Online Age Verification: How It Works and How to Protect Your Privacy

What Is Online Age Verification?

Online age verification is any check a website or app uses to confirm that a user is old enough. Regulators often use the wider term age assurance, which covers two kinds of checks:

• Age verification confirms your age from evidence, such as a passport, a bank account or a credit card.
• Age estimation guesses your age from other signals, most often a selfie analyzed by software.

Simply ticking a box that says “I’m over 18” is called self-declaration. In the UK, it no longer counts as an age check for adult content.

Age checks are spreading fast. On October 29, 2026, the UK regulator Ofcom told the government which methods are good enough to check that someone is at least 16, in preparation for the UK’s planned social media ban for under-16s. It named four: a selfie matched to a government ID, bank account checks, reusable digital ID services, and facial age estimation.

Where Age Checks Are Now Required

The rules differ by country, but the direction is the same everywhere: more checks, on more types of sites.

United Kingdom. Under the Online Safety Act, porn sites have had to check ages since January 2025. Since July 25, 2025, the rule also covers social media and other services that allow pornography or other content harmful to children. Reddit, Bluesky, Spotify, Discord and Xbox are among the services that introduced age checks for UK users. The government plans to ban social media for under-16s from spring 2027.

European Union. The Digital Services Act requires online platforms to protect minors. In April 2026, the European Commission recommended that every member state make an EU age verification app available by the end of 2026. The app can work on its own or inside the European Digital Identity Wallet.

Australia. Since December 10, 2025, social media platforms must take reasonable steps to keep under-16s off their services. In the first half of December 2025, platforms removed or restricted about 4.7 million accounts.

United States. As of October 2026, 27 states require adult websites to verify visitors’ ages. The Supreme Court upheld Texas’s law on June 27, 2025. Several states also require app stores to check ages and get parental consent for minors: Texas (enforceable while court challenges continue; the Supreme Court declined to block it in July 2026), Alabama (from January 1, 2027), Utah (from May 6, 2027) and Louisiana (from July 1, 2027). California takes a different approach: from January 1, 2027, operating systems must ask for a user’s age when an account is set up and pass an age range to apps, with no ID required.

Latest developments (updated October 31, 2026)

• October 29, 2026: Ofcom names four methods as highly effective for checking that a user is 16 or older, for the UK’s planned under-16 social media ban.
• Late September 2026: a federal court blocks the VPN provisions of Utah’s age verification law (see chapter 7).
• July 2026: the US Supreme Court lets Texas enforce its app store age verification law while challenges continue.
• Coming up: the EU age verification app in every member state (end of 2026); California’s device age signal and Alabama’s app store law (January 1, 2027); the UK’s under-16 social media ban (spring 2027); Utah’s (May 2027) and Louisiana’s (July 2027) app store laws.

The Methods, and What Each One Reveals About You

Not all age checks are equal. Some only reveal that you’re over a certain age; others hand over your full identity.

• Photo ID with a selfie: you upload a passport, ID card or driver’s license and a selfie, and software checks that the faces match. This reveals the most: your name, date of birth, photo, document number and, on many driver’s licenses, your home address.
• Facial age estimation: software estimates your age from a selfie. You don’t need to give your name, but your face is processed, so it matters what happens to the image afterwards.
• Credit card check: the provider checks that you hold a valid credit card, since in most countries only adults can open a credit card account. Debit cards don’t count, because children can have them.
• Bank check (open banking): you log in to your bank through the provider, and the bank confirms that the account holder is an adult.
• Mobile operator check: your mobile network confirms whether your phone number belongs to an adult. You share your phone number.
• Email-based age estimation: the provider looks at where your email address has been used, for example with banks or utility companies, to estimate your age.
• Digital ID and age verification apps: you verify your age once in an app, then share only a confirmation, such as “over 18,” with each site.
• Device or app store age signals: your phone or app store tells apps which age range you’re in, based on your account settings. California’s law and the US app store laws work this way.
• Age inference: a platform guesses your age from data it already has, such as your activity. Ofcom says this isn’t enough on its own.

For checks that a user is 18 or older, Ofcom lists seven methods as capable of being highly effective: credit card checks, digital ID services, email-based age estimation, facial age estimation, mobile operator checks, open banking and photo ID matching. For checking that someone is 16 or older, only four qualify: photo ID matched to a selfie, bank account checks, reusable digital ID services and facial age estimation.

The Privacy Risks of Age Verification

Data breaches. Every database of IDs and selfies is a target. In October 2025, Discord said about 70,000 users’ government ID images had been exposed through a breach at a third-party customer service provider. The users had sent the images to verify their age. In July 2025, hackers leaked 72,000 images from the dating safety app Tea, including about 13,000 selfies and photo IDs that users had submitted to verify their accounts.

