume that cardholders are adults. Open banking checks ask your bank to confirm you are over 18 without sharing anything else. Mobile network operators can confirm the age status attached to a phone contract, and email based estimation infers age from how long an address has existed and where it has been used. These are low friction and privacy friendly, but they share a common weakness: coverage. Plenty of adults have no credit card, no mobile contract in their own name, or a freshly created email address. Teenagers have borrowed their parents' cards since the dawn of e-commerce, which is why France's regulator allowed card checks only as a transitional measure before phasing them out in April 2025. Ofcom still lists credit card checks as capable of meeting its standard, but the honest reading is that these methods work best as one layer among several, not as the gate itself.
The fourth approach moves the check off the website entirely and onto the device. Apple and Google already know a great deal about account holders, and both have built tools that let apps request an age signal rather than an identity: Apple's Declared Age Range API and Google Play's Age Signals API return a bracket, such as under 13, 13 to 15, 16 to 17 or adult, and nothing more. A wave of American laws is built on exactly this model. Texas, Utah and Louisiana have passed App Store Accountability Acts taking effect between January and July 2026, requiring app stores to verify users' ages and obtain parental consent for minors, while California's Digital Age Assurance Act extends the idea to operating systems at device setup from 2027. The adult industry itself, led by Aylo, the owner of Pornhub, has spent years lobbying for this architecture, arguing that checking age once at the device level is safer than asking every website to collect documents. There is real merit in the argument. There is also a catch: it hands even more gatekeeping power to two companies that already decide what software you may run.
The privacy problem is not a side issue
Every method above sits somewhere on a spectrum between certainty and anonymity, and the tension cannot be engineered away, only managed. The nightmare scenario is a chain of databases linking real identities to sensitive browsing habits, breachable, subpoenable and sellable. France's data protection authority, the CNIL, responded by demanding what it calls double anonymity: the website must not learn who you are, and the verification provider must not learn which website you are visiting. The EU's blueprint goes further, building in zero knowledge proofs, cryptographic techniques that let your phone answer "is this person over 18?" with a mathematically guaranteed yes, without transmitting your name, your exact age or anything that could link one visit to another. These designs are genuinely clever, and they show that the privacy community's sharper critiques have been heard. But they depend on disciplined implementation, and the Discord breach showed what the undisciplined version looks like. A law that forces millions of people to upload identity documents to view legal content is, in effect, a law that mandates the creation of targets.
Then there is the awkward fact that determined users route around the whole apparatus. The British VPN surge was not an anomaly. When Pornhub withdrew from France in June 2025 rather than comply with its law, Proton VPN recorded a 1,000 percent jump in French signups within hours. When Florida's law took effect in January 2025, VPN demand there rose by a reported 1,150 percent. Researchers at New York University's Center for Social Media and Politics and the Phoenix Center have tracked what happens after state laws bite: searches for compliant, age gated platforms fall, while searches for offshore sites that ignore the law rise. Aylo has responded to the patchwork by simply blocking access from state after state, more than twenty by now, which means the sites that follow the rules lose their audiences to the sites that do not. Supporters of the laws point out, fairly, that overall traffic to the big compliant platforms drops sharply once checks appear, and that friction is the point: most children are not determined adversaries, they are bored teenagers who will give up at the first hurdle. Critics answer that the traffic does not vanish, it migrates to sites with no moderation standards at all. Both things can be true at once, and probably are. A teenager with a free VPN and ten minutes of motivation is not stopped by any of this. The people who are stopped are casual underage users, which is a real gain, and law abiding adults who would rather give up pornography than hand over a passport, which is a real cost.
The map of rules is becoming dense. In the UK, Ofcom judges age assurance against four tests, accuracy, resistance to circumvention, reliability and fairness, accepts methods from facial estimation to open banking, and can fine companies up to 10 percent of global revenue; by early 2026 it had opened investigations into more than 90 services and issued its first fines, including one against the live streaming platform Kick. In the EU, the Digital Services Act's guidelines on protecting minors set the direction, the Commission's white label age verification app was declared technically ready in April 2026, and France runs the strictest national regime, with Arcom able to fine up to 4 percent of turnover and order ISPs to block non compliant sites within 48 hours. In the US, the Paxton ruling has unleashed the states: roughly half now mandate age checks for adult sites, the app store laws are layering device level duties on top, and the fights have moved to social media, where courts have been far less receptive. Australia, not to be left out, began enforcing a national ban on social media accounts for under 16s in December 2025, after a government trial of more than 60 age assurance tools concluded that no single method was good enough on its own.
That Australian trial deserves more attention than it got, because it is the most honest public assessment of the state of the art. The government spent 6.5 million Australian dollars testing more than 60 tools from 48 vendors. Facial estimation returned results in under 40 seconds with a mean error around 1.3 years, but accuracy sagged badly near the 16 year threshold, wrongly flagging 8.5 percent of 16 year olds as underage, and performance varied by skin tone and gender. Document checks were the most accurate option by far, yet the law restricts their use on privacy grounds. The trial's conclusion, that a layered or waterfall approach is needed, starting with the lightest method and escalating only when the result is uncertain, is where serious policy is converging, and it happens to be correct.
Here is my own read, having watched this debate for years. The technology is good enough to run an age gate and not good enough to pin down an exact age, and too much policy pretends otherwise. Facial estimation with a sensible buffer, backed by privacy preserving credentials like the EU's zero knowledge design, is a defensible way to keep most children off adult sites without building an identity registry. Laws that default to ID uploads for access to legal speech are not. They impose the highest privacy cost, they create breach targets like the one Discord's vendor became, and they push traffic toward the least responsible corners of the web while punishing the platforms that comply. If the goal is protecting children rather than performing protection, the double blind, data minimising designs are not a nice extra. They are the whole ballgame.
None of this will satisfy everyone. Civil liberties groups such as the Electronic Frontier Foundation argue that any gate on lawful speech is a surveillance mandate wearing a child safety costume, and the VPN data shows they are right about the evasion, if not about the casual users the gates do catch. Parents, for their part, mostly just want something that works better than a checkbox. The uncomfortable truth is that age verification today is a blunt instrument getting sharper: accurate enough to matter, leaky enough to worry about, and now embedded in law on three continents. The checkbox era is over. What replaces it is still being decided, one screenshot of a passport at a time.