Legislators across the United States are contemplating age verification mandates as a way to limit the potential harms of online experiences for youth and restrict access to age-inappropriate material. While more efforts are needed to ensure children can safely and securely access online spaces, age verification mandates may actually pose more risks than benefits—resulting in unintended consequences for the constitutional rights, privacy, and security of all users.

Most age verification legislation is currently aimed at online content that faces age barriers in the real world. However, some legislators have gone further to target social media platforms. Given the outsized impact of widespread age verification requirements and the potential for serious unintended consequences, this report aims to demystify and clarify these key concepts related to online age verification.

Age Assurance and Verification Terminology

The terms age assurance and age verification are often used interchangeably but have different privacy and security implications—this can cause confusion, particularly when implementing legal mandates. Age assurance is generally used as an umbrella term to describe the different methods to vet the ages of users, and age verification implies authenticating a user’s age with a higher level of certainty, often through the use of government-issued identification. Currently, online operators implementing age restrictions must rely on either age assurance techniques or age verification via a government-issued ID. In practice, this poses the same challenges and risks as identity verification, which requires users to disclose their identity beyond their age.

Legislative Impact

Age verification laws impact all users, not just youth. As states begin to target social media with age verification requirements, the patchwork of legislation could complicate online services' ability to comply. Age verification requirements can exclude users reluctant to disclose their government-issued ID or those without such ID, creating a chilling effect and raising additional barriers to access protected speech. If an online operator believes it cannot verify the ages of users with certainty, it may be inclined to censor or restrict what content is available for all users—or even suspend services within a state entirely—to avoid legal action and liability.¹ These challenges will only be amplified by age verification requirements for social media platforms, which for many people are a cornerstone of full social, economic, and political participation.

Implementation Challenges

Age verification requirements pose immense challenges to users and online operators. Currently, strict age verification—confirming a user’s age without requiring additional personally identifiable information—is not technically feasible in a manner that respects users’ rights, privacy, and security. For online operators, the mandated point of verification will significantly impact the cost, scope, efficacy, and risks of age verification legislation. In addition, age verification legislation and technologies are not ultimately foolproof, and neither option will completely stop under age users from intentionally or unintentionally accessing age-inappropriate content.

All children—and adults—should be able to safely and securely access online spaces that operate in a rights-respecting manner. Advancing kids’ safety online is complex and requires nuance. As state and federal legislators explore age verification as a method of improving youth experiences online, the Open Technology Institute offers key considerations for if legislators move forward with age verification and for navigating the potential ramifications of such mandates.

1. Consider alternative solutions to age verification that may more effectively address concerns surrounding youth online safety. Improving youth experiences online requires a holistic approach. Alternative approaches to improving youth—and general user—online safety may more effectively and directly address concerns about access to age-inappropriate materials and the negative impact of online spaces. Age verification is no substitute for privacy protections and increased user transparency and control.
2. Design for user privacy and choice when building age verification technology. In online spaces in which age verification is absolutely necessary, strict age verification that optimizes user privacy through data minimization and user choice via standardizing third-party facilitation and best practices can be used to implement age restrictions.
3. Require greater transparency and agency over user experience. Platforms are moving ahead with alternative approaches to protecting youth from potentially harmful content and interactions online, such as limited asks for hard-identifiers, age-specific features, and parental controls. These approaches should be evaluated for both potential benefits (greater transparency and agency over online experiences) and risks (data privacy and constitutional concerns) to highlight promising techniques.
4. Understand that content-based restrictions will have unintended consequences for people from vulnerable communities. Content-based restrictions will face strict constitutional scrutiny and should be used sparingly to avoid allowing the politicization of content to drive mandates that change the nature of the internet and disproportionately impact vulnerable communities.
5. Invest in cross-sector research and collaboration to create standardized best practices and protocols for age verification. More research is needed to fully understand the potential impacts of age verification and implementation. Insights from industry, civil society, regulators, and users of all ages should be taken into consideration to create standardized best practices and protocols for age verification.

In response to growing concerns about children’s safety online, legislators across the United States are contemplating age verification mandates as a way to limit the potential harms of online experiences and restrict access to age-inappropriate material. In 2023, more than 60 bills were introduced at the state and federal level requiring greater parental consent, age restrictions, or safety-by-design measures.² Half as many bills have already been introduced in the first few months of 2024.³ Most of these laws, passed and pending, target youth access to online adult content and sales that are age-gated “in real life.” Yet some states are going further to apply age verification requirements to social media, responding to concerns from parents and teens, schools, legislators, and regulators about children’s experiences online.⁴

While more efforts are needed to ensure children can safely and securely access online spaces, current technical limitations often mean that age verification mandates may actually pose more risks than benefits. Many social media platforms and other online operators already implement a wide range of age assurance practices to comply with existing laws and uphold their own terms and conditions. These methods aren’t perfect, but mandating age verification, which often necessitates sharing government-issued identification, can negatively impact users’ constitutional rights, privacy, and security.

