The processes for both age verification and estimation involve sending sensitive personal information to the platform you\u2019re trying to access. Age estimation requires a photo or photos of your face; your age will be estimated based on those pictures. Age verification is more precise, but it requires submitting a photo of your government-issued ID, one of the most sensitive documents you can provide to anyone, to the platform. <\/p>\n
These tools typically use AI for automated facial recognition. And as we’ve seen with other AI tools, this can have harmful effects for users when there’s no human oversight or a reasonable appeals process. If the AI tool estimates your age incorrectly, it can prevent you from accessing content\u2014or worse. Technology similar to this has been used by law enforcement and apps like Google Photos<\/a> for years. <\/p>\n You can’t just opt out, either. These age estimation tools also typically come with a penalty for not using them. Most platforms will simply prevent an account from viewing 18+ content, but some, like Spotify, will delete or deactivate your account<\/a> if your age is estimated incorrectly or if you refuse to use age estimation or verification.<\/p>\n A Spotify spokesperson tells us that users are given \u201ca 90-day period to allow sufficient time for those who are over the minimum age to take the steps required to pass the ID check. If they do not participate in the age check during this time, their account may be deleted.\u201d<\/p>\n As with any tools that gate people off from certain content, it\u2019s hard not to wonder how far these companies could or would take these tools, which are ostensibly used for child safety<\/a>. Currently, companies like Spotify promise to delete photos or IDs their users upload for age estimation or verification purposes, but will this always be the case? Can you really trust these companies to always keep your data safe?<\/p>\n Should You Trust AI With Your Face?<\/p>\n It may sound like paranoia, but it is a fair question. Your government ID and selfies definitely count as sensitive data. Platforms come and go, and they don\u2019t always tidy up after themselves when they leave. The internet is littered with defunct websites that are an expired license or misconfigured bucket away from spilling all of their users\u2019 personally identifiable information. When 23andMe filed for bankruptcy<\/a>, it left many users concerned for the safety of their genetic data for this exact reason.\u00a0\u00a0<\/p>\n So if, for instance, Reddit is committed to keeping its users\u2019 data safe now as an active website, will it be as conscientious of its users\u2019 data security if it shuts down? When good intentions are not backed up with action, the results can be disastrous. The Tea app, which was ostensibly created to help keep women safer during the dating process, ended up doing the exact opposite when 72,000 of its users\u2019 selfies and photos for identification were leaked in a hack<\/a>.<\/p>\n “When used for age estimation, facial scanning is often inaccurate. It\u2019s in the name: age estimation.” Even when companies claim to delete sensitive data or never retain it, this data can still be at risk. For example, the recent Discord hack exposed age verification information<\/a>, including 70,000 government IDs. The hack was accomplished by breaching a third-party company, 5CA, which Discord contracted to bolster its customer service.\u00a0<\/p>\n Tech Companies Say ‘Trust Us’<\/p>\n The companies adding age verification and estimation to their platforms at least claim to take user data seriously. We reached out to Google for comment on how it plans to keep users\u2019 age estimation and verification data safe on YouTube and got this back: \u201cGoogle uses advanced security measures to protect user data against threats, and you can choose the privacy settings that are right for you, including deleting your data.\u201d Which doesn\u2019t really say much about what those security measures actually are.\u00a0<\/p>\n While Google is building and operating its age verification technology in-house, Spotify has partnered with digital identity firm Yoti<\/a> to manage these processes. In response to questions about the steps it’s taking to keep user data safe, a Spotify spokesperson says, \u201cSpotify does not keep any data (face scans or ID verification) provided by the user for the age checks conducted through Yoti\u2019s integration. The data is provided directly by the user to Yoti, and Yoti immediately deletes the data after the age check is complete. The user is informed of this. Spotify keeps limited data on the outcome of the age assurance check\u2014only the age in years (not date of birth), the method of age check (facial age estimation or ID verification), and the date of the check.