“There’s a big spectrum,” said Joe Kaufman, global head of privacy at\u00a0Jumio, one of the largest\u00a0digital identity-verification and authentication platforms.\u00a0He explained that the\u00a0patchwork of state laws\u00a0vary\u00a0in technical demands and compliance expectations.\u00a0“The regulations are moving in many different directions at once,” he said.\u00a0\u00a0<\/p>\n
Social media company Discord announced plans in February to roll out mandatory age verification globally, which the company said would rely on verification methods designed so facial analysis occurs on a user’s device and submitted data would be deleted immediately. The proposal quickly drew backlash from users concerned about having to submit selfies or government IDs to access certain features, which led Discord to delay the launch<\/a> until the second half of this year.<\/p>\n “Let me be upfront: we knew this rollout was going to be controversial. Any time you introduce something that touches identity and verification, people are going to have strong feelings,” Discord chief technology officer and co-founder Stanislav Vishnevskiy wrote in a Feb. 24 blog post. <\/p>\n Websites\u00a0offering adult content, gambling, or financial services often rely on full identity verification that requires scanning a government ID and matching it to a live image. But most of the verification systems powering these checkpoints \u2014 often run by specialized\u00a0identity-verification\u00a0vendors\u00a0on behalf of websites \u2014 rely on artificial intelligence such as facial recognition and age-estimation models that analyze selfies or video to determine in seconds whether someone is old enough to access content. Social media and lower-risk services may\u00a0use\u00a0lighter estimation tools designed to confirm age without\u00a0permanently storing detailed identity records.\u00a0\u00a0<\/p>\n Vendors\u00a0say a challenge is balancing safety\u00a0with\u00a0how much friction users will tolerate.\u00a0“We’re in the business of ensuring that you are absolutely keeping minors safe and out\u00a0and able to let adults in with as little friction as possible,” said Rivka Gerwitz Little, chief growth officer at\u00a0identity-verification platform\u00a0Socure. Excessive data collection, she\u00a0added, creates friction that users resist.\u00a0 Where adult data goes\u00a0<\/p>\n In many implementations, verification vendors \u2014 not the websites themselves \u2014 process and\u00a0retain\u00a0the\u00a0identity information, returning only a pass-fail signal to the platform.\u00a0<\/p>\n Gerwitz Little said\u00a0Socure\u00a0does not sell verification data and\u00a0that in lightweight age-estimation scenarios, where platforms use quick facial analysis or other signals rather than government documentation,\u00a0the company may store little or no information.\u00a0But in fuller identity-verification contexts,\u00a0such as gaming and fraud prevention\u00a0that require\u00a0ID scans, certain adult verification records may be\u00a0retained\u00a0to document compliance.\u00a0She said\u00a0Socure\u00a0can keep some adult verification data for up to three years while following applicable privacy and purging rules.\u00a0\u00a0<\/p>\n Civil liberties’ advocates\u00a0warn\u00a0that concentrating\u00a0large volumes of identity data\u00a0among a small number of verification vendors\u00a0can\u00a0create attractive targets for\u00a0hackers\u00a0and government demands.\u00a0Earlier this year, Discord disclosed\u00a0a\u00a0data breach<\/a> that exposed ID images belonging to approximately 70,000 users through a compromised third-party service, highlighting the security risks associated with storing sensitive identity information.\u00a0<\/p>\n In addition, they warn that\u00a0expanding age-verification systems\u00a0represent\u00a0not only\u00a0a usability\u00a0challenge\u00a0but a structural shift in how identity becomes tied to online behavior. Age verification\u00a0risks tying\u00a0users’ “most sensitive\u00a0and immutable data”\u00a0\u2014\u00a0names, faces, birthdays, home addresses\u00a0\u2014\u00a0to their online activity, according to\u00a0Molly Buckley, a legislative analyst at the Electronic Frontier Foundation.\u00a0\u00a0“Age verification strikes at the foundation of the free and open internet,” she said.<\/p>\n Even when vendors promise to safeguard personal information, users\u00a0ultimately\u00a0rely\u00a0on contractual terms they rarely read or fully understand.\u00a0“There’s language in their terms-of-use policies that says if the information is requested by law enforcement, they’ll hand it over. They\u00a0can’t\u00a0confirm that they will always\u00a0forever be the only entity who has\u00a0all of\u00a0this information.\u00a0Everyone needs to understand that their baseline information is not something under their control,” Tandy said.\u00a0<\/p>\n As more platforms route age checks through third-party vendors, that concentration of identity\u00a0data is also creating new legal exposure for the companies that rely on them.\u00a0“A company is going to have some of that information passing through their own servers,” Tandy said. “And you can’t offload that kind of liability to a third party.”\u00a0<\/p>\n Companies can distribute risk through contracts and insurance, she said, but they\u00a0remain\u00a0responsible for how identity systems interact with their infrastructure.\u00a0“What you can do is have really good insurance and require really good insurance from the entities that you’re contracting with,” she said.\u00a0<\/p>\n Tandy also cautioned that retention promises can be more complex than they appear.\u00a0“If they say they’re holding it for three years, that’s the minimum amount of time they’re holding it for,” she said. “I\u00a0wouldn’t\u00a0feel comfortable trusting a company that says, ‘We delete everything one day after three years.’ That is not going to happen,” she added.\u00a0<\/p>\n Legal battles are not over<\/p>\n Federal and state regulators\u00a0argue that age-verification laws are primarily a response to documented harms to minors\u00a0and insist the rules must\u00a0operate\u00a0under strict privacy and security safeguards.