Executive Summary
Children and teenagers benefit from the many opportunities the Internet offers, but also face risks to their safety and well-being online.
Policymakers around the globe are responding with online safety legislation, including policies that require age checks for accessing certain apps or websites. While often well-intentioned, these policies create risks for people’s privacy, security, and access to an open Internet.
Effective age restrictions must mitigate these risks while ensuring safe, age-appropriate experiences. Strong protections and independent oversight are critical to prevent age check requirements from becoming entry points for data breaches, cybercrime, or personal data misuse.
Existing policies range from “vouching” confirmed by parents or trusted contacts like a teacher, to allowing online services to estimate age, or requiring people to provide a government ID. These checks can happen at different stages: during device setup, in app stores, on websites or apps, or through network operators. Though some laws impose strong privacy requirements on the handling of sensitive information, others require user identification and tracking.
Even the perception of a privacy intrusion can stop people from accessing age-restricted online services. For example, teens and parents are skeptical of using a web camera to scan their face. This method, known as facial age estimation, has become a common age check solution.
The current global patchwork of requirements also creates significant challenges for the open Internet. A lack of common standards leads to incompatible systems across borders, fragmented access to online services, and reduced trust in the Internet. Compliance can be complex and costly with some online services choosing to shut down or withdraw from countries with burdensome regulations.
Guiding Principles Overview
Protect People’s Privacy and Security
Age checks must protect people’s privacy and limit any data collection and sharing to guard against cyber attacks, online activity tracking, and personal data misuse.
Age checks must not identify or track people online.
- Independent oversight of age check providers for data minimization and data security law and best practices is essential to guard against misuse and guarantee accountability.
- Don’t require government ID or financial accounts to complete age checks.
- Limit what information is shared with online services to the user’s age or age range.
- Don’t allow age check providers to track which online services people are visiting.
Safety goals are undermined when privacy concerns cause people to seek risky workarounds.
- Privacy concerns carry risk regardless of whether the underlying technology is secure.
- People look for alternative, and often riskier, online services or seek circumvention tools when online age restrictions are implemented.
- Attempts to restrict workarounds like virtual private networks (VPNs) weaken legitimate security tools used by people and businesses to secure their network connections.
Ensure Accessibility
People should be able to complete age checks regardless of their personal circumstances, computer skills, device, or Internet connection.
- People must have multiple choices for how they can provide their age or age range.
- Age check options should account for technical barriers such as a slow Internet connection, shared or older devices, or lack of access to a working web camera.
- Age check technologies should be evaluated for accessibility.
Protect Open and Global Online Participation
People should be able to easily complete age checks from any location and with trust that their data and privacy are protected.
- Age check technologies should be interoperable and available for use across jurisdictions with security protections built into the underlying protocols by default.
- Government ID and financial accounts should never be the only permitted age checks because these are not available to everyone in a country or region, such as tourists or refugees.
- Age check technologies must not be used to identify and track people’s online activity or location.
Key Considerations
Types of Age Checks
There are many age check methods, but all have tradeoffs with reliability, ease of access, privacy, and security. The three age check categories are outlined below and collectively known as “age assurance.”
- Age Verification: Requiring authenticated sources like a government ID or verified financial account generally provides higher accuracy with higher security risks and barriers to access.
- Age Estimation: Face-scanning technology and analysis of user activity are common age estimation methods with varying accuracy and challenges for privacy and ease of access.
- Self-Declaration: User-reported age checks are easily accessible with minor privacy and security risks, but accuracy is lower with people easily able to provide false information.
Although age check technologies are evolving, this does not mean they are all safe, secure, or effective. Each age check category and technique has tradeoffs. These may vary across countries, cultures, and backgrounds with different perceptions of privacy, free expression, and access to technology.
Implementing Age Checks
Age checks can be implemented at the device, operating system, app store, online service, or network level. There is no single best method. All have privacy and security risks and tradeoffs with accuracy and ease of access.
Online services often use third-party age verification providers. It can be difficult for people to tell which companies are trustworthy, especially if there is no independent oversight. Any online service is vulnerable to breaches, and some services may use provided data for commercial purposes.
Challenges
Online age restrictions can improve safety for young people, but they fail when they create new privacy risks or block access to lawful content and services. Policymakers must prioritize secure technical standards and future-proof regulations to protect people while enabling safe, open access to the Internet.