\u201d<\/p>\n Additionally, the spokesperson says that Spotify has implemented \u201cpseudonymization, encryption, access, and retention policies\u201d to \u201cguard against unauthorized access and unnecessary retention of personal data in our systems.\u201d Yoti also makes some of the details of its data encryption and security measures available<\/a>, including the use of TLS 1.2 by default and TLS 1.3 where supported.<\/p>\n \n Get Our Best Stories!\n <\/p>\n Stay Safe With the Latest Security News and Updates<\/p>\n Sign up for our SecurityWatch newsletter for our most important privacy and security stories delivered right to your inbox.<\/p>\n Sign up for our SecurityWatch newsletter for our most important privacy and security stories delivered right to your inbox.<\/p>\n \n By clicking Sign Me Up, you confirm you are 16+ and agree to our Terms of Use<\/a> and Privacy Policy<\/a>.\n <\/p>\n Thanks for signing up!<\/p>\n Your subscription has been confirmed. Keep an eye on your inbox!<\/p>\n Privacy Experts Say ‘Not So Fast’<\/p>\n However, online privacy experts don\u2019t think any amount of \u201cadvanced security measures\u201d is enough to justify the use of these technologies. In a statement provided to PCMag, Adam Schwartz, privacy litigation director at the Electronic Frontier Foundation<\/a> (EFF), warns that \u201calgorithmic face scans\u201d are \u201cdangerous, whether used to estimate our age, our name, or other demographics.\u201d He adds that the EFF is in favor of \u201ca ban on government use of this technology, and strict regulation\u2026 for corporate use.\u201d<\/p>\n Schwartz highlights several flaws associated with the use of facial recognition technology. \u201cWhen used for age estimation, facial scanning is often inaccurate,” he says. “It\u2019s in the name: age estimation. That means these face scans will regularly mistake adults for adolescents, and wrongfully deny them access to restricted websites.\u201d<\/p>\n There is also the issue of discrimination, whether it\u2019s Google Photos mislabeling a photo<\/a> of Black software engineer Jacky Alcin\u00e9 and his friend as \u201cgorillas\u201d or the many<\/a> examples<\/a> of facial recognition software<\/a> incorrectly identifying suspects for the police. Face scanning, as Schwartz puts it, is \u201cmore likely to err in estimating the age of people of color and women.\u201d As a result, he adds, \u201cthese face scans will have an unfair disparate impact.\u201d<\/p>\n Schwartz says that age estimation scans \u201ccreate new threats to our privacy and information security,\u201d pointing out \u201cour faces are unique, immutable, and constantly on display\u2014creating risk of biometric tracking across innumerable virtual and real-life contexts\u201d and that \u201cat least one age verification vendor has already experienced a reported breach<\/a>.\u201d<\/p>\n Recommended by Our Editors<\/p>\n Platforms Have Struggled, Too<\/p>\n Privacy advocates, such as the EFF, aren\u2019t the only ones with concerns about age verification and estimation. Content platforms have also felt the strain of compliance with these new laws. \u201cWe have publicly supported age verification of users for years,\u201d a representative for Aylo (parent company of Pornhub and other adult content services) tells us in a statement, \u201cbut we believe that any law to this effect must preserve user safety and privacy, and must effectively protect children from accessing content intended for adults.\u201d<\/p>\n However, the spokesperson says that the regulations enacted by governments like the UK have been \u201cineffective, haphazard, and dangerous.\u201d Asking platforms like Aylo\u2019s Pornhub to collect the sensitive PII required for age verification \u201c[puts] user safety in jeopardy.\u201d \u201cMoreover,\u201d they continue, \u201cas experience has demonstrated, unless properly enforced, users will simply access non-compliant sites or find other methods of evading these laws.