Online Age Verification: The Regulators Arrive at the Scene

Access to questionable services is one thing. This does not take into account the physical risks of underage users entering platforms, such as dating or social media apps, where the identity of the person on the other side of a chat is uncertain. Our minds are emblazoned with stories of uncovered schemes that were preying through extortion on youthful minds.

The Regulators are Regulating

2025 has brought with it a flurry of action globally to address these concerns, with regulators around the world addressing the harm this is causing to children and society as a whole. By way of brief 50,000-foot view:

United States

• No federal law mandates age verification across all digital services. However, 25+ states have enacted laws requiring age verification for access to content deemed “harmful to minors,” especially adult content.
• Recent Developments:
  
  • In Free Speech Coalition et al. v. Paxton the Supreme Court upheld Texas’s age verification law, stating adults have no First Amendment right to avoid age checks.
  • Florida and Kansas initiated lawsuits and enforcement actions against non-compliant platforms.
  • Tennessee requires re-verification every 60 minutes for adult content access.

Canada

• No binding federal law yet, but significant regulatory momentum.
• Recent Developments:
  
  • CAN/DGSI 127:2025, a national standard for age assurance, was published in August 2025 by the Canadian Digital Governance Standards Institute (DGSI).
    
    • Requires a Child Rights Impact Assessment (CRIA) before implementation.
    • Promotes privacy-preserving, platform-agnostic technologies.
  • Bill S-210, which would have mandated age verification for adult content, died in early 2025. A new legislative effort is underway, aiming to align with UK and EU models.

United Kingdom

• The Online Safety Act (OSA) is now fully live as of July 25, 2025.
  
  • Platforms must implement “highly effective” age assurance for access to adult entertainment, self-harm and suicide content, and eating disorder content, among other focus areas.
  • Acceptable methods include facial scans, photo ID, and credit card checks.
  • Platforms must not store personal data unnecessarily and must comply with UK data protection laws.
  • The Office of Communications (Ofcom) is actively monitoring compliance and can impose fines up to £18 million or 10% of global turnover.

European Union

• The Digital Services Act (DSA) mandates platforms to implement proportionate measures to protect minors.
• Recent Developments:
  
  • On July 14, 2025, the EU released a blueprint for a privacy-preserving age verification system.
    
    • Known as the “mini wallet”, it is interoperable with the upcoming EU Digital Identity Wallet (due 2026).
    • Allows users to prove age (e.g., over 18) without revealing identity.
  • The blueprint is now in pilot testing across Member States.
  • The EU is also preparing an Action Plan against Cyberbullying for early 2026.

Australia

• The Online Safety Act has been amended to introduce mandatory age restrictions.
  
  • From December 10, 2025, platforms must prevent users under 16 from creating or maintaining accounts on age-restricted social media platforms.
  • Platforms must take “reasonable steps” or face fines up to AUD 49.5 million.
  • Applies to platforms like Facebook, Instagram, TikTok, and YouTube.
  • Exemptions include messaging apps, online games, and educational tools.
• On August 31, the government released a report on its comprehensive assessment on the trialing of age assurance technologies, including consultations on implementation guidelines.

So, what does a good service look like?

While not all regulations and common law approaches are clothed alike, there are some global trending themes that rise to the surface. Companies that serve the industries under focus will be looking for vendors that meet these common standards with applications that maintain positive UX and customer engagement, keeping end users happy, and safe.

P Cubed

Privacy, privacy, privacy. This is a cornerstone of age awareness regulations, with heightened concern to ensure that the data of end users, notably minors, is preserved across the platform. Data minimization or zero data retention comes to the fore of the discussion.

As context:

• The EU’s “mini wallet” and Canada’s CAN/DGSI 127:2025 promote selective disclosure and data minimization.
• The UK mandates that platforms must not store personal data unnecessarily.

A Locked Box

The departure point for privacy is the entry point for heightened security. Where some personal data may require retention (this will be use case dependent), security becomes a critical factor to block the bear from the honeypot. Key factors here include evidence of the following:

• Robust encryption, secure storage and strict access controls.
• Assessments of vendor security seriousness, evidenced by globally recognized security certifications such as the ISO 27000 family of accreditations (27001, 27017, 27018, 27701), among others.
• Strong defense to cyberattacks, including performing regular penetration testing, maintaining complete audit logs with sufficiency of alarms and best approach multi-factor authentication for admin access.

Recognizing All

Let’s not lose the primary focus of the age verification regulations – it is to shield minors from harmful online content, extortion, self-harm, and cyberbullying. Recognition of all end users is a call to pull back the advertised wrapper and look under the hood. How does the tech perform?

• What is the accuracy and performance of the tech, in delivering towards the goal? Many vendors will promote their solution as 4 x nines accurate (99.99%). On what basis? Is this testing by an independent NIST NVLAP laboratory? Is this just model testing or real environment live scenario testing?
• Does the test perform equally across all demographics? Noting that while outputs have improved after the past few years, discrepancies remain across certain demographic groups. As in, a drop in presentation for those with darker skin tones, women, and certain ages (ironically, those under the age of 18 to 20). Here too, independent NVLAP laboratory testing is available to get a better sense check of the core engine performance in the real world.

Fully Automated

Website and app designers hate friction, including anything that increases the dreaded drop off onboarding rate. In a world of increasing customer acquisition costs, why pay a fortune in advertising to drive traffic if your prospective visitors abandon disproportionately because of an age verification system that is not slick enough to their expectations?

Age verification, even more so than identity verification, should be fully automated. Full automation does not mean an onboarding process that resorts to manual fall back. It means that best technology is infused into the process to facilitate a more seamless process, with humans over the loop, and not a cause of bottleneck and delay in the loop. Not to mention the challenges of the inaccuracy of human reviewers in a world of sophisticated deepfakes and injection attacks.

An Opportunity to Shine

Over the past 10+ years we have witnessed an increasing tide of reports on physical and mental damage to one of the most vulnerable and active user groups in our online world. The regulators have taken time to circle among themselves, to bring forward their own flavor of Thou Shall Not’s as it relates to trying to protect minors in this dimension. They are now arriving to the scene in large numbers.

As the dates of enforcement of their rules come into effect, the spotlight now shifts to the industry. This is the time for the leaders of the online communities to shine. It starts with a good flashlight.