Key Risks
Young people should not be blocked from accessing positive online experiences, and adults should not be cut off from services because they are concerned about their privacy or cannot complete age verification processes.
- People are more exposed to cybersecurity risks: Collecting more sensitive data and documents increases the risk of data breaches, enables criminals to exploit frequent age checks for phishing attacks, and allows governments or age check providers to track people online.
- Privacy fears drive people to less safe tools and services: People who are unwilling to complete checks are cut off from services they want to access, look for workarounds, or go to less trustworthy services that don’t comply with age check requirements.
- People are cut off from accessing online services: These laws can make it more difficult for older and more vulnerable populations to access online services, and can splinter a global Internet with varying minimum ages and age check requirements.
- Practical and technical limitations: Age estimation has improved but remains unreliable with face scans often off by two years. Effectiveness is further limited on older and shared devices or open-source operating systems.
- Cultural, social, and developmental differences: Cultural expectations across borders, or even within the same region, vary for age-appropriate content and services. Young people also have different levels of maturity, even if they are the same age. Restrictions should not impact an open and global Internet for everyone.
Key Benefits
Age checks can help protect minors online by restricting access to harmful services, strengthening safeguards on social platforms, and tailoring protections by age and service type.
- Limit access to regulated services: Age checks can help block access to illegal or inappropriate online services for minors, such as gambling, dating, or pornography.
- Provide safer, age-appropriate experiences: Online services can limit who can contact or connect with younger users, block or blur potentially harmful messages, curate content, and increase default privacy protections.
- Risk-based online safety: Online services with the most immediate and high risks, like gambling or dating services, may require more detailed checks while social media or gaming services can use more proportionate age check measures.
Guiding Principles and Recommendations
Protect People’s Privacy and Security
The more sensitive personal information that people are required to provide, such as government IDs or biometric data, the greater the security and privacy risks from scams and weak privacy practices.
Data Breaches and Cyber Attacks: No service is immune from data breaches, with risks increased when people provide an ID or services use other sensitive data. Criminals also spoof age check requirements to steal people’s government identification or other sensitive information in phishing attacks.
Privacy Fears: People are concerned about requirements to show their face on camera or provide sensitive information that could be linked to their identity. They are blocked from accessing services they want to use or seek risky alternatives or workarounds due to those concerns.
Data Privacy: Failure to minimize data collection can violate existing data privacy laws and conflicts with privacy principles to only use necessary data for as long as needed. Bad actors collect or sell sensitive information for profit or criminal purposes, especially when there are no privacy laws.
No Fully Privacy-Preserving Approach: There is no fully privacy-preserving age verification method. Age checks should confirm a user’s age without revealing their actual identity or age, known as “double blind” authentication, to improve privacy. Zero-knowledge proofs provide a technical solution to this privacy-preserving approach, but the technology is still under development and not widely deployed.
Recommendations
- Age assurance providers must comply with data minimization and data security law and best practices. Independent oversight is essential to guard against data misuse and guarantee accountability.
- Data should only be shared when online services have a valid reason to check user age.
- Only the age or age range of a user should be shared with online services.
- No personally identifiable data should be stored to comply with age restriction policies.
- Age check providers should not be able to track your online activity.
Ensure Accessibility for All Users
Everyone should be able to complete age checks, regardless of location, socioeconomic status, or personal circumstances. This includes people using older devices, without access to a government ID or financial account, or who use assistive technologies.
Disproportionate Impact: Some age check tools are less accurate or inaccessible due to race, disability, age, or other characteristics. Not everyone has access to a government ID, good lighting, a web camera, or the technical knowledge to complete an age check process.
Technical Barriers and Limitations: Frequent age checks will slow connections and facial age estimation has technical barriers by requiring a working web camera and from being less accurate at estimating some ethnicities and ages than others. Facial age estimation has improved in recent years but is an average of about two years off.
Challenge for Older Adults: Older adults may be wrongly flagged or unable to complete age checks while teenagers are often misidentified as being adults or can more easily find workarounds. Conditions like cataracts, stroke, or other ailments may prevent older adults from completing age checks.
