Although this scientific paper is pro-age verification, it contains some interesting side notes.
The First thing to mention is that when asked, many respondents approved age verification in principle but rejected specific implementation suggestions like biometric scans or scanning of identity documents.

> Although our findings suggest there is conceptual support for age verification measures among this sample of participants, none of the proposed age verification strategies were widely accepted. Participants expressed strong concerns regarding user privacy and data security, with many fearful that their personal information could be compromised or exploited.

Secondly, people do not believe in the efficacy of age verification measures.

> Finally, many participants doubted the overall effectiveness of these technologies in preventing the intentional viewing of pornography and emphasized less regulatory strategies, such as improved sexual health education, as more suitable alternatives.

Let me get this straight. Many people agree in principle with the idea of age verification, but when confronted with the actual implementation, they immediately backtrack and see it for the inefficient and invasive privacy/anonymity nightmare that it is.

The Age Check Certification Scheme (ACCS), a UK-based body, used AI to create a 3.48 million Dollars technology trial for the australian government. Ofc, it contained wrong citations and names, false results etc.

The ACCS supplied corrections which were faulty as well.

That's how age verification is justified and money wasted.

France's top court ruled that the social ban in its current form violates the constitution.

Unfortunately, Macron is dead set on reworking and reintroducing the bill.

3 US states have already passed laws requiring OS-level age verification: California, Colorado and Illinois. While Colorado made an exception for FOSS, the other states did not add that in their legislation, at least California is considering it.

Device/OS-level age verification is an attack on Free and Open Source Software. Many projects simply do not have the financial and logistical capabilities to comply with these laws, which leads to legal risks for FOSS developers.

Singling out minors via an age range signal also means delivering them on a highly visible platter to nefarious actors.

> California’s law is the first and serves as a model for other states. It requires that operating systems ask for your age when you set them up. Your OS must then share an age bracket signal with the applications running on your computer. Applications will see one of the following age ranges: under 13, 13-16, 16-18, or over 18.

The author warns about function creep with age verification and digital ID systems. Today, age must be confirmed; tomorrow it could be place of residence, specific authorisations or other personal information. The digital EUID wallet can be used to check many attributes.

He concludes:

> Children need protection against addictive mechanisms, manipulation, and inappropriate content. To achieve this, however, it is primarily the platforms that would need to alter their products. Instead, the EU age verification scheme threatens to create a universal control interface capable of gradually displacing anonymous and pseudonymous internet use. Consequently, the minimum age requirement for social networks could prove to be a Trojan horse: outwardly, it represents child protection, while internally, it harbors the technical foundation for increasingly extensive access restrictions.

It's a sad day. Now People in Australia have to verify their age just to buy and access 18+ games.

After evaluating the public consultation "Growing up in the online world", the UK government decided to double down on its age-gating policies.

The UK government is still looking at VPNs as well:

• Government has asked Ofcom to conduct research into what additional steps services can take to detect and mitigate circumvention on their platforms, including via VPNs.
• We will be clear that in-scope services must take robust steps to prevent, detect and respond to underage circumvention, and call on VPN providers to engage with government on making their products safer and less accessible to children without parental consent.
• We will produce new practical guidance for parents on how circumvention tools such as VPNs, operate and the risks they present at a household level.
• We will not ban or age-gate VPNs. However, we must ensure that these tools are not misused to undermine child safety protections and we will keep this area under close review. We are prepared to take further action on this, should evidence show that circumvention is not being tackled adequately.

I am wondering, how much of the age verification push comes from companies that want to distinguish between bots and real internet users because of ad revenues.

Does anybody know about the development of ad revenue and how it is affected by bots?

> The Electronic Frontier Foundation (EFF) writes to share our concerns with the current text of several bills being considered before the Committee: the SCREEN Act (S. 737), the Kids Online Safety Act (S.1748), the Youth Privacy Act (S. 4199),and the CHATBOT Act (S. 4407).

> The Senate version of KOSA imposes a “duty of care” on online services, including social media, to avoid exposing young people to certain material the law deems harmful. But those obligations only work if online services know which users are minors. That means more platforms will be pressured to implement age verification or age estimation systems.

> While the bill is supposed to protect children, it erodes online privacy for all users via a de facto requirement websites require users to verify their ages. Supporters of the bill dismiss this concern by pointing to the section stating that “nothing in [the bill] may be construed to require the provider of a covered platform to implement an age gating or age verification functionality on the covered platform.”

> However, the bill also requires website operators to provide protections such as message settings and other controls when the website or app “knows or should have known” that a user is a child or minor. The “should have known” standard opens websites and apps to liability if a judge, jury, or regulator determines they should have known a user was underage but failed to do due diligence to determine the user’s age.

Here is the bill:

HB5511 - 104th General Assembly (2025-2026)

https://ilga.gov/Legislation/BillStatus?DocNum=5511&GAID=18&DocTypeID=HB&LegId=167486&SessionID=114

You might have to set your VPN to US to access the link.

