Executive Summary

Legislators across the United States are contemplating age verification mandates as a way to limit the potential harms of online experiences for youth and restrict access to age-inappropriate material. While more efforts are needed to ensure children can safely and securely access online spaces, age verification mandates may actually pose more risks than benefits—resulting in unintended consequences for the constitutional rights, privacy, and security of all users.

Most age verification legislation is currently aimed at online content that faces age barriers in the real world. However, some legislators have gone further to target social media platforms. Given the outsized impact of widespread age verification requirements and the potential for serious unintended consequences, this report aims to demystify and clarify these key concepts related to online age verification.

Age Assurance and Verification Terminology

The terms age assurance and age verification are often used interchangeably but have different privacy and security implications—this can cause confusion, particularly when implementing legal mandates. Age assurance is generally used as an umbrella term to describe the different methods to vet the ages of users, and age verification implies authenticating a user’s age with a higher level of certainty, often through the use of government-issued identification. Currently, online operators implementing age restrictions must rely on either age assurance techniques or age verification via a government-issued ID. In practice, this poses the same challenges and risks as identity verification, which requires users to disclose their identity beyond their age.

Legislative Impact

Age verification laws impact all users, not just youth. As states begin to target social media with age verification requirements, the patchwork of legislation could complicate online services' ability to comply. Age verification requirements can exclude users reluctant to disclose their government-issued ID or those without such ID, creating a chilling effect and raising additional barriers to access protected speech. If an online operator believes it cannot verify the ages of users with certainty, it may be inclined to censor or restrict what content is available for all users—or even suspend services within a state entirely—to avoid legal action and liability.¹ These challenges will only be amplified by age verification requirements for social media platforms, which for many people are a cornerstone of full social, economic, and political participation.

Implementation Challenges

Age verification requirements pose immense challenges to users and online operators. Currently, strict age verification—confirming a user’s age without requiring additional personally identifiable information—is not technically feasible in a manner that respects users’ rights, privacy, and security. For online operators, the mandated point of verification will significantly impact the cost, scope, efficacy, and risks of age verification legislation. In addition, age verification legislation and technologies are not ultimately foolproof, and neither option will completely stop under age users from intentionally or unintentionally accessing age-inappropriate content.

All children—and adults—should be able to safely and securely access online spaces that operate in a rights-respecting manner. Advancing kids’ safety online is complex and requires nuance. As state and federal legislators explore age verification as a method of improving youth experiences online, the Open Technology Institute offers key considerations for if legislators move forward with age verification and for navigating the potential ramifications of such mandates.

1. Consider alternative solutions to age verification that may more effectively address concerns surrounding youth online safety. Improving youth experiences online requires a holistic approach. Alternative approaches to improving youth—and general user—online safety may more effectively and directly address concerns about access to age-inappropriate materials and the negative impact of online spaces. Age verification is no substitute for privacy protections and increased user transparency and control.
2. Design for user privacy and choice when building age verification technology. In online spaces in which age verification is absolutely necessary, strict age verification that optimizes user privacy through data minimization and user choice via standardizing third-party facilitation and best practices can be used to implement age restrictions.
3. Require greater transparency and agency over user experience. Platforms are moving ahead with alternative approaches to protecting youth from potentially harmful content and interactions online, such as limited asks for hard-identifiers, age-specific features, and parental controls. These approaches should be evaluated for both potential benefits (greater transparency and agency over online experiences) and risks (data privacy and constitutional concerns) to highlight promising techniques.
4. Understand that content-based restrictions will have unintended consequences for people from vulnerable communities. Content-based restrictions will face strict constitutional scrutiny and should be used sparingly to avoid allowing the politicization of content to drive mandates that change the nature of the internet and disproportionately impact vulnerable communities.
5. Invest in cross-sector research and collaboration to create standardized best practices and protocols for age verification. More research is needed to fully understand the potential impacts of age verification and implementation. Insights from industry, civil society, regulators, and users of all ages should be taken into consideration to create standardized best practices and protocols for age verification.