Age Verification Online: Can the Internet Prove Who You Are?

1. The question

A website asks you to prove how old you are before it will let you in.

That sentence describes a small, growing share of the internet right now, in Britain, in Australia, in parts of America, and soon across Europe.

Governments are forcing sites to check an age before showing certain content, on the promise that it keeps children away from harm.

Checking age sounds simple. It is not. A website cannot see you, so it has to ask for something that stands in for your face or your date of birth: a scanned ID, a photograph of your face, or a signal passed along from the device in your hand.

And whatever stands in for your age has to be checked somewhere, by somebody, and then kept somewhere, by somebody. That is the cost this video follows alongside the benefit.

So here is the question this video asks. Can any of these checks actually prove who you are, and what does trying cost everyone else who has to prove it too?

2. What 'age verification' actually means

There are three different ways a site or a store can check your age today, and they work very differently from each other.

The first is a government-ID upload. You photograph your driving licence or passport, a service reads the date of birth printed on it, and the site is told only whether you passed, not what the document actually said.

The second is AI face-scan age estimation. A camera takes your picture, and a trained model guesses your age from your face, the same way a shop assistant might glance at you and guess. No document changes hands at all.

The third, and newest, is a device or operating-system signal. Instead of every site asking you separately, your phone or your account already knows roughly how old you are. It passes a simple signal, old enough or not, to the app that asks.

On 22 September 2026, Discord switched on exactly this mix worldwide: face or ID scans for some users, and a machine-learning classifier called Account Signal that the company says clears more than 90% of people without either. One company, three approaches, running at once.

None of these three methods is perfect. A document can be borrowed. A face-scan model can get a teenager's age wrong by a year or two in either direction. A device signal is only as honest as whoever first told the device how old its owner is.

Which approach a law demands, and who ends up holding the result, is most of what the rest of this video is about.

3. The UK forces the issue

Britain moved first, and it moved through Parliament rather than through any one company's choice.

The UK's Online Safety Act became law when it received Royal Assent on 26 October 2023. It took nearly two more years for its hardest duty to actually bite.

That duty is called highly effective age assurance, for pornography and for content that promotes suicide, self-harm or eating disorders. It became legally enforceable on 25 July 2025. Ofcom, the regulator, opened its own enforcement programme the day before, on 24 July.

A site covered by the duty now has to check a visitor's age with a method Ofcom accepts as reliable — not simply ask the visitor to tick a box saying they are over eighteen.

Ofcom can fine a site that fails this duty up to £18 million, or 10% of its global revenue, whichever figure is larger. That is the penalty meant to make the check worth building properly rather than faking.

What happened once that duty actually started being enforced is the next chapter.

4. What happened after UK enforcement

The first numbers from enforcement day itself come from the industry being checked, not from the regulator checking it.

The Age Verification Providers Association, the trade body for companies that sell age-checking technology, estimated 5.7 million age checks across the UK on its members' first day of enforcement. That day was 25 July 2025, and the figure is the industry's own estimate, not an independently audited count.

Ofcom's side of enforcement took longer to produce a result. On 4 December 2025, it fined a company called AVS Group £1,000,000. The fine covered inadequate age checks across 18 adult websites, the regulator said, and a separate £50,000 penalty followed for not responding properly to an Ofcom information request.

So one company was fined twice, four months into enforcement — the regulator's first finished case, not a running tally of every site checked.

Those two numbers sit on either side of the same law. Millions of checks claimed by the industry selling them, and one proven failure, with a price attached, from the regulator enforcing them. Both are true, and neither tells you how the other nine months went.

5. Australia bans under-16s outright

Australia did not ask platforms to check ages more carefully. It told them to remove an entire age group.

The Australian Parliament passed the Online Safety Amendment (Social Media Minimum Age) Act on 29 November 2024, making Australia the first country to set a minimum social media age in law rather than leave it to a platform's own terms of service.

The ban itself took effect just over a year later, on 10 December 2025. Ten platforms were covered: Facebook, Instagram, Snapchat, TikTok, X, YouTube, Threads, Reddit, Kick and Twitch. Anyone under 16 was no longer allowed an account on any of them.

Within the first two days, the platforms disclosed their own figures: about 4.7 million accounts closed. ABC News reported that count on 15 January 2026. It describes the platforms' own early numbers, not a single official government tally.

A law passed in one year, enforced the next, and measured within days of starting: Australia moved faster, in that sense, than anywhere else in this video.

6. The US patchwork, state by state

America never passed one law. It passed dozens, one state legislature at a time.

Louisiana went first. Its law requiring age verification for sites with substantial sexual content was signed on 15 June 2022. It took effect the following January, the opening move in what became a state-by-state wave.

By 2026, legal trackers that follow state-by-state activity count 27 states with a law of this kind on the books — more than half the country. The exact count shifts because new states keep adding themselves, and different trackers update on different days.

New York took a narrower, different route: rather than requiring ID checks for adult content, the state attorney general issued final rules on 28 July 2026 implementing an earlier law that limits addictive social-media feeds for minors. One state, one separate approach, inside the same patchwork.

None of this patchwork reached the US Supreme Court until one state's law was challenged directly. What the Court decided there is the subject of the next chapter.

7. The Supreme Court draws the line

Texas's law was the one a court finally tested against the US Constitution's protection of free speech.

Free Speech Coalition v. Paxton asked whether Texas's age-verification law, HB 1181, violated the First Amendment by burdening adults' access to legal speech, not just minors' access to it. Ken Paxton, Texas's Attorney General, was the named defendant, as the state official responsible for enforcing the law.