Previous attempts to protect minors from harmful material online through content restrictions and required age verification—such as the 1996 Communications Decency Act and 1998 Child Online Protection Act—have largely been ruled unconstitutional by federal courts for being overly broad, restricting freedom of expression, and limiting access to protected speech.⁵ These new laws are likely to face the same fate, especially as some of the champions of these bills raise concerns about veiled attempts to restrict access to critical, and often politicized, information about gender, sexuality, and reproductive health care.⁶

Given the outsized impact of age verification requirements and the potential for serious unintended repercussions, it is important for users, lawmakers, regulators, industry, and civil society to understand the recent push toward age verification and its implications for how children and adults use and access content online. This report aims to demystify and clarify key concepts related to online age verification by providing a digestible survey of (1) current terminology and practices; (2) recent state and federal efforts requiring online age verification; (3) legal, technical, and social implementation challenges; (4) social media age-based features; and (5) recommendations for minimizing potential harms of age verification moving forward.

While there are “no universally recognized legal definitions” for these terms, age assurance is generally used as an umbrella term to describe online operators’ methods to vet the ages of users and implement age restriction laws online.⁷ Any—or a combination of the following—age assurance techniques can be used to determine a user’s age range or a binary statement about their age (such as this person is or is not 21+ years old):

• Age-gating/age-screening, or asking a user to self attest their age through checking a box or inputting a date of birth to confirm they are or older than the necessary age to access content;
• Age estimation, or estimating a user’s age by analyzing their online profile, activity, history, or facial data;
• Third-party verification, or trusting a third-party to verify a user’s age, using methods such as referencing linked accounts, vouching of age from parents or other users, or inspecting hard identifiers such as government-issued identification; and
• Age verification, or directly inspecting identifiers such as government-issued identification or biometric data to confirm a user’s age.

The terms age assurance and age verification are often used interchangeably—though this can cause confusion, particularly when implementing legal mandates. Age assurance includes a variety of methods to “establish, determine, or confirm a user’s age with some level of confidence,” according to the Digital Trust & Safety Partnership.⁸ These methods offer varying degrees of accuracy, authenticity, reliability, and verifiability. Age verification is a subset of age assurance, which implies authenticating and confirming a user’s age with a higher level of certainty, often through the use of government-issued identification. As such, age verification in practice often means identity verification, requiring a user to disclose their identity beyond their age.

It is important to note that identity verification has implications for user privacy that differ from the implications of age verification. Identity verification requires a user to provide personally identifiable information about themselves to establish and verify their identity. Or as the National Institute for Standards and Technology (NIST) defines it, “the process of confirming or denying that a claimed identity is correct by comparing the credentials…of a person requesting access with those credentials previously proven…and associated with the identity being claimed.”⁹

On the other hand, age verification can simply mean establishing or verifying a person’s age. The Age Verification Providers Association (AVPA) defines age verification as “the process of checking the age of an internet user, without necessarily needing to know their identity.”¹⁰ This distinction around identity is critical. Requiring a user to disclose their identity is in itself a privacy intrusion, and online handling and processing of data can put personal information at risk. Additionally, forced identity disclosure can create a chilling effect on speech and exclude people who lack appropriate identification from online spaces and services.¹¹ Online operators implementing age restrictions currently must rely on either age assurance techniques or age verification through the use of a government-issued ID—which in practice poses the same challenges and risks as identity verification. To help maintain these distinctions, this report will use strict age verification to refer to age verification methods that do not require verifying a person’s identity. However, the reality is that limitations in today’s technology do not enable this type of strict age verification.

Young online users are subject to the Children’s Online Privacy and Protection Act (COPPA), which requires online operators to obtain parental consent for their collection, use, or disclosure of personal data for children under 13 years old.¹² To, presumably, avoid being subjected to COPPA requirements, social media platforms—as well as many other websites—often require account holders to be older than 13 years of age.

As such, current age assurance practices mimic the approved methods of parental consent outlined by the Federal Trade Commission’s COPPA standard for acceptable methods of obtaining parental consent.¹³ These methods include signing and submitting a consent form; using a credit card, debit card, or online payment system; calling a toll free number; connecting via video conference; providing a copy of government-issued ID that can be checked against a database; answering multiple knowledge-based questions; and verifying a photo ID with a real-time photo using facial recognition technology.

