GoKawiilThis article has been reviewed according to Science X's editorial process and policies . Editors have highlighted the following attributes while ensuring the content's credibility:
Credit: Pixabay/CC0 Public Domain
New cybersecurity research indicates that one of the world's leading age verification providers collects and shares highly sensitive personal data—including facial photos and device fingerprints—with third parties. The research also reveals that most websites that require age verification don't enforce the policy.
The findings come from a new study, "Papers Please: A First Look at Age Verification on the Web," that researchers from the Georgia Institute of Technology and the University of California, Irvine (UC Irvine) presented on May 20 at the IEEE Symposium on Security and Privacy (SP 2026) conference in San Francisco.
The research team examined Yoti, a London-based company that provides age-verification services for an estimated 60% of websites that require it. Its client list includes Meta, OnlyFans, Sony PlayStation, and TikTok.
The research team determined that the process Yoti uses to verify a person's age broadcasts the person's personal information to third- and fourth-party companies.
When a bartender checks an ID, they quickly verify a customer's date of birth and identity before serving them. Companies like Yoti that employ digital age verification claim their products function the same way, but in a completely private manner.
That analogy has justified laws passed in 25 U.S. states—comprising more than 40% of Americans—mandating the use of digital age verification to gate access to social media and adult online content.
However, by measuring online age verification, researchers reveal that the reality of these systems is far from ideal. The study found that most sites covered by these laws do not appear to enforce age verification.
When sites comply, they force users to use third-party age-verification services like Yoti, which collect and share highly sensitive data with other third parties.
... continue reading