Online age checks proliferating, but so are concerns they curtail internet freedom

Online age checks are on the rise in the U.S. and elsewhere, asking people for IDs or face scans to prove they are over 18 or 21 or even 13. To proponents, they're a tool to keep children away from adult websites and other material that might be harmful to them.

But opponents see a worrisome trend toward a less secure, less private and less free internet, where people can be denied access not just to pornography but news, health information and the ability to speak openly and anonymously.

“I think that many of these laws come from a place of good intentions,” said Jennifer Huddleston, a senior technology policy fellow at the Cato Institute, a libertarian think tank. “Certainly we all want to protect young people from harmful content before they’re ready to see it.”

More than 20 states have passed some kind of age verification law, though many face legal challenges. While no such law exists on the federal level in the United States, the Supreme Court recently allowed a Mississippi age check law for social media to stand. In June, the court upheld a Texas law aimed at preventing minors from watching pornography online, ruling that adults don't have a First Amendment right to access obscene speech without first proving their age.

Elsewhere, the United Kingdom now requires users visiting websites that allow pornography to verify their age. Beyond adult sites, platforms like Reddit, X, Telegram and Bluesky have also committed to age checks. France and several other European Union countries also are testing a government sponsored verification app.

And Australia has banned children under 16 from accessing social media.

“Platforms now have a social responsibility to ensure the safety of our kids is a priority for them,” Australian Prime Minister Anthony Albanese told reporters in November. The platforms have a year to work out how they could implement the ban before penalties are enforced.

To critics, though, age check laws raise “significant privacy and speech concerns, not only for young people themselves, but also for all users of the internet,” Huddleston said. “Because the only way to make sure that we are age verifying anyone under the age of 18 is to also age verify everyone over the age 18. And that could have significant impacts on the speech and privacy rights of adults.”

The state laws are a hodgepodge of requirements, but they generally fall into two camps. On one side are laws — as seen in Louisiana and Texas — that require websites comprised of more than 33% of adult content to verify users' ages or face fines. Then there are laws — enacted in Wyoming or South Dakota — that seek to regulate sites that have any material that is considered obscene or otherwise harmful to minors.

What's considered harmful to minors can be subjective, and this is where experts believe such laws run afoul of the First Amendment. It means people may be required to verify their ages to access anything, from Netflix to a neighborhood blog.

“In places like Australia and the U.K., there is already a split happening between the internet that people who are willing to identify themselves or go through age verification can see and the rest of the internet. And that's historically a very dangerous place for us to end up,” said Jason Kelley, activism director at the nonprofit digital rights group Electronic Frontier Foundation.

What's behind the gates is determined by a “hundred different decision-makers," Kelley said, from politicians to tech platforms to judges to individuals who have sued because they believe that a piece of content is dangerous.

While many companies are complying, verifying users' ages can prove a burden, especially for smaller platforms. On Friday, Bluesky said it will no longer be available in Mississippi because of its age verification requirements. While the social platform already does age verification in the U.K., it said Mississippi’s approach “would fundamentally change how users access Bluesky.”

That's because it requires every user to undergo an age check, not just those who want to access adult content. It would also require Bluesky to identify and track users that are children.

“We think this law creates challenges that go beyond its child safety goals, and creates significant barriers that limit free speech and disproportionately harm smaller platforms,” the company said in a blog post.

Some websites and social media companies, such as Instagram's parent company Meta, have argued that age verification should be done by app store owners, such as Apple and Google, and not individual platforms. This would mean that app stores need to verify their users’ ages before they allow them to download apps. Unsurprisingly, Apple and Google disagree.

“Billed as ‘simple’ by its backers, including Meta, this proposal fails to cover desktop computers or other devices that are commonly shared within families. It also could be ineffective against pre-installed apps,” Google said in a blog post.

Nonetheless, a growing number of tech companies are implementing verification systems to comply with regulations or ward off criticism that they are not protecting children. This includes Google, which recently started testing a new age-verification system for YouTube that relies on AI to differentiate between adults and minors based on their watch histories.

Instagram is testing a similar AI system to determine if kids are lying about their ages. Roblox, which was sued by the Louisiana attorney general on claims it doesn't do enough to protect children from predators, requires users who want to access certain games rated for those over 17 to submit a photo ID and undergo a face scan for verification. Roblox has also recently begun requiring age verification for teens who want to chat more freely on platform.

Face scans that promise to estimate a person’s age may address some of the concerns around IDs, but they can be unreliable. Can AI accurately tell, for instance, if someone is 17.5 or just turned 18?

“Sometimes it’s less accurate for women or it’s less accurate for certain racial or ethnic groups or for certain physical characteristics that then may mean that those people have to go through additional privacy invasive screenings to prove that they are of a certain age,” Huddleston said.

While IDs are a common way of verifying someone’s age, the method raises security concerns: What happens if companies don't delete the uploaded files, for instance?

Case in point: the recent data breaches at Tea, an app for women to anonymously warn each other about the men they date, speak to some of these concerns. The app requires women who sign up to upload an ID or undergo a scan to prove that they are women. Tea wasn't supposed to keep the files but it did, and stored them in a way that allowed hackers to not only access the images, but also their private messages.