Each age assurance method and implementation strategy comes with its own trade-offs for user rights, data privacy, and security. Below is a non-exhaustive survey of age assurance methods, categorized by the underlying age assurance techniques outlined above. These methods are listed generally in order of lowest to highest level of assurance, broadly reflecting AVPA’s levels of age assurance and levels of assurance outlined in NIST’s Digital Identity Guidelines.¹⁴ However, levels of assurance will vary based on accompanying implementation practices.

State and federal legislators across the United States—and around the world—are attempting to address the current loopholes in age assurance techniques by requiring online operators to verify the ages of their users (often through government-issued identification).

In 2022, Louisiana became the first state to mandate age verification via government-issued ID for users accessing adult content online.¹⁵ In 2023, Arkansas, Mississippi, Montana, North Carolina, Texas, and Virginia followed suit.¹⁶ Currently, these bills require online operators that “distribute material harmful to minors” and “contain a substantial portion” (or greater than 33.3 percent) of such material to verify users’ ages. This type of requirement can impact a variety of online operators, but is mainly intended to reduce youth access to online adult content and sales that are age-gated in real life. However, Utah and Connecticut, and additional laws in Louisiana and Arkansas,¹⁷ went further with age verification mandates, extending the requirements to social media platforms and their users.¹⁸ This trend raises two immediate concerns.

First, age verification laws impact all users, not just youth. Age verification requirements can exclude users reluctant to disclose their government-issued ID or those without such ID, creating a chilling effect on their speech and additional barriers to accessing protected speech. If an online operator cannot, with certainty, verify the ages of users, it may choose to censor or restrict content that is available for all users—or even suspend services within a state entirely—to avoid legal action and liability.¹⁹ While lawmakers may intend to only apply restrictions to specific content or to overall platform access to users of a certain age, the impact of broad and vague age verification legislation can be far reaching. For example, in response to age verification requirements, Pornhub, one of the largest adult content operators, removed access to all users in Mississippi, Utah, and Virginia.²⁰

Second, since many of these laws are enforced through an individual’s right to private action, the courts’ full interpretation of the law and how it applies to particular content and online spaces is unclear and will unfold only as lawsuits against companies are brought forward. As courts determine the scope of “material harmful to minors,” groups and topics that are already vulnerable to politicization may be targeted—as seen in the recent efforts to ban LGBTQ+ content from libraries, remove critical race theory from school curriculum, and restrict access to reproductive health care sources.²¹

Creating barriers to speech and targeting access to specific content raises serious constitutional concerns. Even age-gating scenarios meant to reduce youth access to adult content have previously been found to be unconstitutional for overbreadth of impact.²² While there is a compelling government interest to restrict youth access to age-inappropriate content, the movement still faces strict constitutional challenges. These challenges will only be amplified by age verification requirements for social media platforms, which have become, for many people, a cornerstone of full social, economic, and political participation in modern life.²³ Legal challenges have already been brought forth in some states, but legislators at the state and federal level are nevertheless continuing to pursue age verification mandates.

As states move forward with differing age verification bills, online operators will face challenges navigating the patchwork of laws that come into effect. As with previous attempts to require age verification, federal courts have blocked laws in Arkansas and Texas for being unconstitutional.³⁵ Courts also blocked the California Age Appropriate Design Code in part for its inadvertent age verification requirements, since the law mandated additional safeguards for all web services “likely” to be accessed by users under 18 years old.³⁶ However, legal challenges in Utah and Louisiana were dismissed on the grounds that the filers sued state officials, who do not have enforcement authority, as those laws enable a private right of action for users.³⁷ Most recently, a federal appeals court upheld Texas’s age verification law, overturning a lower court ruling.³⁸ Altogether, competing court decisions and precedents show that the legality of age verification requirements for either online adult content or social media is an unsettled question.

National governments are also taking on the challenge of improving online safety for youth through a variety of methods, including age verification. Age verification requirements implemented at a national level will have a rippling impact across global online spaces. As online operators reconfigure their internal processes for compliance, national legislation could set new precedents for how users—even those beyond their borders—access content online.

At the federal level in the United States, age verification and youth online safety bills have focused on social media companies. In previous sessions, a range of bills, including the Making Age-Verification Technology Uniform, Robust, and Effective (MATURE) Act and Protecting Kids on Social Media Act sought to implement age restrictions and age verification, respectively, on social media platforms.³⁹ Neither of these bills have been reintroduced in 2024.