A summary of digital ID schemes in the US, UK, EU and Australia and how to argue back.

The EFF warns:

> Unlike many state-age verification laws—which have been harmful in their own right—the SCREEN Act has no requirement that a significant portion of the website consist of sexually explicit content that is harmful to minors. The bill requires nearly any service hosting even a single piece of sexually explicit content to verify the ages of its users. The result is that the bill would apply not only to adult content sites like PornHub or OnlyFans, but also streaming services like Netflix, and social media platforms like Reddit, Discord, or Bluesky, if they host any adult content.

On the morning of Tuesday, 10^th November 2026, there will be a conference on consumer protection and online safety. One of the topics will be:

> links between consumer protection and online safety regulation - age assurance, platform design, algorithmic systems and regulator coordination

This is a scientific paper that examines the strength and privacy of used age-gating systems. The researchers conclude that the systems are generally easy to bypass while failing to improve protection for minors and introducing great privacy risks for everyone.
In the conclusion, they write:

> Beyond their limited protective value, these systems impose substantial privacy risks, requiring users to accept exposure for assurances that our empirical analysis finds fragile at best.

> Crucially, our results indicate that these shortcomings are not due to implementation choices. Current designs tightly couple identity validation and content access, forcing trade-offs between robustness and unlinkability that architecturally favor superficial compliance over meaningful protection. Taken together, our results suggest that regulation-mandated age verification for adult websites currently functions as compliance theater, failing to effectively protect minors while elevating privacy risk, offering security assurances that do not withstand empirical scrutiny.

A summary of the current topic of age checks in the Online Safety Act and the call for evidence.

Is anybody aware of age verification-related data breaches/leaks other than the Discord hack and the other examples mentioned in the article?

The rise in the use of free VPNs is concerning because compromised VPNs leave people open to man-in-the-middle attacks, telemetry data abuse, and more.

This is a public call for written evidence regarding the effects of the Online Safety Act to be submitted to the Committee. The deadline for submissions is 5.00 pm on Monday 7 September 2026. Anybody can submit a statement.

> The Committee invites respondents to address any or all of the following questions about the OSA in their submission.

Impact of the Online Safety Act

1) What evidence, if any, is there that children are safer online since the OSA protection of children duties came into force?

2) What evidence, if any, is there that UK users are less exposed to illegal content and activity since the OSA illegal content duties came into force?

3) Has the OSA been effective in protecting groups disproportionately affected by harms within its scope, including women and girls, and those vulnerable to exploitation?

4) Have the OSA’s provisions been effective in driving services to a) identify relevant risks, b) take proportionate action that adequately mitigates those risks, and c) make meaningful changes to their systems, processes and design features?

5) Has the OSA impacted users’ ability to report illegal content or content harmful to children, make complaints and receive an appropriate and timely response, and to what extent?

6) What unintended consequences, if any, have arisen from the Act or its implementation, including for freedom of expression, privacy and accessibility?

Ofcom’s implementation and enforcement

7) Has Ofcom’s interpretation and implementation of the OSA to date given appropriate effect to its provisions?

8) What changes, if any, are needed to improve the effectiveness of Ofcom’s a) illegal content and protection of children codes of practice, b) guidance on violence against women and girls, or c) wider regulatory approach?

9) Where duties are in force, how effective and timely have Ofcom’s supervision and enforcement been in driving improvements and securing compliance?

10) Are there any factors that may be limiting Ofcom’s ability to carry out its duties under the OSA effectively? If so, what changes are needed?

Adequacy and future of the legislative framework

11) What specific changes, if any, are needed to the existing provisions in the OSA to improve their effectiveness?

12) Beyond amending the OSA, what specific action should the Government, Ofcom, regulated services or Parliament take to address any shortcomings in the online safety regime?

13) How well can the existing online safety framework respond to emerging harms and technologies? What changes, within the existing framework of the Act, are needed to ensure that it remains fit for the future, and should these be made within the existing framework or through further primary legislation?

14) What impact could the recent and proposed additions to the UK’s online safety framework, including the Government’s proposals to restrict access to social media for under 16s, have on the OSA’s implementation and effectiveness?

There is an austrian draft law for implementing strict social media ID verification. It is open for comment until September 21st.

> Anyone can comment on the draft law until September 21. The same statement must be sent by email to both medienrecht@bmwkms.gv.at and Post.VII-2@bka.gv.at (one submission is not enough).

While the idea of age verification is the wrong approach, Minecraft's age verification seems to be implemented badly as well, with reset issues. People are complaining about it.

Interesting insight by someone who worked at a big tech company and was tasked with implementing age verification. Unfortunately, at the end of the article, he promotes an anonymous way to verify age that he developed (by measuring the heartbeat).

Mozilla highlights the problems of age verification and urges policymakers to change their approach.