GoKawiilIn the span of a few years, age verification went from an idea to standard practice on large parts of the internet. Seeking to prevent kids from accessing porn, other inappropriate content, or social media altogether, laws mandating age-gating have spread rapidly across the globe, reaching the UK, the US, Australia, France, Brazil, and many more countries. The problem comes in with exactly how to check that a user isn’t lying about their stated age. Unfortunately, every method politicians have settled on has significant flaws — and though experts have ideas to improve on them, these remain just concepts for now.
One popular method is age inference, which uses AI to “guess” the age of users based on their activity on a specific platform. Another is third-party services that promise to prioritize user privacy. A third is having app stores and operating systems perform age checks before users can download apps. But each of these methods comes with significant tradeoffs, even as new rules are forcing platforms to deploy them at scale. It’s 2026, and we’re living on an increasingly age-gated internet, but the right tech still isn’t there.
It starts with age inference
Before scaring away users by asking for an ID or face scan, many platforms try to guess their age using data that’s already on file. Meta, for example, uses an AI-driven system to identify and place teens on Instagram into more restrictive accounts. Google and YouTube also started scanning accounts for users suspected to be under 18, while Discord is planning to roll a system out later this year.
Inference systems look at a variety of signals. A simple one is account age — if you joined Instagram 18 years ago, for instance, you’re probably over 18. Others are more speculative. YouTube uses AI to analyze the types of videos you’ve searched for. Discord has said it will use device and activity data, along with “aggregated, high-level patterns across Discord communities,” while Instagram may flag an account if someone wishes them a “Happy 14th birthday” on a post.
Ideally, the upside to inference is that nobody has to provide extra data. Discord has said most users won’t be impacted by its incoming age verification rollout because of its age-guessing AI system. “You don’t need to know who someone is in order to figure out their age, so that’s why, in theory, age inference technologies can be less privacy invasive,” Cobun Zweifel-Keegan, managing director at the International Association of Privacy Professionals, tells The Verge.
But age inference alone often can’t reliably predict someone’s age, and may not meet the bar set by government regulators. When the system is unsure about someone’s age — or falsely declares them a minor — users are asked to divulge personal data about themselves anyway.
Passing on personal data
To verify someone is at least 18, an age-gating system typically needs to collect revealing details about them, and that raises a whole new set of privacy tradeoffs. A government-issued photo ID, for instance, is a highly accurate age indicator but causes severe problems if it’s exposed in a data breach, something that’s happened multiple times. Third-party vendors like k-ID, Persona, and Yoti can save every company from needing to run its own system and let them offload some risk. For users, there’s still a fundamental security problem that these services are attempting to mitigate, but haven’t solved.
Scanning a user’s face and automatically determining their age range has become a popular alternative to photo IDs. It doesn’t require collecting a legal document, and it can even be conducted on the user’s device, so no identifying information gets stored somewhere it might leak.
... continue reading