The most prominent piece of federal legislation is the Kids Online Safety Act, which would establish a “duty of care” for platforms, or establish a legal responsibility for knowing or reasonably knowing if the user is a minor and taking the appropriate steps to mitigate and reduce online risks.⁴⁰ Initially introduced in May 2023, the bill faced criticism for its restrictions on free speech and inadvertent age verification requirements.

The bill has since been amended twice, garnering bipartisan support for tackling kids safety online.⁴¹ However, criticisms of the bill remain.⁴² The most recent iteration of the bill removes explicit age verification requirements and includes a provision that would require a study “evaluating the most technologically feasible methods and options for developing systems to verify age at the device or operating system level.”⁴³

Countries outside the United States are looking to age verification technologies to enforce online restrictions on content and services that may be harmful to children. And they are seeing similar challenges and criticism that face U.S. efforts.

The United Kingdom’s Online Safety Act of 2023 requires and places responsibilities on social media platforms to take the necessary measures to verify a user’s age.⁴⁴ This legislation is facing backlash for potentially compromising user privacy and safety online.⁴⁵

Australia’s eSafety Commissioner submitted an age verification roadmap weighing potential methods and impact.⁴⁶ Based on the findings, the Australian government decided against implementing any age verification measures citing privacy and security concerns, and instead suggested alternative avenues to creating safer online environments for children.⁴⁷

Similarly, in 2022, the French Commission on Information Technology and Liberties (Commission Nationale de l’Informatique et des Libertés) released a report concluding, “there is currently no solution that satisfactorily” can provide reliable age verification and complete coverage of the population while respecting user data privacy and security.⁴⁸

The European Union’s euCONSENT project is attempting to develop an open, secure, and interoperable solution network for age verification and parental consent.⁴⁹ The project is currently in the second phase of its pilot, and it could provide valuable insight into applying age verification requirements.

As governments around the world explore better ways to ensure children can safely and securely access online spaces, age verification requirements continue to pose a number of challenges to users and online operators. Such challenges include: technical immaturity; first amendment implications—restricting access and excluding eligible users; data privacy and security risks; determining scope of responsibility and level of implementation; cost of compliance and impact on competition; and ease of circumvention.

As of this report’s publication, strict age verification—confirming a user’s age without requiring additional personal identifiable information (PII)—is not technically feasible in a manner that respects users’ rights, privacy, and security. In 2022, the French Commission on Information Technology and Liberties (CNIL) investigated six common solutions for online age assurance, including payment card validation, facial analysis, offline verification, identity documentation, government-provided tools, and inferential verification.⁵⁰ CNIL’s report examined whether these solutions provided “sufficiently reliable verification, complete coverage of the population, and respect for the protection of individuals’ data and privacy and their security” and found that “there is currently no solution that satisfactorily meets these three requirements.”

Australia’s eSafety Commission released an in-depth roadmap for age verification, which also found that “each type of age verification or age assurance technology comes with its own privacy, security, effectiveness, and implementation issues.”⁵¹ The Australian government noted that age assurance technologies are too immature to work effectively while balancing user privacy and security, ultimately suggesting alternative methods of improving children’s safety online, such as industry codes, increased platform transparency, and greater parental support.⁵²

It should be emphasized there are no available technologies that verify age in a private and secure manner, much less any that could do so at the scale required by large social media platforms.

Current practices of age verification often require disclosing government-issued ID, and users who are hesitant to disclose or those without such ID face restricted access to content, anonymity, and privacy. Given current technological limitations, age verification mandates require online operators to verify the age of every user (often through the use of government-issued identification). If an online operator believes they are unable to undertake this task with certainty, it may feel obligated to censor or restrict content available for all users to avoid legal action and liability.⁶⁰ As a result, many age verification laws aimed at protecting children inadvertently limit access to content and infringe on all users’ First Amendment rights.

Previous Congressional attempts to protect minors from harmful material online through content restrictions and required age verification failed to pass constitutional muster. Supreme Court rulings found the Communications Decency Act and Child Online Protection Act unconstitutional for being overly broad, restricting freedom of expression, and limiting access to protected speech.⁶¹ Through these cases, the Court also acknowledged that age verification mandates would impose significant costs on commercial entities and limit access of adults without acceptable identification. Current limitations on commercially effective and available tools may also impact the Court’s willingness to accept any new online age verification requirements aimed at protecting children’s safety online.⁶² It is also important to note, that while the Supreme Court has established the government’s ability to regulate material deemed harmful to minors, particularly obscene material, children are not completely exempt from First Amendment rights to protected speech.⁶³