\u201d<\/p>\n The representative details Aylo\u2019s experience complying with these laws<\/a>, specifically citing the company\u2019s efforts to comply with regulations in the UK and the state of Louisiana. In both cases, Aylo found that its traffic dropped by nearly 80% after implementing age verification measures. \u201cThese people did not stop looking at porn,\u201d the representative explains. \u201cThey just migrated to darker corners of the internet that don’t ask users to verify age, that don’t follow the law, that don’t take user safety seriously, and that often don’t even moderate content. In practice, the laws have just made the internet more dangerous for adults and children.\u201d<\/p>\n Aylo didn\u2019t just mention the company\u2019s issues with age verification laws, though. The representative proposes what Aylo, as well as many privacy advocates, believe would be the \u201cbest solution to make the internet safer, preserve user privacy, and prevent children from accessing adult content\u201d: perform age verification on the device.<\/p>\n “These people did not stop looking at porn…In practice, the laws have just made the internet more dangerous for adults and children.” The spokesperson points out that \u201cthe technology to accomplish this exists today\u201d and that many Internet-capable devices \u201coffer free and easy-to-use parental control features that can prevent children from accessing adult content without risking the disclosure of sensitive user data.\u201d All that\u2019s missing is \u201cthe political and social will to make it happen.\u201d<\/p>\n Where’s the Oversight?<\/p>\n By handing off the process to AI, users often lack much recourse when their age is incorrectly estimated. As mentioned above, Spotify\u2019s policy in these cases is to either delete your account or request that you provide your government-issued ID to rectify the issue. This is in addition to other concerns, such as the inherent issue of granting AI and large language models access to the vast datasets they require to operate, which could lead to catastrophic data breaches.\u00a0<\/p>\n Age estimation and verification are not without their workarounds and alternatives. Discord users have found success by uploading photos of video game characters<\/a> to bypass the platform\u2019s age estimation process. A good VPN<\/a> can also help access age-restricted content on websites like YouTube as easily as it can be used to access region-locked content on those same sites. YouTube alternatives like NewPipe also exist and can sometimes offer equivalent or better user experiences than the platform they aim to replace. However, most such sites will not be able to provide the same user interface polish as the major platforms.<\/p>\n On the other hand, finding alternatives to the web\u2019s most popular services is difficult, and you can\u2019t be blamed if you still want to use the platforms and tools that everyone else uses, even after being educated on the risks. It\u2019s just important to recognize that companies will always prioritize their needs and safety over yours, and that uploading sensitive information to the internet will always come with risks and vulnerabilities, no matter how safe these companies claim your data is in their hands.<\/p>\n About Our Expert<\/p>\n Zephin Livingston<\/p>\n Contributor<\/p>\n Experience<\/p>\n I’ve been covering the tech industry, with a focus on cybersecurity and AI, since 2021. While most of my work has been on the reporting side, I have also written product reviews, how-to guides, and articles on consumer cybersecurity technology. In addition to PCMag, my work has been published at WIRED, eWeek, Little Village Magazine, IT Business Edge, eSecurity Planet, and FinTech Futures.\u00a0<\/p>\n I primarily cover cybersecurity and AI, focusing on Windows and Android, although I also have experience with macOS, iOS, and Linux. I also cover video games and the communities built within or around them.\u00a0<\/p>\n Most of my work is done on an Acer laptop, though I also use my Samsung Galaxy phone from time to time. On the gaming side of things, I have a PS5 and a Switch.\u00a0<\/p>\n
\n – Adam Schwartz, privacy litigation director at the EFF<\/p>\n![\"Newsletter](\"https:\/\/www.pcmag.com\/images\/newsletter-envelope.svg\")
<\/p>\n<\/p>\n![\"SecurityWatch](\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2025\/07\/17707707-contextual.fit_lpad.size_250x140.v1750711966.png\")
<\/p>\n
\n – Spokesperson for Aylo, owners of Pornhub<\/p>\n![\"Zephin](\"https:\/\/www.newsbeep.com\/au\/wp-content\/uploads\/2025\/11\/01HhjQReUxkxxlOWWS9HQmM.fit_lim.size_100x100.v1763489652.jpg\")
<\/p>\n