Your identity linked to what you do online. An ID-based check ties your real name to a visit to a specific site or type of content. For adult sites, or sites about health, sexuality or religion, that link can be sensitive in itself.

Outside companies. The check is often run by a specialist age verification company, not by the site you’re visiting. You have to trust both: the site and the company that sees your documents.

Data used for other purposes. Data collected to check your age can, in principle, be kept longer or used for other things, such as fraud prevention or marketing. The privacy notice should say what happens to it.

Scams. New rules create new excuses for scammers. When Australia’s under-16 rules started, the government’s Scamwatch service warned that scammers were posing as platforms, age verification providers and even government agencies, asking people for proof of age or payment. Legitimate platforms don’t charge for age checks.

Age Checks That Reveal Less

Age checks don’t have to expose your identity. Several approaches are designed to share as little as possible:

• Yes/no proofs: the EU age verification app lets you prove that you meet an age threshold without revealing your exact age, your identity or any other personal details.
• Zero-knowledge proofs: this cryptographic technique lets you prove a fact about yourself, such as being over 18, without sharing anything else. Google released its zero-knowledge proof code as open source in July 2025, in part to support age checks with the European Digital Identity Wallet.
• Reusable digital IDs: you verify your identity once with an app, then share only your age, not your documents, with each site.
• Device-level signals: under California’s law, apps receive only an age range from your phone or computer. You don’t upload anything, though this also makes the check easier to get around, since the age is self-declared.
• Estimation without identity: facial age estimation doesn’t need your name. If the image is deleted right after the estimate, very little is left behind.

How to Protect Your Privacy When a Site Asks for Your Age

You can’t always avoid age checks, but you can control a lot of what you hand over.

Choose the method that reveals the least. If a site offers several options, prefer a digital ID or yes/no proof, or facial age estimation, over uploading an ID document. A credit card, bank or mobile operator check is usually a middle ground.

Check who runs the check. The verification page often belongs to an outside company. Look for its name, read its privacy notice, and check how long it keeps your data, whether it deletes images after the check, and what it passes back to the site. Ideally, the site should get only a “pass” or “fail.”

Only verify through the real site or app. Open the service yourself instead of clicking a link in an email or text message that asks you to “verify your age.” Legitimate platforms don’t ask for payment to verify your age.

Never send ID documents by email or support chat. Documents sent to customer support can end up with support contractors: the Discord images were exposed through a breach at a customer service provider.

If you must upload an ID, pick the one that shows the least. For example, a passport doesn’t show your home address, while many driver’s licenses do.

Use your data rights. In the EU and the UK, the GDPR lets you ask a company what data it holds about you and to delete data it no longer needs. California residents have similar rights under the CCPA. You can send these requests to the age verification provider as well as to the site.

Be ready if a provider is breached. If a company that holds your ID is breached, expect targeted phishing, and consider extra protection, such as a credit freeze in the US. Read more about the privacy trade-offs of biometric authentication and facial recognition technology.

Can a VPN Get Around Age Checks, and Is It Legal?

Many services decide which country’s rules apply based on where you appear to be, usually from your IP address. A VPN replaces your IP address with one from another location, which is why VPN sign-ups jumped when the UK’s age checks started: Proton VPN reported an increase of more than 1,400% in UK sign-ups.

Using a VPN is legal in the UK, the EU, the US and Australia (see are VPNs legal?). The age verification laws place their duties on platforms, not on users. Ofcom has said that platforms must not host or share content that encourages people to use VPNs to get around age checks. Using a VPN to appear to be in another country can also break a service’s terms of service, and some services check other signals, such as your account details or payment country.

Lawmakers have tried to close the gap. Utah’s age verification law would have required adult sites to treat users physically in Utah as Utah users even when they use a VPN. In late September 2026, a federal court blocked those provisions, finding that they demand perfect geolocation, which isn’t currently possible.

How common is it? According to Ofcom’s data, about 30% of 11- to 17-year-olds had seen content they were supposed to be blocked from in the previous six months, and only 12% of them had used a VPN.

Keep in mind what a VPN doesn’t do: if you go through an age check, the provider still receives whatever you submit. A VPN hides your IP address from the sites you visit, but it doesn’t make you anonymous.

Summary

Online age verification is here to stay. The UK, Australia, the EU and more than half of US states now require some form of it, and app stores and operating systems are next. The methods range from privacy-friendly yes/no proofs to full ID uploads that reveal your name and address.

To protect your privacy, choose the method that reveals the least, find out which company runs the check and what it keeps, verify only through the real service, never send ID documents by email or chat, and use your data rights to see and delete what’s stored.