In addition, those that lack any acceptable form of identity to prove their age may be excluded from accessing content protected by the First Amendment under traditional methods of age verification simply because they do not have access to a government-issued ID or credit card. Youth between the ages of 14 to 16 years old often do not hold any official form of government identification, and those under the age of 18 are unable to hold credit cards. Millions of adults who are 18 years of age and older do not hold a valid government-issued photo identification.⁶⁴ Additionally, the Federal Deposit Insurance Corporation’s 2021 National Survey of Unbanked and Underbanked Households found that 28.5 percent of households did not have a credit card and 4.5 percent were unbanked.⁶⁵ Age verification requirements also leave no space for users who do not wish to identify themselves online, threatening individuals’ right to anonymous speech, which has long been upheld by the Supreme Court.⁶⁶

Most age verification methods are at odds with data minimization, posing significant risks to user data privacy and security. Recent age verification laws require that online operators cannot knowingly retain users’ personal information, but the act of verifying user ages itself can put personal and sensitive data at risk. For instance, operators verifying users’ ages through government-issued ID or credit card information put data at risk if secure processes are not in place for use, collection, processing, storage, or deletion of PII. This, in turn, increases the risk that such sensitive data could be merged, stolen, sold, or turned over as part of legal proceedings.⁶⁷

At the same time, operators who choose to verify ages through estimation or inference models may increase surveillance and monitoring of users’ online activity, such as their content, engagement, social networks, geographic location, screen time, linked accounts, and browsing history. Subjecting users to such intrusive practices may result in a chilling effect that suppresses online speech and enables the potential collection, use, or sale of user activity data.

The point of verification—whether that be via an online operator or platform, app-store, device, operating system, or internet service provider (ISP)—will significantly impact the cost, scope, efficacy, and risks of age verification mandates. Currently, most age verification legislation targets online operators and platforms—with the exceptions of Idaho and Tennessee, which target devices.⁶⁸ While NetChoice, a coalition of trade associations, eCommerce businesses, and online consumers, has challenged attempts to implement age verification requirements, Meta and Pornhub have recently come out in support of different approaches to online age verification. Meta’s Global Head of Safety argued that app stores should play a larger role in age verification, while Pornhub representatives supported device-level age verification.⁶⁹

Selecting the technological intervention point at which age verification is required has implications for the degree of invasiveness of the policy. For example, implementation via online platforms could create an onerous verification system for users that puts their data at greater risk. Implementation at the app-store level leaves large gaps in coverage because it would not encompass non-application points of access like websites. At the device level, age verification could have implications for users’ non-online activities and fail to account for multiple users. Similarly, requiring ISPs to verify age does not account for multiple users and necessitates invasive data monitoring and collection practices. More research is needed to fully explore the consequences of mandating age verification at any level of application.

Age verification mandates would impose costly barriers to entry for start-ups and smaller operators. Such costs could unintentionally bias the market toward larger, more established companies that are better positioned to implement age verification and undertake the associated costs. Companies unable to effectively meet requirements may be forced to pull their services from jurisdictions with age verification legislation.

Most age verification laws, both passed and pending, require companies to institute any “commercially reasonable” age verification techniques—yet strict age verification or age verification through the use of government-issued identification can be costly. In a POLITICO article, Mike Stabile, the director of public affairs for the Free Speech Coalition, states that age verification costs operators “around 65 cents per verification,” which can be exorbitant for many companies processing hundreds of thousands of users, potentially each time they begin a new session.⁷⁰ A February 2024 report by Engine, a start-up trade association, details how the direct and indirect costs of age verification requirements will make it more difficult for start-ups and smaller companies to compete.⁷¹ The report identifies costs such as age assurance product creation and integration, additional staff, data testing and training, cybersecurity, and the potential cost of data breaches.

Age verification legislation and technologies are not foolproof—nor will they completely stop underage users from intentionally or unintentionally accessing age-inappropriate content. Despite the efforts of legislators and online operators, users can still use tools like virtual private networks (VPNs) to bypass age verification.⁷² In China, where age verification is required to enforce online gaming limits, users evade restrictions through a variety of methods.⁷³ Tech giant Tencent found that users can evade age verification by borrowing the device of a parent or adult or by buying, renting, or trading verified adult accounts.⁷⁴ South Korea, which has similar limits for online gaming, also found children were using their parents’ identification to bypass age restrictions.⁷⁵

Further, as the technology develops, it’s uncertain how users will be able to use generative AI to circumvent age verification methods. For example, users could use realistic filters that can alter the age a person is perceived as in images and videos, or they could generate an image of an accepted identification document. Relatedly, the Supreme Court has also considered users’ ability to evade age verification tools as part of the rationale for finding mandates unconstitutional.⁷⁶

In response to concerns about children’s experiences online from parents and teens, schools, legislators, and regulators, state and federal age verification legislation is beginning to focus on social media platforms.⁷⁷ Growing evidence shows that while not inherently bad for youth, social media can facilitate and exacerbate challenges to children’s mental health and safety online.⁷⁸ While more efforts are needed to ensure children can safely and securely access online spaces, age verification mandates present various challenges and may not actually address the root concerns surrounding social media use.