The Supreme Court decided the case on 27 June 2025, by six votes to three. Justice Thomas wrote the majority opinion, joined by Chief Justice Roberts and Justices Alito, Gorsuch, Kavanaugh and Barrett. Justices Kagan, Sotomayor and Jackson dissented.

The majority held that requiring age verification before showing sexual content to adults does not violate the First Amendment in the way earlier, pre-internet rulings about adult bookshops might have suggested.

That ruling is why the rest of America's patchwork, chapter by chapter, state by state, is no longer fighting over whether an age-verification law can exist. It is fighting over what each state's version should actually require.

The Supreme Court Building in Washington, D.C., is where that six-to-three answer was handed down. It is the same building, and the same nine seats, that will eventually decide the next age-verification case to reach it.

8. Checking age once, at the device

If every site must check your age separately, you end up proving it over and over. The newest idea tries to check it once instead.

Apple built a Declared Age Range API. Instead of handing your exact birth date to every app, your phone tells the app which age band you fall into, not a precise number, and only when the app actually needs to know.

Apple started requiring this in Texas from 4 June 2026, under the state's own App Store Accountability Act. That law is Senate Bill 2420, and a federal appeals court had briefly paused an earlier injunction against it, which is why the date moved by a few days from when reporting first expected it.

Google built its own version for Android, the Play Age Signals API, announced globally on 29 July 2026 after an earlier pilot in Brazil. The plan is Australia and Canada by mid-August 2026, then the rest of the world by the end of the year.

Colorado went further than either company. Its own law, SB26-051, puts an age-attestation duty on the device itself rather than on each app, and it has already passed and been signed — not merely proposed. It will not take effect until 1 January 2028, so no device is required to comply yet.

Apple's chief executive, Tim Cook, leads the one company a Texas law has already forced to build this. Apple did not volunteer the Declared Age Range API; Texas required it first, and Apple built it to comply.

Checking once, at the device, promises less repetition for you. It also means one company, or one phone-maker, ends up knowing your age band everywhere you go, rather than a dozen separate sites each knowing a little.

9. Europe's answer: a digital wallet

The European Union is building something closer to a passport for the whole internet than a single age check.

Every EU member state must offer its citizens at least one free EU Digital Identity Wallet, with age-verification built in, by 24 December 2026. That deadline is usually described simply as the end of 2026.

On 15 April 2026, the European Commission declared a simpler companion app, built specifically for age checks and nicknamed the "mini-wallet," technically ready.

It answers only one question to a website — are you over this age, yes or no — without handing over any other identity document.

The mini-wallet is being piloted in five countries named on the Commission's own page: Denmark, France, Greece, Italy and Spain. A full EU-wide wallet is the bigger, slower-moving programme behind it.

The Berlaymont building, in Brussels, is where the European Commission that set both of those deadlines is based. The same Commission building also houses the digital-strategy department that built the mini-wallet itself.

So Europe's answer is neither a site-by-site check nor a single company's phone feature. It is a government-issued wallet, built to prove your age to a website without that website ever learning anything else about you.

10. The privacy cost

Every one of these checks solves the same problem the same way: by handing something personal to somebody else, so they can confirm it.

A government-ID upload puts a scan of your driving licence or passport on a company's server. A face-scan puts a photograph of your actual face there instead. A device signal puts your age band in the hands of whichever company made your phone.

None of that data existed on those servers before these laws required it. A site that never used to need to know how old an adult visitor is now has a reason to collect exactly that, for every visitor, every time.

A government wallet, of the kind Europe is building, is designed to avoid this: it answers yes or no without handing over the document behind the answer. Not every country's law works that way yet.

Wherever ID scans or face photographs are stored on an age-verification company's server, rather than discarded immediately, the usual risks that come with any stored personal data come with them too. A breach, a leak, or simply a government subpoena could reach data that did not exist five years ago.

The child-safety case for these laws is about keeping something out. The privacy cost is about what has to come in to make that possible.

11. Does it actually work?

A law that is easy to pass is not necessarily a law that is hard to get around.

A virtual private network, or VPN, makes a computer appear to be browsing from a different country, one where the site being visited might carry no age-check duty at all. Age-verification laws are written and enforced country by country, and a VPN can simply step outside the country doing the enforcing.

A borrowed or fake ID defeats a document-upload check the same way it has always defeated any other check that only reads a document. A face-scan model's own error margin cuts both ways: some teenagers will be read as adults by mistake, and some adults will be read as teenagers.

Even inside the UK, Ofcom's own first enforcement case is itself a sign of a gap: AVS Group's eighteen sites were found to be running inadequate checks four months after the duty requiring adequate ones began.

Australia's law does not stop a determined teenager from using a VPN or a false birth date either. What it changes is the default: an under-16 who does nothing extra no longer has an account at all, rather than having one nobody checked.

So the honest answer is not yes or no. These laws raise the amount of effort a child needs to get around them. They have not made getting around them impossible for one who tries.

12. Where this ends up

Pull every country in this video onto one map, and two different futures are visible at once.

Britain and most of America check age site by site, country by country, law by law. Each site decides, or is told, how to check, and each check happens again somewhere else.

Europe, and to a lesser extent Apple and Google's device signals, point the other way. Check once, prove it everywhere, and let the device or the wallet carry the answer instead of your face or your documents.

Both futures claim to protect children. Both futures ask an adult to hand over something personal to make that protection work. Neither has so far made getting around the check impossible for someone determined to try.

Which future wins is not decided yet. The EU's wallet is still rolling out. Apple and Google's device signals are still spreading state by state and country by country. Which approach a government chooses next decides which cost its citizens end up paying: checking everywhere, or being known everywhere.

That is the choice this video opened with. The internet can try to prove who you are. It cannot yet do that without changing, a little, what it means to walk through it unknown.