TL;DR
The Electronic Frontier Foundation has published guidance for users confronted with online age-verification mandates, explaining available verification methods and how to minimize privacy harms. The guide urges submitting the least data possible and lays out questions to evaluate each verification option, while documenting platform-specific practices and known risks.
What happened
The EFF published a practical resource for people who encounter mandatory age checks on websites and apps, outlining the trade-offs of different verification methods and advising ways to reduce exposure of sensitive data. The piece explains that many platforms first infer age from existing account signals and only prompt users for extra proof when that fails. When verification is required, options range from on-device facial age estimation to uploading government IDs or proving adulthood through financial or public-record signals. The guide highlights that some systems send images or documents to third-party vendors, that retention policies vary widely, and that leaks and process errors have already led to disclosures. It also calls attention to unequal accuracy of facial estimation tools for some communities, and notes the existence—but limited availability—of cryptographic digital-ID approaches that reveal only whether a user meets an age threshold without sharing underlying identity data.
Why it matters
- Age-verification choices can require highly sensitive personal data that, if leaked or retained improperly, can expose identity and location.
- Some commonly used methods are less accurate for marginalized groups, risking wrongful restriction of access or forced disclosure of more-identifying documents.
- Third-party verifiers and long retention periods increase the attack surface for breaches and make data available for future requests.
- Alternative checks (credit card, email or public-record indicators) reduce certain risks but still undermine anonymity and create tracking vectors.
Key facts
- The EFF opposes age-verification mandates and offers a resource hub to explain what these laws do and how to respond.
- Guidance recommends submitting the minimum amount of data necessary and evaluating each verification option on Data, Access, Retention, Audits, and Visibility.
- Many platforms try to infer age from account signals first; if that fails they present options such as facial age estimation or document upload.
- Facial age-estimation systems can operate on-device (Private ID, k-ID) or by uploading images to third-party servers (Yoti), with different exposure profiles.
- Yoti states that facial images are deleted immediately after an age estimate, and Meta says it will delete uploaded ID images after 30 days; those are stated practices, not guarantees against process failures.
- Security researchers found trackers in Yoti’s app and website, raising concerns that verification activity could be observed by third parties.
- Document-based verification proves both age and identity and has led to breaches in practice; Discord’s workflow error resulted in nearly 70,000 ID photos being disclosed.
- Some document-verification vendors have long default retention policies—for example, Incode defaults to indefinite storage—while platforms may claim to delete on users’ behalf.
- Less-sensitive alternatives include proof of credit-card ownership or checking for adulthood signals in public databases, but these still weaken anonymity.
What to watch next
- Whether major platforms and verifiers adopt external, security-focused audits (the guide cites auditors like NCC Group or Trail of Bits as examples).
- Changes to vendor retention policies and whether platforms enforce prompt deletion of ID images and verification artifacts.
- Adoption or wider availability of cryptographic digital-ID approaches that assert only age eligibility without sharing full identity data.
Quick glossary
- Age gate: A website or app checkpoint that blocks or restricts access until the user confirms they meet a minimum age.
- Facial age estimation: A method that uses a picture of a face to guess whether a person is above a required age threshold; implementations may run on-device or send images to a server.
- Document-based verification: A process that requires submission of a government-issued ID or similar document, which verifies both age and identity.
- Third-party verifier: An external company contracted to perform age checks or identity verification on behalf of a platform.
- Retention policy: A vendor or platform’s rules for how long verification data and images are stored before deletion.
Reader FAQ
Does the EFF support age-verification mandates?
No. The EFF opposes mandates and is working to overturn existing ones and block new ones.
Are facial age checks safe to use?
Not always. On-device methods expose less data, but facial estimation is less accurate for some groups, and many vendors upload images to servers where leaks or tracking can occur.
What happens if I upload my government ID?
Document verification proves both age and identity and can expose sensitive details; practices vary—platforms and vendors report different deletion timelines, but breaches and process errors have occurred.
Should I stop using a service that requires age verification?
not confirmed in the source
This blog also appears in our Age Verification Resource Hub: our one-stop shop for users seeking to understand what age-gating laws actually do, what’s at stake, how to protect yourself, and…
Sources
Related posts
- Why nations should adopt 16 as the minimum age for social media accounts
- The Influentists: How viral AI demos trade context for excitement
- U.S. to suspend immigrant visa processing for 75 countries, State Dept. says