Already, websites and social media platforms implement a variety of age assurance practices to enforce previously established legal age restrictions—such as the Children’s Online Privacy Protection Rule (COPPA) or age restrictions related to online gambling and alcohol and tobacco sales—and to uphold their own account age requirements. For example, when age restrictions are mandated by law, online operators may use hard identifiers such as photo ID or credit cards to confirm a user’s age, which is similar to age assurance practices taking place in the physical world.

In the absence of age limits set by law, such as platform’s account holder age requirements, many platforms and websites rely on self-declaration. This is usually done by asking users to input their date of birth when creating an account, link to an existing account with date of birth information, or simply check a box to confirm that they are the required age.

However, these methods aren’t foolproof, as users can simply declare they are of the required age when they are not. Age verification legislation intends to close these loopholes but leaves online platforms grappling to respond to concerns about children’s access to social media and age-inappropriate material while minimizing potential risks of age verification.

As a result, platforms have employed a variety of strategies to create safer online spaces for children and teens, such as requiring age verification only when an account holder is suspected to be underage, introducing age-specific features for users, and creating parental controls. These strategies have their own trade-offs and considerations for user rights, data privacy, and security, but they may offer insight for more direct and effective strategies for promoting kids safety online than those of age verification mandates.⁷⁹

To identify users who do not self-declare their age accurately, some social media companies are incorporating measures to flag when a user may be under the required age. For example, TikTok scans public videos of users to help determine account holders’ ages.⁸⁰ Meta uses artificial intelligence to detect underage account holders based on account activity and linked profiles.⁸¹ Additionally, both Meta’s Instagram and Facebook platforms allow users to report accounts suspected to be held by an underage user.⁸² If a user tries to change their self-reported age or has been identified as being underage, platforms, including Pinterest, Discord, TikTok, and Google, require users to verify their age with a government-issued ID, credit card, or a live photo.⁸³ When users try to edit their account age from under 18 to over 18 years old, Meta’s Instagram requires them to verify their age by submitting a government-issued ID, recording a video selfie to be analyzed by age-estimation AI, or asking mutual friends to vouch for their age.⁸⁴ This strategy may reduce the personal or sensitive data that users need to share with a platform to verify their age by only requesting verification of account holders suspected of being under the required age. However, methods used to detect these underage account holders may subject users to intrusive surveillance and monitoring of online activity and incorrectly flag account holders as being underage.

Some platforms employ age-specific features to protect youth from potentially harmful content and interactions online. For example, Roblox is working to incorporate an age verification feature that will allow users 13 years of age and older to submit a government-issued photo ID and a selfie to verify their age to “access innovative social capabilities and age-appropriate content.”⁸⁵ Enabling account restrictions on Roblox will lock an account’s contact settings to block messages and chats from other users and limit play to experiences recommended for all ages.⁸⁶

Google offers a suite of digital well-being tools that allows all users to set daily limits and timers on apps, customize or turn off notifications, and set bedtime reminders—some of which are turned on by default for users who are 13 to 17 years old on YouTube.⁸⁷ In addition, Google has specific ad policies for teens that restrict personalized ads or ads containing sensitive content.⁸⁸

Snapchat implements specific default settings for teens, including limiting contacts to friends and existing phone contacts, restricting location sharing, and sending in-app reminders about privacy and safety settings.⁸⁹ Similarly, TikTok has a variety of age-specific features, such as prohibiting users under 13 years old from posting videos or comments, setting accounts held by 13 to 15 year olds to private by default, and restricting live streaming and direct messaging for users under the age of 16.⁹⁰ In March 2023, TikTok introduced new age-specific features, including an automatic 60-minute screen time limit for users under 18 and created a screen time dashboard and controls for all users.⁹¹

In January 2024, Meta released new policies for teens, hiding age-inappropriate content, limiting content recommendations, and defaulting content recommendations to the most restricted settings.⁹² While these features help customize a safer and healthier online experience for young people, these features are not activated unless an account is created with the correct age.

Companies are also creating more opportunities for parents to play a greater role in supervising their child’s online activity. Many platforms already implement options for parents to set restrictions, monitor, enable permissions, and link accounts for their children’s accounts.

