The Era of Online Age Checks Is Here–How Does It Work?

Laws demanding internet users provide proof of age are sprouting up around the world.

In the United States, at least 24 states have already passed laws requiring pornography sites to verify users’ ages, according to the Age Verification Providers Association.

A handful of countries, including Germany, France, Australia, and Ireland, have implemented age verification to access specified content, from social media access to pornography.

At the end of July, the UK rolled out the most comprehensive national system so far.

How does age verification work in practice? What are the loopholes? And how might it reshape the internet? Here’s what the experts say.

How Age Checks Work in Practice

Age‑verification systems range from uploading a photo of an identification such as a driver’s license to advanced biometric scans.

The Age Verification Providers Association lists several approved methods for age checks, including mobile phone account verification, credit database matching, transactional records, and digital ID apps.

Some platforms ask users to upload a government‑issued ID, while others rely on mobile phone account data, banking or credit records, or digital ID apps to confirm age.

Increasingly, sites are turning to biometric solutions, such as facial analysis that estimates age from a selfie or a brief movement check.

Reddit, for example, uses the third‑party service Persona to verify either an ID or a live selfie, while Discord relies on k‑ID, which confirms age by analyzing facial movements. X combines internal account signals with optional ID checks.

Porn sites like Pornhub offer a mix of options, such as requiring a photo ID or running a credit card check before users can view sexually explicit material.

The Next 24 Months

Mary Ann Miller, vice president and fraud adviser at Prove, a digital identity verification platform, said that age verification will become more standard and required over the next 24 months.

Miller said that simpler methods include uploading a government-issued ID that is sometimes checked for authenticity or a selfie taken to ensure identity accuracy and that the person is alive.

“Other methods use solutions that leverage technology that uses the phone as a proxy for our identity since we have them with us ‘all the time’ and determine the assurance and trust of the person presenting information or attesting their age or attesting for a child’s age as part of parental consent,” she told The Epoch Times by email.

“Other methods include age estimation from facial recognition or other data sources.”

In terms of which methods are most reliable, Miller pointed to those that “can use passive techniques to determine identity assurance first, then age verification as part of an identity flow.”

Passive identity assurance techniques verify a user’s identity without requiring the user to actively perform actions—such as entering a password or scanning a fingerprint—by using data already available to infer age, including credit cards, IP addresses, or other information.

Businesses in the near future will have to overhaul their age‑verification systems to meet stricter standards, rather than relying on low‑accuracy or patchwork identity checks.

“What has taken many businesses by surprise is that when they try to apply age verification with low-accuracy identity checks or the absence of identity checks, they have to ‘go back to the drawing board’ on both aspects,” she said.

The Push for Biometric Verification

Biometric age estimation can be conducted using facial analysis.

Other methods include voice blueprints, gestures, and keystrokes (how you type). These methods are currently less well-developed than facial analysis but are progressing quickly.

Derek Jackson, chief operations officer and cofounder of Cyber Dive, a tech company founded with the mission of keeping children safe online, told The Epoch Times by email that facial biometrics are “newer but catching on quickly.”

“They estimate your age by analyzing your facial features, cheekbones, eye spacing, skin tone, in real time,” Jackson said. “Voice biometrics and keystroke patterns are even newer. They try to match your unique patterns, your voice pitch, how fast or slow you type to known age profiles.”

He said that facial recognition is growing quickly because “it’s simple, fast, and surprisingly effective.”

Privacy Risks and Skepticism

Users remain wary about sharing personal data online, especially government IDs or biometrics.

Denis Vyazovoy, chief product officer of AdGuard VPN, said that some platforms attempt to be more privacy-aware by, for example, not permanently storing selfies or ID documents or keeping data for just seven days.

“But even with such reassurances, trust is low,” he told The Epoch Times by email.

“Even though platforms claim that facial data or ID scans are not stored long-term, people remain wary, and rightfully so. The truth is, any method that requires biometric data, government ID, or sensitive financial information introduces serious privacy risks.”

The UK’s New Law

The UK’s Online Safety Act does not mandate a single method of age verification. The UK’s tech regulator Ofcom, which is in charge of policing the law, just requires companies to implement highly effective age assurances.

The law focuses on keeping under‑18s out of adult spaces but does not tell companies how to achieve this goal, leaving firms to choose their own verification systems as long as they are “highly effective.”

But failure to implement a system can result in financial penalties of up to 10 percent of a service’s qualifying worldwide revenue, or 18 million pounds ($23.9 million), whichever is greater. The Online Safety Act is a UK-specific law, but it affects U.S. and global companies with no legal presence in the country.

Dodging Online Age Verification

Downloads of virtual private network (VPN) apps have surged in the UK as users look for ways to dodge the Online Safety Act’s age verification rules.

VPN users establish a secure and encrypted connection over the internet. They effectively mask IP addresses and anonymize online presences, making it more difficult for websites, advertisers, and government agencies to track a user’s activities.

Users can sign up for a VPN, often free and with no age requirement, needing only an email address, and browse the internet as if they were in a country without such rules.

Vyazovoy said that many users are actively trying to avoid online age checks.

“We’ve seen that in real time, with UK VPN usage on AdGuard spiking since the law took effect,” he said.

UK website traffic for AdGuard, a VPN service, surged more than 60 percent, with visits from Android more than doubling, and iOS traffic nearly doubling.

Vyazovoy said that some users are even using video games to bypass security by capturing video game characters’ faces to access desired sites.

“We’ve already seen creative workarounds where users tricked Reddit’s and Discord’s systems using in-game characters like Sam Bridges from Death Stranding,” he said.

How Sites and Platforms Handle ‘Unverified’ Users

Platforms that cannot verify a user’s age are increasingly placing such users in restricted modes, which means that they cannot see content.

In a recent statement, free speech organization Free Speech Union said that one knock-on effect of the UK’s Online Safety Act is that it pushes companies to filter harmful material before it appears in users’ feeds if they don’t verify their age.

“Ofcom’s broader regulatory guidance warns that recommender systems can steer young users toward material they didn’t ask for,” it said. “In response, platforms may now be expected to reconfigure their algorithms to filter out entire categories of lawful expression before it reaches underage or unverified users.”

Free Speech Union said that X uses internal signals, including when an account was created, any prior verification, and behavioral data, to estimate a user’s age, and if that process fails to confirm the user is over 18, they are automatically placed into a sensitive content filtering mode.

This has caused content, such as asylum seeker hotel protests, to be inaccessible to many UK-based users. Users are now greeted with the message “Due to local laws, we are temporarily restricting access to this content until X estimates your age.”

Global Trend Toward Age Verification

The age of age verification didn’t start with the UK, but the Online Safety Act is the first large‑scale, unified national system and is likely to influence global norms.

Several countries, including Australia, France, Italy, and the wider European Union bloc, are also tightening rules on underage access to social media or online content by enforcing strict age verification.

In June, the U.S. Supreme Court upheld a Texas law that requires pornography websites to verify that visitors are at least 18.

The decision paves the way for other states to pass similar laws.

A More Regulated Internet

Some experts say the internet will feel more regulated in the next five years.

“[The internet] won’t look radically different from what it does right now,” Jackson said. “But certain areas will feel more regulated, just like other risky parts of our lives gradually became safer.”

Pippa King, children’s digital rights activist and campaigner of the Biometrics in Schools blog, said that the shift toward online age checks risks turning the internet into a de facto identification system.

“This isn’t just on children, is it? The companies have to ask everybody to make sure they’re not putting children on, so it’s not an age verification, it’s basically an identification system,” she told The Epoch Times.

“So there’s no … anonymity.”

Matthew Vadum contributed to this report.