Lawmakers want technology companies to limit young people’s access to social media by verifying their age. It’s no easy feat.
U.S. law already prohibits social media and other ad-supported platforms from serving content to children under 13 without parental permission. Now lawmakers and advocacy groups are taking it a step further, with a patchwork of new rules that also prohibit kids under 18 from engaging in certain online activities.
The U.K.’s Online Safety Act, which went into effect on July
Lawmakers want technology companies to limit young people’s access to social media by verifying their age. It’s no easy feat.
U.S. law already prohibits social media and other ad-supported platforms from serving content to children under 13 without parental permission. Now lawmakers and advocacy groups are taking it a step further, with a patchwork of new rules that also prohibit kids under 18 from engaging in certain online activities.
The U.K.’s Online Safety Act, which went into effect on July 25, requires platforms to verify users’ ages before showing some content. In the U.S., several states have passed similar bills. New laws in Texas and Utah require parental permission before a child can download apps or make in-app purchases. This puts the enforcement burden on app-store providers, namely Apple and Google. Other states, like Mississippi, instead ask social-media companies to verify user age.
NetChoice, a trade association whose members include Meta, Google and Reddit, is continuing to challenge the Mississippi law, and has generally opposed government mandates.
“Our members have developed many tools to give parents more visibility and control, and they are continuing to innovate every day to build effective solutions,” said Paul Taske, co-director of NetChoice Litigation Center. Google has even proposed alternative legislation.
Age-verification technology—much of it outsourced to third-party providers like Yoti, Incode and Persona to prevent excessive data collection—isn’t always accurate. Legitimate users have complained about being locked out of their accounts. User error is a problem as well, with some failing to provide the proper identification.
Families sometimes willingly give underage kids access. And often, they just don’t know what the kids are up to. Tech-savvy kids find workarounds, such as using VPN services that mask their location.
Here are the various technologies that the tech companies are using, and the pros and cons of how they work:
Photo IDs
Many platforms rely on using a government-issued photo ID to verify who users are. People fudge these documents constantly, from pasting a different picture to uploading a high-quality fake ID—sometimes even generating one with AI—said Roman Karachinsky, chief product officer at Incode.
The other problem with photo IDs is it assumes that someone will have one and not all people do, said Karl Ricanek Jr., professor of computer science in the college of science and engineering at University of North Carolina, Wilmington.
Parent’s permission
“Some of these age-verification tools are no better than parents being in control of their own children,” said Ari Waldman, professor of law at UC Irvine School of Law. Both are “poor guardrails,” he added.
Yet platforms and app-store providers at times do rely on parents—and others over 18.
Apple and Google let parents create and monitor child accounts. In June, Apple announced a new developer API that allows a parent to share a child’s age range with developers without giving them the child’s birth date, so that apps can display age-appropriate content.
But it isn’t always easy to tell that the so-called parents are being truthful. “You have no idea whether or not you have a true parent that’s doing these validations,” said Ricanek. “And kids are creative—most kids have multiple accounts.”
The video selfie
In 2024, Meta’s Instagram announced teen accounts, limiting what they can see and who they can connect with. Those under 16 are also required to receive a parent or guardian’s permission to make any changes. If someone tries to change their age to over 18, they are required to validate with either an ID check or a video selfie that’s sent to Yoti.
On TikTok, if banned users want to prove they are of age, they can provide a credit card for a temporary charge or send a photo of their government ID along with three selfies. TikTok works with Incode, which uses zero-knowledge proof tokens—essentially confirming age without disclosing personal information—to ensure privacy. Banned users can also ask their parent or guardian to confirm their age.
“We’re minimizing data and not asking for too many things,” said Ricardo Amper, chief executive of Incode.
The verifying process can be hard to get right. Users need to take a high-quality video selfie in a well-lit room, said Karachinsky. (The company guides users through the process and can also help them fix it live.)
And the rise of manipulated, deepfake video makes the job even harder, he added. “Even for comparatively lower-stakes use cases, you need technology that can catch the advanced attempts,” he said.
In the U.K., Reddit works with Persona to request an uploaded selfie or a government ID. After Persona verifies the user’s age, Reddit only receives and stores the user’s birth date and verification status.
The AI guess
In mid-August, Google started to use AI to figure out a user’s age based on signals they are sending to the platform: what they’ve searched, what YouTube videos they’ve watched. Indirect signals could be a good way to check without involving the user. Meta also says it uses technology to estimate age based on activity.
But it’s hard enough just differentiating between users in the first place, said Ricanek. “We’re assuming that everybody has their own personalized individualized account and that doesn’t happen as well.”
Safety vs. privacy
Getting age verification right means nailing accuracy without collecting too much data.
The Kids Online Safety Act is legislation that sailed through the Senate but is stuck in the House. This would push big tech companies to address the host of risks posed to children on their platforms, from deceptive marketing to sexual exploitation. It might never become U.S. law, but if it does, platforms will need to know exactly who the children are.
“If companies are going to be required to do age verification, they must do so in a rights-respecting way,” said Aliya Bhatia, senior policy analyst at the Center for Democracy and Technology, a nonprofit organization.
Write to Ann-Marie Alcántara at ann-marie.alcantara@wsj.com
One Subscription.
Get 360° coverage—from daily headlines
to 100 year archives.
Archives
HT App & Website