The Era Of Online Age Checks Is Here - How Does It Work?

Gulf Insider

4 days ago

In the United States, at least 24 states have already passed laws requiring pornography sites to verify users' ages, according to the Age Verification Providers Association.
A handful of countries, including Germany, France, Australia, and Ireland, have implemented age verification to access specified content, from social media access to pornography.
At the end of July, the UK rolled out the most comprehensive national system so far.
How does age verification work in practice? What are the loopholes? And how might it reshape the internet? Here's what the experts say.
Age‑verification systems range from uploading a photo of an identification such as a driver's license to advanced biometric scans.
The Age Verification Providers Association lists several approved methods for age checks, including mobile phone account verification, credit database matching, transactional records, and digital ID apps.
Some platforms ask users to upload a government‑issued ID, while others rely on mobile phone account data, banking or credit records, or digital ID apps to confirm age.
Increasingly, sites are turning to biometric solutions, such as facial analysis that estimates age from a selfie or a brief movement check.
Reddit, for example, uses the third‑party service Persona to verify either an ID or a live selfie, while Discord relies on k‑ID, which confirms age by analyzing facial movements. X combines internal account signals with optional ID checks.
Porn sites like Pornhub offer a mix of options, such as requiring a photo ID or running a credit card check before users can view sexually explicit material.
Mary Ann Miller, vice president and fraud adviser at Prove, a digital identity verification platform, said that age verification will become more standard and required over the next 24 months.
Miller said that simpler methods include uploading a government-issued ID that is sometimes checked for authenticity or a selfie taken to ensure identity accuracy and that the person is alive.
'Other methods use solutions that leverage technology that uses the phone as a proxy for our identity since we have them with us 'all the time' and determine the assurance and trust of the person presenting information or attesting their age or attesting for a child's age as part of parental consent,' she told The Epoch Times by email.
'Other methods include age estimation from facial recognition or other data sources.'
In terms of which methods are most reliable, Miller pointed to those that 'can use passive techniques to determine identity assurance first, then age verification as part of an identity flow.'
Passive identity assurance techniques verify a user's identity without requiring the user to actively perform actions—such as entering a password or scanning a fingerprint—by using data already available to infer age, including credit cards, IP addresses, or other information.
Businesses in the near future will have to overhaul their age‑verification systems to meet stricter standards, rather than relying on low‑accuracy or patchwork identity checks.
'What has taken many businesses by surprise is that when they try to apply age verification with low-accuracy identity checks or the absence of identity checks, they have to 'go back to the drawing board' on both aspects,' she said.
Biometric age estimation can be conducted using facial analysis.
Other methods include voice blueprints, gestures, and keystrokes (how you type). These methods are currently less well-developed than facial analysis but are progressing quickly.
Derek Jackson, chief operations officer and cofounder of Cyber Dive, a tech company founded with the mission of keeping children safe online, told The Epoch Times by email that facial biometrics are 'newer but catching on quickly.'
'They estimate your age by analyzing your facial features, cheekbones, eye spacing, skin tone, in real time,' Jackson said. 'Voice biometrics and keystroke patterns are even newer. They try to match your unique patterns, your voice pitch, how fast or slow you type to known age profiles.'
He said that facial recognition is growing quickly because 'it's simple, fast, and surprisingly effective.'
Users remain wary about sharing personal data online, especially government IDs or biometrics.
Denis Vyazovoy, chief product officer of AdGuard VPN, said that some platforms attempt to be more privacy-aware by, for example, not permanently storing selfies or ID documents or keeping data for just seven days.
'But even with such reassurances, trust is low,' he told The Epoch Times by email.
'Even though platforms claim that facial data or ID scans are not stored long-term, people remain wary, and rightfully so. The truth is, any method that requires biometric data, government ID, or sensitive financial information introduces serious privacy risks.'
The UK's Online Safety Act does not mandate a single method of age verification. The UK's tech regulator Ofcom, which is in charge of policing the law, just requires companies to implement highly effective age assurances.
The law focuses on keeping under‑18s out of adult spaces but does not tell companies how to achieve this goal, leaving firms to choose their own verification systems as long as they are 'highly effective.'
But failure to implement a system can result in financial penalties of up to 10 percent of a service's qualifying worldwide revenue, or 18 million pounds ($23.9 million), whichever is greater. The Online Safety Act is a UK-specific law, but it affects U.S. and global companies with no legal presence in the country.