Policymakers have increasingly promoted age verification as a method of protecting minors from adult content online. Although age verification mandates might seem like a simple solution, these top-down policies disregard the wisdom supervision of parents and ignore the practical shortcomings of existing technologies. However well-intentioned, age verification measures are ineffective and pose serious risks to personal privacy. 

Early this month, AI Forensics (a European investigative nonprofit) issued a report on the privacy risks inherent in age verification methods in France. Following pressure to comply with the European Union’s Digital Services Act (and pursuant to subsequent French law) France imposed age-verification requirements on online platforms hosting pornographic content. Several such platforms within France adopted the age-verification method offered by AgeGo, to which French users must submit before accessing these platforms. Despite assurances from authorities that these systems protect users’ privacy, AI Forensics’ report reveals myriad major privacy risks created by AgeGo’s system.  

As AI Forensics found, AgeGo’s verification system records the website and URL of the content each user seeks to access. This information is transmitted to the AgeGo servers prior to the user even selecting an age verification method. Thus, even if the user selects a “double anonymity” age verification method, in which the verification provider should not know which website the user is attempting to access, AgeGo already has information about the specific website and videos users are attempting to access.  

Even worse, users who select the “selfie facial age estimation” method, which is labeled as a double anonymity verification option, must accept AgeGo’s terms and conditions, which allows the video stream from the user’s device to be uploaded to an unnamed third-party provider. The report’s examination of network traffic traced the user’s webcam stream to Amazon’s Web Services (AWS) “Rekognition.” In the end, despite its deceptive denomination as a “double anonymity” method, this process exposes user’s webcam feed, IP address, user agent, and that they are accessing an 18-plus website through AgeGo.  

Far from being an isolated issue, France’s age verification requirements are part of a broader trend towards online censorship. Although age verification is minimally invasive to privacy and effective in brick-and-mortar stores, it is untenable in digital spaces. Age verification in physical stores works because it occurs spontaneously and does not create large repositories of sensitive information.  

France attempted to mitigate the cybersecurity and privacy dangers that flow from age verification. While the theory might have seemed sound, the practice—as instanced by AgeGo’s spectacular deficiencies—has proven flawed. Even technologies purporting to be privacy-protective have been anything but. Simply mandating privacy does not erase the inevitable vulnerabilities that arise from technological difficulties and human error. 

Making matters worse, in the U.S., policy makers have not even attempted to build into their age verification proposals the sorts of protections for privacy required in France. An article from the R Street Institute points out that even when legislative language does not mandate disclosure of personal information for age verification, technological limitations necessitate the disclosure of sensitive information like government IDs, social security numbers, credit card information, or biometric scans in practice. Even then, age verification technology is not always accurate. Underage users seeking to access explicit material could show a parent’s government ID and facial scans often produce flawed age estimates. 

Because of the large amounts of personal data these companies accumulate, age verification platforms are ripe for hacking attacks, data leaks, and identity theft. Although the logical solution is for platforms to delete this data once the user’s age is verified, platforms are incentivized to retain databases of personal information needed to demonstrate compliance with age verification laws. The pooling of information collected by these platforms creates a tempting target for cybercriminals. Even major corporations and social media platforms—not to mention third-party verification services—have been victims of hacking attacks.  

Of the various kinds of age verification technologies that have been proposed or implemented in various countries, all have had security vulnerabilities. Given the risks, any benefit age verification might provide is outweighed by an avalanche of privacy concerns. 

Policymakers should abandon fanciful visions of a perfect solution through top-down mandates. Instead, they should recognize the practical limitations of age verification technology and seek realized the solution lies in educated and empowered families, and not in sweeping mandates.  

Although the government has an interest in protecting minors from explicit content, the imposition of age verification mandates put users’ privacy — including, in the context of non-pornographic online platforms, the privacy of children — at risk and impose weighty regulatory burdens for online service providers. Government and civil society alike should seek to limit government interference, preserve individual liberty, promote family education and autonomy, and avoid the data-privacy nightmare produced by ill-conceived mandates.  

Lillian Kriese is a research associate at the Taxpayers Protection Alliance.