������Ƶ

As governments around the world explore better ways to ensure children can safely and securely access online spaces, age verification requirements continue to pose a number of challenges to users and online operators. Such challenges include: technical immaturity; first amendment implications—restricting access and excluding eligible users; data privacy and security risks; determining scope of responsibility and level of implementation; cost of compliance and impact on competition; and ease of circumvention.

As of this report’s publication, strict age verification—confirming a user’s age without requiring additional personal identifiable information (PII)—is not technically feasible in a manner that respects users’ rights, privacy, and security. In 2022, the French Commission on Information Technology and Liberties (CNIL) investigated six common solutions for online age assurance, including payment card validation, facial analysis, offline verification, identity documentation, government-provided tools, and inferential verification.¹ CNIL’s report examined whether these solutions provided “sufficiently reliable verification, complete coverage of the population, and respect for the protection of individuals’ data and privacy and their security” and found that “there is currently no solution that satisfactorily meets these three requirements.”

Australia’s eSafety Commission released an in-depth roadmap for age verification, which also found that “each type of age verification or age assurance technology comes with its own privacy, security, effectiveness, and implementation issues.”² The Australian government noted that age assurance technologies are too immature to work effectively while balancing user privacy and security, ultimately suggesting alternative methods of improving children’s safety online, such as industry codes, increased platform transparency, and greater parental support.³

It should be emphasized there are no available technologies that verify age in a private and secure manner, much less any that could do so at the scale required by large social media platforms.

Current practices of age verification often require disclosing government-issued ID, and users who are hesitant to disclose or those without such ID face restricted access to content, anonymity, and privacy. Given current technological limitations, age verification mandates require online operators to verify the age of every user (often through the use of government-issued identification). If an online operator believes they are unable to undertake this task with certainty, it may feel obligated to censor or restrict content available for all users to avoid legal action and liability.¹¹ As a result, many age verification laws aimed at protecting children inadvertently limit access to content and infringe on all users’ First Amendment rights.

Previous Congressional attempts to protect minors from harmful material online through content restrictions and required age verification failed to pass constitutional muster. Supreme Court rulings found the Communications Decency Act and Child Online Protection Act unconstitutional for being overly broad, restricting freedom of expression, and limiting access to protected speech.¹² Through these cases, the Court also acknowledged that age verification mandates would impose significant costs on commercial entities and limit access of adults without acceptable identification. Current limitations on commercially effective and available tools may also impact the Court’s willingness to accept any new online age verification requirements aimed at protecting children’s safety online.¹³ It is also important to note, that while the Supreme Court has established the government’s ability to regulate material deemed harmful to minors, particularly obscene material, children are not completely exempt from First Amendment rights to protected speech.¹⁴

In addition, those that lack any acceptable form of identity to prove their age may be excluded from accessing content protected by the First Amendment under traditional methods of age verification simply because they do not have access to a government-issued ID or credit card. Youth between the ages of 14 to 16 years old often do not hold any official form of government identification, and those under the age of 18 are unable to hold credit cards. Millions of adults who are 18 years of age and older do not hold a valid government-issued photo identification.¹⁵ Additionally, the Federal Deposit Insurance Corporation’s 2021 National Survey of Unbanked and Underbanked Households found that 28.5 percent of households did not have a credit card and 4.5 percent were unbanked.¹⁶ Age verification requirements also leave no space for users who do not wish to identify themselves online, threatening individuals’ right to anonymous speech, which has long been upheld by the Supreme Court.¹⁷

Most age verification methods are at odds with data minimization, posing significant risks to user data privacy and security. Recent age verification laws require that online operators cannot knowingly retain users’ personal information, but the act of verifying user ages itself can put personal and sensitive data at risk. For instance, operators verifying users’ ages through government-issued ID or credit card information put data at risk if secure processes are not in place for use, collection, processing, storage, or deletion of PII. This, in turn, increases the risk that such sensitive data could be merged, stolen, sold, or turned over as part of legal proceedings.¹⁸

At the same time, operators who choose to verify ages through estimation or inference models may increase surveillance and monitoring of users’ online activity, such as their content, engagement, social networks, geographic location, screen time, linked accounts, and browsing history. Subjecting users to such intrusive practices may result in a chilling effect that suppresses online speech and enables the potential collection, use, or sale of user activity data.

The point of verification—whether that be via an online operator or platform, app-store, device, operating system, or internet service provider (ISP)—will significantly impact the cost, scope, efficacy, and risks of age verification mandates. Currently, most age verification legislation targets online operators and platforms—with the exceptions of Idaho and Tennessee, which target devices.¹⁹ While NetChoice, a coalition of trade associations, eCommerce businesses, and online consumers, has challenged attempts to implement age verification requirements, Meta and Pornhub have recently come out in support of different approaches to online age verification. Meta’s Global Head of Safety argued that app stores should play a larger role in age verification, while Pornhub representatives supported device-level age verification.²⁰

Selecting the technological intervention point at which age verification is required has implications for the degree of invasiveness of the policy. For example, implementation via online platforms could create an onerous verification system for users that puts their data at greater risk. Implementation at the app-store level leaves large gaps in coverage because it would not encompass non-application points of access like websites. At the device level, age verification could have implications for users’ non-online activities and fail to account for multiple users. Similarly, requiring ISPs to verify age does not account for multiple users and necessitates invasive data monitoring and collection practices. More research is needed to fully explore the consequences of mandating age verification at any level of application.

Age verification mandates would impose costly barriers to entry for start-ups and smaller operators. Such costs could unintentionally bias the market toward larger, more established companies that are better positioned to implement age verification and undertake the associated costs. Companies unable to effectively meet requirements may be forced to pull their services from jurisdictions with age verification legislation.

Most age verification laws, both passed and pending, require companies to institute any “commercially reasonable” age verification techniques—yet strict age verification or age verification through the use of government-issued identification can be costly. In a POLITICO article, Mike Stabile, the director of public affairs for the Free Speech Coalition, states that age verification costs operators “around 65 cents per verification,” which can be exorbitant for many companies processing hundreds of thousands of users, potentially each time they begin a new session.²¹ A February 2024 report by Engine, a start-up trade association, details how the direct and indirect costs of age verification requirements will make it more difficult for start-ups and smaller companies to compete.²² The report identifies costs such as age assurance product creation and integration, additional staff, data testing and training, cybersecurity, and the potential cost of data breaches.

Age verification legislation and technologies are not foolproof—nor will they completely stop underage users from intentionally or unintentionally accessing age-inappropriate content. Despite the efforts of legislators and online operators, users can still use tools like virtual private networks (VPNs) to bypass age verification.²³ In China, where age verification is required to enforce online gaming limits, users evade restrictions through a variety of methods.²⁴ Tech giant Tencent found that users can evade age verification by borrowing the device of a parent or adult or by buying, renting, or trading verified adult accounts.²⁵ South Korea, which has similar limits for online gaming, also found children were using their parents’ identification to bypass age restrictions.²⁶

Further, as the technology develops, it’s uncertain how users will be able to use generative AI to circumvent age verification methods. For example, users could use realistic filters that can alter the age a person is perceived as in images and videos, or they could generate an image of an accepted identification document. Relatedly, the Supreme Court has also considered users’ ability to evade age verification tools as part of the rationale for finding mandates unconstitutional.²⁷