Age assurance reshapes the internet as platform accountability gains ground

The internet is now old enough that it is subject to the curse of nostalgia: online, things just aren’t like they used to be. A new report from Freedom House observes “seismic shifts on the global internet,” one of which is how online safety regulations have driven adoption of age assurance technologies like facial age estimation and biometric age verification.

“The shape of the internet is changing, as governments across the ideological spectrum erect new barriers to how people access information and express themselves online,” it says. “Global internet freedom declined for the 16th consecutive year amid these significant shifts.” While the report notes efforts by authorities in Iran and Russia to cut connections to the global internet over the past year, and declines in online freedom in Jordan and Nigeria, the data is somewhat skewed, in that it includes, among the factors curtailing internet freedom, “new measures to age-gate access to social media platforms.” “Age assurance is reshaping the internet, as laws mandating age checks for social media use take effect around the world,” the report says.

“Policymakers have pursued these measures at full speed since Australia’s under-16 social media ban, the first in the world, took effect in December 2025. As the laws entered into force, people encountered new barriers to online content and new risks to privacy and security.” It also claims that “the world’s repressive leaders have already sought to leverage so-called age-gating mandates for their own ends, such as invasive online surveillance.” Freedom House puts age checks in wider internet freedom debate Freedom House, then, places age assurance regulations alongside threats to internet freedom including government-imposed internet blackouts in Iran and restrictions imposed by authoritarian governments in Russia and China.

Its argument that age checks have already been used to tighten repression rests on theoretical examples in Türkiye and China – both governments with long histories of strict rule and dubious civil rights records. In the end, there is nothing unreasonable in the statement that “the speedy adoption of age-assurance social media bans represents the most significant live experiment in internet regulation in years, and the consequences for internet freedom demand due consideration.” This is correct.

Where the paper errs is in following up with the assertion that “the current state of age-inference and age-verification technology, for example, cannot mitigate the privacy and security risks introduced by their large-scale use; further technical research is needed to advance age-assurance methods that are truly privacy-preserving.” There is certainly continued development of privacy-preserving age assurance models – but the claim that two radically different types of age checks pose the same privacy risks ignores both categorical subtleties in age assurance technology and the established network of age assurance providers already operating at scale in jurisdictions like the UK and Australia, in compliance with international standards.

Australia example held up as failure, but model is evolving Of the latter, the report highlights the problem of circumvention , citing “early surveys and news reports” indicating that teens have “evaded the ban at significant rates, sometimes by manipulating age-estimation and age-verification algorithms.” “Children have evaded age-assurance mechanisms at considerable scale, remaining connected to social media platforms that are still rife with problems of the digital age,” it says.

“A rights-respecting pursuit of child safety requires action by policymakers and the private sector to resolve the long-standing problems of the social internet.” In this, it shows alignment with the plotted course of online safety regulation worldwide. Regulators in Australia are well aware that their age assurance law is under intense scrutiny, and while the eSafety Commissioner has been clear that the true results of the project will only emerge over the long term, the government has moved steadily toward a duty of care model that places broader legal obligations on platforms, rather than relying solely on age gating.

This, in turn, aligns with the shift toward an “age appropriate” or “ age adaptive ” model, in which a platform’s content and function are tailored to a user’s confirmed age band or verified age. On a high level, the online safety debate is moving from restricted access to design changes that eliminate some of the problems social media has created.

To hold social media companies to account, governments will need robust legal mechanisms: this is the function of the digital duty of care model, which, in some proposals, includes personal legal consequences for company executives. Fragmentation erodes trust with each degree of separation A report from Defend Digital Me focuses on the UK legal landscape, asking, “who is age-gating our life online?” The paper promises “analysis of the technology used in the Australian Social Media Ban, emerging proposals in Europe, and the outcomes for privacy and data protection rights.” While some of its findings will be obvious to industry observers, the report also makes several novel points about the age assurance ecosystem that are worth consideration.

