The Age-Checked Internet Has Arrived

Beginning today, millions of adults trying to access pornography in the United Kingdom will be required to prove that they are over the age of 18. Under sweeping new online child safety laws coming into force, self-reporting checkboxes that allow anyone to claim adulthood on porn websites will be replaced by age-estimating face scans, ID document uploads, credit card checks, and more. Some of the biggest porn websites—including Pornhub and YouPorn—have said that they will comply with the new rules. And social media sites like BlueSky, Reddit, Discord, Grindr, and X are introducing UK age checks to block children from seeing harmful content.

Ultimately, though, it's not just Brits who will see such changes. Around the world, a new wave of child protection laws are forcing a profound shift that could normalize rigorous age checks broadly across the web. Some of the measures are designed to specifically block minors from accessing adult material, while others are meant to stop children from using social media platforms or accessing harmful content. In the UK, age checks are now required by websites and apps that host porn, self-harm, suicide, and eating disorder content.

Protecting children online is a consequential and urgent issue, but privacy and human rights advocates have long warned that, while they may be well-intentioned, age checks introduce a range of speech and surveillance issues that could ultimately snowball online.

“Age verification impedes people’s ability to anonymously access information online,” says Riana Pfefferkorn, a policy researcher at Stanford University. “That includes information that adults have every right to access but might not want anyone else knowing they’re consuming—such as pornography—as well as information that kids want to access but that for political reasons gets deemed inappropriate for them, such as accurate information about sex, reproductive health information, and LGBTQ content.”

Efforts that have been mounting over the past decade to introduce strong age checks online have recently gained traction. Last month, the United States Supreme Court paved the way for states to require porn websites to check that visitors are at least 18 using age-verification technologies. Pornhub, for example, has already blocked access to visitors in at least 20 states as laws have been passed. Meanwhile, courts in France ruled last week that porn sites can check users' ages. Ireland implemented age checking laws for video websites this week. The European Commission is testing an age-verification app. And in December, Australia’s strict social media ban for children under 16 will take effect, introducing checks for social media and people logged in to search engines.

“If people choose not to log on [to search engines] to avoid age assurance checks, this could have a wide-reaching impact on the streamlined, integrated ways people search for online information,” says Lisa Given, a professor of information sciences at RMIT University in Australia who has been closely following the country’s age-checking policies. “It will also affect the level of privacy people have come to expect from being able to search freely online, which may change how and where they search for information.”

Though the recent wave of court decisions and legislation around age verification is new, multiple online platforms and services have required some form of age checking for years. The British age-verification company Yoti, which works on multiple digital identity technologies including face scanning to estimate ages, says it has done more than 850 million age checks and completes more than 1 million per day. “Brands around the world in different sectors are using this technology, including social media, gaming, adult, dating, retail, and vaping,” a Yoti spokesperson told WIRED in an email.

Age-verification mechanisms come in multiple forms. The UK’s Online Safety Act, which is being overseen by communications regulator Ofcom, lists seven “highly effective” approaches that websites can use. Typically websites will employ third-party companies from the growing age-assurance industry rather than checking ages directly themselves.

Standard age verification is done by uploading a form of government identification and a selfie, using a digital identity service, or submitting credit records or other financial documentation. There are also age estimation services. For example, “email-based” age estimation, according to the UK’s Ofcom, will analyze data on where your email address has been used and for how long as part of a calculation of how old you are. Age estimation services that try to predict someone’s age from a selfie or a video are also increasingly common. Their performance varies, though, depending on how accurate the underlying algorithms are. Many systems offer accuracy of “plus or minus 18 months.” Some physical stores in France that sell tobacco already use facial estimation systems as well.

There are potential privacy and security risks that come with all the approaches, though, such as excessive data gathering, government surveillance, and the threat of data breaches. And opponents of age verification argue that the technologies are not reliable and can be circumvented. Last year, for example, an Israeli ID-verification company exposed driver's licenses and other sensitive data because of a technical oversight. A study commissioned by Green politicians in Europe last year concluded that, while there were some “promising” privacy-preserving methods for age checks, there is ultimately “misalignment between the urgency with which governments are pushing for age assurance and the time needed to develop robust, safe, and trustworthy age assurance technology.” Preliminary results released in June from a study in Australia found multiple problems with age-checking systems.

“The question isn't whether there will be a data breach connected to age verification, it's when,” says Alison Boden, executive director of Free Speech Coalition, a US-based adult entertainment industry trade association. “So, people circumvent the laws. In the best case, they use VPNs to protect their identities. And in the worst case, they turn to websites that flout the law, and then risk being exposed to illegal content like child sexual abuse material and nonconsensual intimate imagery. And this is all in service of policies that have clearly been shown to be ineffective.”

In general, many porn sites and other adult content platforms say that they are in favor of age checks but don’t agree with current approaches.

Proponents of age verification say that it is possible to minimize data collection. Third-party providers can limit the personal information that is shared with individual sites conducting age verification. And, particularly, these third parties can use what are known as authentication tokens, so people can confirm their age once and then produce this credential across multiple sites and providers as verification.

“Our members do over a billion anonymized age checks a year, so our best argument is our track record—and we know that will just continue to improve because of the strict application of data minimization principles,” says Iain Corby, the executive director of the industry group Age Verification Providers Association. “There is no need to retain any personal data after an age check is completed, and if you don’t keep data, it can’t be lost or stolen.”

The practical realities of widespread age verification are messy, though. For one thing, sites and services may not comply with regulations. Ofcom, the UK regulator, says that it may issue fines to websites that do not put age checks in place. It already has 11 investigations open. Additionally, not all people have the proper ID or other documents to prove their age when signing up for sites.

“No solution to this is perfect,” says Rachel Coldicutt, the executive director of Careful Industries and a former Ofcom nonexecutive director. “Age verification assumes that all services and platforms that host harmful content are good and lawful actors and that devices don’t get shared. In lots of families, someone aged under 16 or 18 would easily be able to log in to a device that belongs to one of their parents, so unless age verification is required on every login to a site or app it would be quite easy to get access to age-restricted content by using an adult’s device.”

In general, too, many experts note that age verification is broadly unpopular. People feel uncomfortable scanning their face or handing over personal details to view content or participate in online discourse, especially when they are trying to use a service or view content that is intimate or otherwise personal in nature. As a result, age verification can have a chilling effect on speech and the free flow of information online.

And since people can use circumvention tools like VPNs to skirt national laws, there are limits to how effective these policies can be in isolation, which has the potential to tip off a sort of validation and surveillance arms race. There is often a spike in VPN interest when a country introduces new age-check laws.

“A critical point is that while these measures are intended to keep children safe from harmful content, my concern is that these measures will give parents and other members of the public a false sense of security,” says Given, the Australian academic. She adds that there should be greater government investment in education for young people, parents, and teachers about potential online harms, plus more support for people who use social media to access critical information.

As Stanford’s Pfefferkorn puts it, “Ultimately, age verification tech actually poses a risk to the kids it is supposed to protect. It chills their ability to access information, and it can put them at risk of privacy violations, identity theft, and other security issues.”