Let’s talk about the woman who had to prove to a machine that she wasn’t fourteen — and couldn’t.
Over the past eighteen months, age checks stopped being a box you tick and became a face you show. The UK’s Online Safety Act pushed age assurance into everyday apps, the EU published its age-verification blueprint and its wallet-style age app, and a growing list of US states followed. The idea is simple, and honestly, it’s defensible: keep kids out of places kids shouldn’t be.
Then the reports came in.
A thirty-eight-year-old locked out of a messaging app because the model read her as thirteen. A sixteen-year-old cleared as an adult, no questions asked. A person with a beard, a cracked camera, and bad light stuck in a scan loop at two in the morning, being told by a company that has never met her to “move to a better-lit area.”
Here’s what people keep getting wrong. Age estimation is not a measurement. It’s a guess with a decimal point on it.
The model looks at a face and returns a probability — an eighty-something percent chance you’re over eighteen. Then a threshold does the deciding, and a person’s access to their own messages, or a forum, or a game hinges on where the vendor set that number. Nobody in the room can tell you why it landed there. You can’t appeal it, because there’s no claim to appeal. You just get a door that doesn’t open.
And the error doesn’t fall evenly. NIST’s facial recognition testing has documented for years that accuracy drops for women, for older faces, and for darker skin — sometimes by a wide margin, across many algorithms. So the gate is not neutral. In practice it’s a little stricter with some faces than others. That’s not a bug you patch next quarter. That’s the system working as built, on the population it was built for and the population it got pointed at.
Now watch where the failure actually ends, because this part nobody signed off on.
When the guess says no, the fallback is to prove it — upload a passport, a driver’s licence, sometimes a selfie holding the document. Which means the app that couldn’t tell you apart from a teenager now holds your ID, and often a matching face scan, sitting with a third-party age vendor you’ve never heard of, retained for some period, shared with someone. Your date of birth and your face, in one file, at a company whose entire business is checking whether strangers are old enough.
That’s the honeypot. That’s the thing that ends up in a breach disclosure, or a broker’s index, or both.
What people are missing is the inversion running underneath all of it.
For most of the internet’s life, the default was anonymous and verification was the edge case. That’s flipped. Now the normal thing is to be checked, and the unchecked person is the suspicious one. Being unable to prove your age became a kind of guilt — the same slide we’ve watched with unsigned email, with unstamped paper, with every credential that ever got normalised. The person who can’t prove themselves stops being rare and starts being flagged.
And that’s before you notice the shape of the fix. The gate is national. The internet isn’t. So we’re putting a border check on a road with no borders and calling it child safety.
So what’s the move. Two things, and they’re not complicated.
If you’re building anything in this space: prove the fact, lose the person. The system needs to know one bit — over or under. It does not need your face and your licence sitting on a disk to know it. Privacy-preserving age tokens exist. Proofs that assert “over eighteen” without shipping the date of birth or the image exist. The industry keeps shipping the light version because an ID upload is cheaper and it happens to build an asset nobody asked for. Don’t be that vendor.
If you’re on the other end — just a person trying to open an app — notice the difference between a gate that checks and forgets, and one that checks and keeps. Ask what happens to the document after you send it. Ask whether there’s a route through that doesn’t involve handing over the one thing that can be reassembled into you. And if there isn’t, that’s information about who designed the door.
The principle is plain. A system should be able to prove a fact about you and then forget you completely. Whether you’re old enough is a yes or a no. Everything beyond that isn’t verification. It’s collection wearing a safety badge.
You’re allowed to be thirteen, or thirty-eight, or a hundred and four, and still walk through a door that doesn’t need your whole face to open.
You’ve got this.