AI age checks: Is this new surveillance method friend or foe?

How do AI age checks work?

AI age assurance is an umbrella term encompassing several techniques that establish a user's age with varying degrees of confidence. Organizations can use different methods to establish someone's age, such as AI-powered age estimation from biometric signals, behavioral analysis of the user's activities, third-party verification against trusted records and requests for government-issued IDs.

Age estimation predicts a person's age from certain signals. In contrast, age verification confirms someone's age against an authoritative source, such as an ID document or a trusted database. The UK Information Commissioner's Office describes age assurance as techniques including AI and biometric-based systems, technical design measures, tokenized age checks using third-party services and hard identifiers such as passports and driver's licenses.

One approach for AI age estimation is to use visual and biometric information. This includes analyzing facial characteristics, photos and videos. This estimate is based on available signals and can't provide a completely accurate result. Facial age estimation is the most widely deployed technology, evaluating facial features to predict user age. The process entails using a machine learning model trained on a large data set of facial images with known ages, enabling the system to learn the facial patterns of different age groups. While age estimation can make predictions without requiring knowledge of a user's identity, facial recognition identifies a user by comparing their biometric data against an existing record. Some verification systems combine both approaches.

Voice-based age estimation is also currently gaining attention. An article published by ScienceAdvances titled "Speech clocks decode dementia phenotypes, social exposome, and biological aging" found that it's possible to estimate someone's age by analyzing their linguistic characteristics, like speech rate, pauses, pitch, emotional tone, vocabulary and semantic precision.

AI can also verify age by making inferences from behavioral and contextual signals. Meta analyzes users' profiles for age clues across posts, comments, bios and captions, searching for indicators that reveal someone's age. These include direct clues, such as birthday messages or mentions of users' graduations or the start of school. Meta can also analyze a user's writing style, trace the pages they follow and people they interact with and analyze the age ranges of their friends and followers.

A more direct approach to age verification is to request a government-issued document. The process works by uploading a government ID, such as a passport, checking whether the document is genuine, reading the date of birth and confirming the face on the ID to a live selfie. This method is more accurate than using an AI model to estimate age from appearance, but it also requires users to share more sensitive information. This is the tradeoff that comes with more reliable verification.

The final approach is using a third-party service to verify age. Rather than relying on AI-based systems or requesting users to upload official documents, this method verifies age by fetching existing records about the user from trusted sources, such as government databases and telecom and utility records. Users enter their personal information, such as name, date of birth, phone number or address. The system compares it with information available in trusted records and verifies the data.

The limitations of AI age checks

Although AI age verification systems can help platforms identify underage users, they still face technical limitations. The technology can produce errors that negatively affect the user's experience rather than protecting them.

AI age checks can be inefficient

The accuracy of AI age checks depends on the type and quality of information available to them. AI can examine facial characteristics in images and videos, check profile information and bios and analyze user behavior. However, these indicators might not provide a reliable assessment of someone's actual age. An adult might use language linked to teenagers. At the same time, a minor might present as an adult by discussing certain sports or using language common among older users.

False positives and false negatives

Another problem with AI age checks is the possibility of incorrect classifications. A false positive occurs when the system classifies an adult as a minor, while a false negative occurs when it classifies a minor as an adult. Both results can negatively affect the platform and users.  

If one of these systems labels an adult as a minor, the platform might ask them to provide additional details to verify their age, typically by uploading their government-issued photo ID to restore access to their account. Individuals who are uncomfortable sharing such sensitive information could choose to leave the service altogether. On the other hand, if a minor is mistakenly identified as an adult, they could access content or services that the platform intended to block for their age group.

Age checks can't guarantee online safety

Even if a platform's age-verification system works perfectly, it can't guarantee it will eliminate all the risks children face online. Blocking minors from certain platforms or services doesn't automatically protect them from threats like cyberbullying, grooming or contact with dangerous users.