TikTok’s Family Pairing allows parents to link their TikTok account to their child’s account to manage settings for various features, including account discoverability, searches, direct messaging, and screen time.⁹³ Similarly, Google’s Family Link allows parents to manage parental controls such as SafeSearch and edit settings on YouTube Kids and YouTube accounts.⁹⁴

Apple’s Family Sharing allows parents to create Apple IDs for their children and set parental controls and receive warnings about sensitive content sent or received by a child’s account.⁹⁵ In 2022, Snapchat introduced its Family Center tool that allows parents to view their teen’s privacy and safety settings, manage parental controls, and restrict sensitive content.⁹⁶ Likewise, Discord’s Family Center allows parents to see who their child is talking to on the platform, what forums of which they are a part, and newly added friends.⁹⁷ In 2023, Meta began launching new parental supervision features on Facebook and Instagram that allow parents to see with whom their child is friends or messaging through both apps.⁹⁸

While parental controls offer greater insight and supervision into their child’s online life, these controls may negatively infringe upon a young person’s privacy and enable unnecessary surveillance of their online activity.

All children—and adults—should be able to access online spaces and interactions safely, securely, and in a rights-respecting manner. The conversation around advancing kids’ safety online is complex and requires thoughtful nuance to ensure strategies address core concerns. Age verification requirements can create a cascading impact on how all users access online content, as each age assurance and verification method comes with its own trade-offs for user rights, data privacy, and security.

Alternative approaches that optimize user choice, privacy, and control over their online experience may be more feasible and efficient at improving children and teen safety online than age verification mandates. As state and federal legislators explore age verification, the Open Technology Institute offers five recommendations for navigating potential ramifications of such mandates and for moving forward on addressing youth safety online.

Improving youth experiences online requires a holistic approach. Using a mix of alternative methods to improve youth—and general user—safety online may more effectively and directly address concerns about access to age-inappropriate materials and the negative impact of online spaces. Ultimately, age verification is no substitute for privacy protections and increased user transparency and control.

Growing concerns over social media’s impact on youth mental health and well-being have driven the bulk of age verification and other youth-focused online safety bills.⁹⁹ Yet, these concerns are complex and no single technology solution can or will adequately address what are ultimately social challenges.¹⁰⁰ It is important to evaluate whether or not age verification requirements can effectively address the core concerns before moving forward with legislation.

Given the challenges and risks of age verification mandates, more feasible and effective methods for advancing children’s safety online should be explored. First and foremost, comprehensive federal data privacy legislation, such as the American Data Privacy Protection Act, remains the best method for protecting children, and all users, online.¹⁰¹ Such legislation would require stronger data minimization, limit the ability of companies to use the data they do collect, and create special protections for sensitive data like biometric information and precise geolocation data.

Other avenues, such as requiring platform transparency, customizable design features, or safety- and security-by-design principles, can offer users greater insight and control over the algorithms that impact their experiences online while standardizing a base level of data privacy and security. These methods could allow parents, youth, and all other types of users to tailor their default settings and the content they see online to better fit their needs.

In online spaces in which age verification is absolutely necessary, strict age verification that optimizes user privacy through data minimization and user choice via standardizing third-party facilitation and best practices can be used to implement age restrictions.

Age verification is incompatible with user needs and expectations for anonymity online and is likely to raise constitutional concerns. Mandates for age verification can infringe on user rights and put their privacy at risk. This is especially concerning as current age verification practices require users to share a government-issued identification, which could disproportionately impact vulnerable communities and access to politicized content. In spaces that require strong authentication needs or present clear precedent for age-based restrictions (such as engaging in online gambling or purchasing alcohol and tobacco products), strict age verification that uses data minimization principles and third-party facilitators can offer a rights-respecting method for implementing age restrictions.

Although the French Commission on Information Technology and Liberties (CNIL) concluded that no solution fully met their privacy criteria, their 2022 report discusses a proof of concept that shows it is possible “through a third-party system, to guarantee the protection of the individual’s identity and the principle of data minimisation, while maintaining a high level of assurance on the accuracy of the data transmitted.”¹⁰² Using two cryptographic concepts (group signatures, and zero knowledge proofs), researchers built “a possible implementation of an age verification system that allows accessing restricted websites without sharing other personally identifiable data.”¹⁰³ In other words, a system could be used in which the website only learns the age (or age range) of the visitor and the age verifier learns nothing about the site requesting the verification. This work shows that privacy-respecting age verification is possible via the use of existing and well-understood cryptographic principles.