People with Disabilities: Many age check methods don’t account for people with disabilities, making it difficult to complete age checks or access. People unable to drive may not have ID, some disabilities make people look younger, and assistive technology complicates any age check process.
Recommendations
- Age check methods must be evaluated for accessibility.
- People must have a variety of options to complete mandatory age checks.
- Age, disability, race, and other characteristics must not affect a person’s ability to complete an age check or its accuracy.
- Limit the frequency of age checks to improve usability, especially when Internet connections are slow or unreliable.
Protect Open and Global Online Participation
People must be able to easily complete age checks regardless of where they are connecting to the Internet. Affected online services, minimum ages, and requirements for age checks vary across borders. This patchwork of age-restriction rules fragments and splinters people across a global Internet.
Internet Fragmentation: People living in different jurisdictions have increasingly different experiences on the Internet. Age gates and varying access to online services further splinters the Internet.
Regional Requirements: Requirements for government IDs and financial accounts are often unavailable to people outside of a certain region who are traveling or marginalized communities who are unable to attain those credentials, like refugees.
Varying Internet Connections and Devices: Technology limitations in some regions make it difficult to rely on checks that use web cameras, like face scans, or otherwise require a modern device or strong Internet connection.
Impede Online Security Tools: People try to find ways around age checks when laws go into effect. Lawmakers are considering banning tools like virtual private networks (VPNs) that can help people circumvent restrictions but are relied on by journalists, human rights activists, and global companies and regular people to protect against government censorship and security vulnerabilities.
Recommendations
- Age check requirements should be guided by global standards for user-friendly design, reliable verification, and strong default security protections including encryption.
- Age check technologies must be interoperable across jurisdictions to uphold the principle of an open and global Internet accessible to everyone, everywhere.
- Acceptable age checks must be globally accessible in terms of hardware, Internet connection, and access to an ID or financial account for travelers and across regions.
Additional Resources
Internet Society. Texas’ Mandatory Age Verification Law Will Weaken Privacy and Security on the Internet. (September 2024) https://www.internetsociety.org/blog/2024/09/texas-mandatory-age-verification-law-will-weaken-privacy-and-security-on-the-internet
The Center for Growth and Opportunity. Keeping Kids Safe Online: How Should Policymakers Approach Age Verification? (June 2023) https://www.thecgo.org/research/keeping-kids-safe-online-how-should-policymakers-approach-age-verification
Digital Trust and Safety Partnership. Age Assurance: Guiding Principles and Best Practices. (September 2023) https://dtspartnership.org/wp-content/uploads/2023/09/DTSP_Age-Assurance-Best-Practices.pdf
European Data Protection Board. Statement on Age Verification. (February 2025) https://www.edpb.europa.eu/our-work-tools/our-documents/statements/statement-12025-age-assurance_en
Forland, Sarah. Exploring Privacy-Preserving Age Verification: A Close Look at Zero-Knowledge Proofs. New America (July 17, 2025) https://www.newamerica.org/oti/briefs/exploring-privacy-preserving-age-verification
Forland, Sarah, Nat Meysenburg, Erika Solis. Age Verification: The Complicated Effort to Protect Youth Online. New America. (April 2024) https://www.newamerica.org/oti/reports/age-verification-the-complicated-effort-to-protect-youth-online/age-assurance-and-age-verification
ICO. Age assurance – estimating or verifying the age of service users. https://ico.org.uk/for-organisations/uk-gdpr-guidance-and-resources/childrens-information/childrens-code-guidance-and-resources/how-to-use-our-guidance-for-standard-one-best-interests-of-the-child/best-interests-framework/age-assurance
Lang, David, Benjamin Listyg, Brennah V. Ross, Anna V. Musquera, and Zeve Sanderson. Do Age-Verification Bills Change Search Behavior? A Pre-Registered Synthetic Control Multiverse. (March 2025). https://osf.io/z83ev
OECD. The legal and policy landscape of age assurance online for child safety and well-being. (June 2025) https://www.oecd.org/en/publications/the-legal-and-policy-landscape-of-age-assurance-online-for-child-safety-and-well-being_4a1878aa-en.html
World Economic Forum. The Intervention Journey: A Roadmap to Effective Digital Safety Measures. (March 2025) https://www.weforum.org/publications/the-intervention-journey-a-roadmap-to-effective-digital-safety-measures