There are also ways for users to circumvent age restrictions, as seen in Australia. In 2024, Australia passed the Social Media Minimum Age Act, with restrictions taking effect in December 2025. The law requires particular social platforms to prevent Australian users under 16 from having accounts. But after the law took effect, a 2026 BMJ survey of 436 adolescents aged 12 to 16, "Assessing early effects of Australia's Social Media Minimum Age Act on adolescents' social media use: observational study," found that over 85% of participants reported continuing to use social media platforms covered by the law using different methods such as giving false information, uploading a parent's photo to pass facial age estimation, using someone else's account or simply lying about their birth date.

The privacy risks of AI age checks

Although AI age verification lets organizations identify underage users to prevent them from accessing certain content, the way organizations collect and process users' personal data to verify their age raises numerous privacy questions. Depending on the method used, verifying someone's age might require collecting personal information beyond just their age group.

User profiling

One of the main concerns of using AI age verification technology is that it can extend beyond simply determining someone's age. Meta's age-assurance technology needs to scan users' profiles for contextual clues about their age. While this can help identify underage users, it can also enable these platforms to examine users' activities and personal information.

This concern is not limited to AI-based analysis. When a platform requests that a user upload a government-issued ID, provide facial images or use third-party verification services, the user must disclose sensitive information. When TikTok asks a user to upload a government-issued ID along with a selfie holding it and then processes this information via a third-party service, the platform gains access to highly sensitive information. The platform or third-party service could also retain the information users submit to confirm their age. Should someone who wants access to a website have to provide the same ID information that they would present to a government agency or a bank?

Sensitive data collection

Collecting personal information from users poses security risks. When a platform collects facial images and identity documents, such data is likely to attract cybercriminals. If age verification systems store large amounts of such information, a data breach could expose it, leading to identity theft or fraud.

Biometric information is particularly sensitive. Unlike passwords, which can be changed if compromised, a person's biometric data reflects their physical characteristics and cannot be easily changed, making it a more lucrative target for cybercriminals. Organizations must therefore consider how this information is protected, who can access it, whether it can be shared with third-party processors and how long they should keep it.

The normalization of digital surveillance

AI age checks could also normalize identity checks across digital platforms. If users get used to sharing their biometric information, government documents or behavioral data to access online services, these access requirements could extend to other activities and online services. A user who first uploads their passport to verify their age on a dating application might later agree to use the same verification requirement to access a gaming platform.

This doesn't mean that every age-verification system creates surveillance concerns. The risks depend on how each organization implements the technology, what information it collects and how they use it. A verification system that uses a mobile phone operator to confirm a user's age without requesting a date of birth, name or account details is safer than one that requires a passport upload and a selfie.

Safer alternatives to AI age checks

There are other ways to protect children online besides AI age checks. Organizations should implement additional approaches that prioritize protecting users' personal information while still helping them enforce age restrictions.

Privacy-preserving age verification approach

The best alternative to AI age checks is a system that confirms someone's age without requiring them to share their identity or other unnecessary personal information. Instead of revealing a user's full name, date of birth, facial image and identity document, a platform would receive a confirmation message that the user meets the required age threshold.

The European Commission developed a method for this approach in 2026. Users can confirm their age using a supported identity document, such as an ID, passport or a trusted third-party app and then use the resulting cryptographic proof of age to demonstrate that they meet the age requirements without disclosing their personal details to the platform. The commission developed this "mini wallet" as a standalone age verification application.

Anonymous age assurance

Another approach is to isolate user identity from age verification. A third-party service can verify a user's age and issue a digital credential confirming they meet a specific age requirement, such as being over 18. The participating platform can then check this credential and make its access decision without receiving the user's identity information through the age check.

A good example of this approach is the OpenAge initiative, which develops AgeKey, a cryptographic age-assurance tool that creates reusable, privacy-preserving age credentials without tracking a user's identity. According to OpenAge, its system doesn't collect or store users' personal information. Instead, it uses information about age or age range. However, the initial verification provider might still need to process personal information to determine the user's age, and overall privacy protection depends on how the system is implemented.

Nihad A. Hassan is an independent cybersecurity consultant, digital forensics and cyber OSINT expert, online blogger and author with more than 15 years of experience in information security research. He has authored six books and numerous articles on information security. Nihad is highly involved in security training, education and motivation.