Standardization of strict age verification can foster a varied ecosystem of third-party age assurance providers that enables greater user choice in who is verifying their age, promotes greater safety and security measures through competition, and avoids concentrating verification solely within a few large tech companies. However, little conclusive work has been done so far in this area.¹⁰⁴ Even if a standard is agreed upon, there must be enough critical mass behind its use to actually make such a system useful for every type of site that may need to verify a user’s age. As CNIL demonstrated, it is already technically possible to build an age verification system that assures privacy, but in the absence of an established and widely adopted protocol, it is unlikely that strict age verification can be widely done at scale in privacy-preserving ways.

Until there is a secure standard, age verification should be accompanied by security- and privacy-by-design practices, and online operators should offer users a variety of methods to confirm their age.

Platforms are moving ahead with alternative approaches to protecting youth from potentially harmful content and interactions online, such as limited asks for hard-identifiers, age-specific features, and parental controls. These approaches should be evaluated for both potential benefits (greater transparency and agency over online experiences) and risks (data privacy and constitutional concerns) to highlight promising approaches to youth safety online.

As detailed in the Social Media Platforms and Age-Appropriate Practices section of this report, many platforms integrate age-specific features for users between the ages of 13 and 18 years old. These can include default privacy settings on accounts; app usage dashboards and settings; and restrictions for posting content, sending and receiving messages, accessing promoted and recommended content, and limiting screen time. In addition, parental controls and linked accounts can help assuage some parents’ concerns by allowing them greater supervision and more decisions in their child’s online experience.

While these features respond to current concerns about access to age-inappropriate material and the potentially addictive nature of technology, it is important to note their limitations. These features are not activated unless the associated account age is accurate. Additionally, parental controls place a high burden on parents, who do not always have the capacity, willingness, or digital skills to effectively use parental monitoring tools—which most do not even use.¹⁰⁵ When in use, increased surveillance of kids online may exacerbate digital abuse by allowing children and teens to be subjected to extreme monitoring and control over their online presence.¹⁰⁶ This could be particularly dangerous for LGBTQ+ youth, those seeking access to reproductive health care, or those experiencing sexual, physical, or emotional abuse at home.

When advocating for safer, healthier online spaces for youth, legislators and civil society should evaluate existing approaches to creating age-appropriate online environments and the associated risks to be addressed to highlight successful techniques that can be adopted across online operators.

Content-based restrictions will face strict constitutional scrutiny and should be used sparingly to avoid allowing the politicization of content to drive mandates that change the nature of the internet and disproportionately impact vulnerable communities.

Much of age verification legislation stems from ongoing conversations about what information is appropriate or not appropriate for young people to access. While content-based restrictions will face strict constitutional scrutiny, any allowances to restrict speech in the name of protecting children can have far-reaching consequences for freedom of expression and access to information.

As legislators and courts determine the scope of age verification requirements, sensitive or politicized topics, like those surrounding gender, sexuality, race, and reproductive health care, may become targets to censorship or age-gating.¹⁰⁷ Allowing the politicization of content to drive age verification requirements can set a dangerous precedent for years to come, leaving users and companies responding to changing considerations of what is age-appropriate or not.

More research is needed to fully understand the potential impacts of age verification and implementation. Insights from industry, civil society, regulators, and users of all ages should be taken into consideration to create standardized best practices and protocols for age verification.

Governments and societies should carefully consider how age verification may unintentionally impact users. Mandates will increase the frequency at which people are asked to provide government-issued identification to access online spaces and may desensitize users to requests for personal and sensitive information. Along with a lack of clarity about what constitutes age-appropriate material, this could lead to an increase in requests for age verification, even in online spaces in which identification is normally neither required nor needed, as well as associated scams. Governments should play a role in determining the standard of verification and identification online, the role of digitized or digital IDs, and alternative age verification processes for people that lack traditional identification.

To further mitigate the negative impacts of age verification on users, cross-sector collaboration is needed to understand the full range of implications, develop best practices, and standardize protocols. This work is in progress at various stages.

The Digital Trust & Safety Partnership outlined five guiding age assurance principles and best practices that put user choice, safety, and needs at the forefront of age assurance practices. Google’s recent Legislative Framework to Protect Children and Teens Online offers thoughtful considerations to improve youth experiences while minimizing user risk and ensuring oversight and accountability. Previous projects at the International Organization for Standardization and Institute of Electrical and Electronics Engineers could be revived to develop common technical standards for conducting and facilitating age verification at acceptable levels of efficacy, privacy, and security.

Cross-sector collaboration provides opportunities to include the perspectives of actors and users of all ages in crafting design approaches and legislation.