\u00a0<\/p>\n An FTC spokesperson\u00a0told CNBC that\u00a0companies must limit how collected information is used.\u00a0While age-verification technologies can help parents protect children online, the agency said firms are still bound by existing consumer protection rules governing data\u00a0minimization, retention, and security.\u00a0The agency pointed to existing rules requiring firms to\u00a0retain\u00a0personal information only as long as reasonably necessary and to safeguard its confidentiality and integrity.\u00a0<\/p>\n According to Rae Pickett, a spokesperson from the\u00a0Virginia\u00a0attorney general’s office\u00a0\u2014 one of the states that has been actively enforcing age-verification laws \u2014\u00a0officials view strong verification and data-handling standards as inseparable parts of protecting\u00a0young users and ensuring age-appropriate online experiences.\u00a0She\u00a0pointed to litigation against Meta<\/a> and TikTok\u00a0as evidence that inadequate safeguards can expose young users to harmful content and experiences.\u00a0Under the Virginia law,\u00a0companies collecting verification data cannot use it for purposes beyond age determination and must maintain security practices appropriate to the sensitivity of the information under the state’s Consumer Data Protection Act.\u00a0<\/p>\n However, Virginia’s effort suffered a legal setback when a federal court at least temporarily blocked enforcement of its law<\/a> last week, siding with a First Amendment challenge brought by a trade group representing major social media companies. Virginia Attorney General Jay Jones said in a statement to CNBC after the court decision that the AG’s office “will use every tool available to us to ensure that Virginia’s children are protected from the proven harms of unlimited access to these addictive feeds. We look forward to being able to fully enforce the law to keep families safe.”<\/p>\n Buckley says legislators do not need to sacrifice their constituents’\u00a0First Amendment rights and privacy to make a safer internet and address many of the harms these proposals seek to mitigate. In fact, according to the EFF analyst, many lawmakers have recognized these approaches, such as data minimization, in\u00a0existing age-verification\u00a0proposals. But if\u00a0legislators want to meaningfully improve online safety instead of building new systems of surveillance, censorship, and exclusion,\u00a0she said they should pass a strong,\u00a0comprehensive\u00a0federal\u00a0privacy\u00a0law<\/a>\u00a0that protects and\u00a0empowers\u00a0all\u00a0internet users to control how our data is collected.<\/p>\n ‘A permanent feature of online life’<\/p>\n In some countries, age verification laws may already require platforms to use methods like facial age estimation or ID checks, including in the UK, Australia, and soon in Brazil.<\/p>\n Major platforms based in the U.S. are\u00a0staking\u00a0out\u00a0positions on how age verification should be implemented, though not without controversy, as the Discord example suggests, and coming after years of lawsuits<\/a> alleging weak efforts to keep their sites safe for children.\u00a0<\/p>\n Discord said in explaining its delayed global rollout that other than in countries where national laws require certain methods of verification, over 90% of users will never need to verify their age by any methods other than its existing internal safety systems that do not require user action. Though its CTO noted in the recent blog post, “We know many of you believe the right answer is not to do this at all.”<\/p>\n Discord said it is using the additional time this year to add more verification options, including credit cards, more transparency on vendors and technical detail of how age verification will work, and once the system goes into effect, it will publish details on the percentage of users asked to verify age in its existing transparency reports. <\/p>\n Snap<\/a>, which\u00a0operates\u00a0Snapchat, said it supports alternative approaches that reduce the need for platforms to collect identity information directly.\u00a0“We believe there are better, more privacy-conscious solutions such as mandating age verification at the primary point of entry \u2014 the device, operating system, or app store level,” a Snap spokesperson\u00a0told CNBC.\u00a0<\/p>\n Meta and Google did not respond to requests for\u00a0comment.\u00a0<\/p>\n According to Tandy, as\u00a0more states adopt age-verification mandates and companies race to comply, the infrastructure behind those systems is likely to become a permanent fixture of online life.\u00a0Taken together, industry leaders say the rapid spread of age-verification laws\u00a0may push\u00a0platforms toward systems that verify age once and reuse that\u00a0credential across services.\u00a0<\/p>\n “The way the trend is moving is definitely toward some kind of persistent verification\u00a0of a user’s age,” Kaufmann said.\u00a0In other words,\u00a0a digital\u00a0proof of age that travels with the user across platforms.\u00a0<\/p>\n Tandy\u00a0said over time,\u00a0once a system confirms someone’s age, it may not need to ask again.\u00a0She compared\u00a0the model to ecosystems such as Disney<\/a> accounts, where a user’s age\u00a0is\u00a0established\u00a0once and then recognized across its services rather than being rechecked every time they log in, even years later.\u00a0<\/p>\n For adults,\u00a0that means an internet where identity verification is no longer occasional friction\u00a0but a built-in layer of everyday access.\u00a0<\/p>\n
\u00a0
Still, many users perceive mandatory identity checks as invasive. “Having another way to be forced to provide that information is intrusive to people,” said Heidi Howard Tandy, a partner at Berger Singerman who specializes in intellectual property and internet law. Some users may\u00a0attempt\u00a0workarounds \u2014 including prepaid cards or alternative credentials \u2014 or turn to unauthorized distribution channels.\u00a0“It’s going to cause a piracy situation,” she added.\u00a0<\/p>\n![\"We've](\"https:\/\/www.newsbeep.com\/ie\/wp-content\/uploads\/2026\/03\/108266655-17714163851771416382-44089440474-1080pnbcnews.jpg\")
<\/p>\n