In the former category is the observation that “every age check is a commercial process. Platforms pay other companies per check.” This is tied to a case study of an unnamed provider, which the report presents as evidence that providers are profiting from privacy risk. More compelling is the finding that “the social media app often isn’t the company doing the check.” The report asserts that “a child signing up to a platform in one country is told the name of the age-check orchestrator, but their ID is processed by another company in another country, and their face by a third company in a liveness check .

Children have no relationship with most of these companies and rarely know who they are.” Some of this is true, notably the last part. The fragmented nature of online safety tech, while not a revelation, is a legitimate problem – one the industry’s trend toward consolidation and broader product offerings may help address.

‘Turn your head slightly’: a story of stolen agency Most interesting is the objection that “children are taught to perform for the camera on demand.” “Face scans are least accurate near the age being checked, so young people close to it are the most likely to be sent on to harder checks, including some that ask them to smile, turn their head or speak aloud,” the report alleges.

“A child who learns that complying whether they want to or not, is the price of taking part and required for their ‘safety’ is being taught the opposite of what safeguarding requires.” This is a conceptual argument resting on the notion that asking children to comply as a condition of participation and safety is unusual in our society.

But children are asked to comply all the time: at school, when it’s time for them to brush their teeth, at church, or in social situations. Asking a minor to turn their head is not a major imposition and is unlikely to foment long-standing resentment or trauma. It is worth considering, though, because it acknowledges the larger questions at play in the debate over age assurance regulation and technology.

In this case, the questions are, what are we willing to ask kids to do to gain access to a range of platforms that are, at best, pretty bad for them even if they’re sometimes useful? And, what are kids willing to do? Does the idea of digital privacy translate across generations and lead to the same conclusions?

Jen Persson, director of Defend Digital Me, makes another interesting if unconvincing point, which gestures at the broader state of surveillance culture. “We spend years teaching children that when an adult or a stranger online tells them to do something with their body on camera, they should stop and it is unsafe,” Persson says.

“Age checks teach them the opposite.” Verification always means an initial reference to a date of birth A final claim casts some doubt on how well the organization did its research. “Claims of ‘no ID needed’ are untrue for age verification,” it says. “Bank checks and digital ID wallets rest on a document checked earlier in the process, if not directly by the platform.” The international standard for age assurance systems, ISO/IEC 27566-1 , clearly defines an age verification method as an “age assurance method based on calculating the difference between a verified year or date of birth of an individual and a subsequent date.” Age verification under ISO/IEC 27566-1 relies on a verified year or date of birth, typically established through an identity document or authoritative source.

That does not mean a user must present an identity document for every subsequent check, or disclose their date of birth to the platform. Finally, Defend Digital Me says Australia’s regulation is “failing on its own terms, and costs children their rights.” “One in two say they now get less news, just as the UK plans to give 16 and 17-year-olds the vote,” it says.

The finding raises a separate question about the consequences of age restrictions for young people’s access to news and information, regardless of the platform through which they receive it. The organization is calling for the government to publish Ofcom’s assessment, “with a full human rights impact assessment including dedicated attention to child rights, and to open that to genuine and expert consultation” before it finalizes regulations under the Online Safety Act .

“We also ask it to end the routine processing of children’s facial and bodily data for age checks, and to hear children’s views on age verification methods before the rules are written.” Age assurance providers must introduce themselves to the world The takeaway for the age assurance industry is, so to speak, clear.

Promises of transparency in data handling and compliance only matter if users know who is behind them. Muddying the responsibility for age checks creates distrust from users who want a clear path to liability. Providers, perhaps wary of too much attention from the wrong crowds, are not highly visible companies.

Small, unfamiliar logos on age check prompts are many users’ first encounter with these firms. Having seen how some have fared , providers may feel inclined to avoid public scrutiny. Instead, they should embrace visibility and invite scrutiny.

If the adoption of age-assurance social media regulations represents the most significant live experiment in internet regulation in years, it should be conducted by companies that can back up their claims and defend themselves with evidence when challenged. It may not be feasible for an age assurance provider to sponsor the Olympics or run an ad during the Super Bowl.

But the time for public engagement has already begun; trust, in the end, boils down to who you know. Article Topics age verification | biometrics | children | social media | surveillance