As the **UK's Online Safety Act** came into full effect in July 2025, a legal obligation now mandates platforms hosting content deemed 'harmful' by the UK government and regulator **Ofcom** to verify users are over 18. This regulatory push, while aimed at child protection, introduces a complex landscape of digital rights and privacy challenges. For users in the UK, platforms like **Reddit** and even **iPhones** are now implementing age checks. Understanding the data collected and the potential threats to personal safety is crucial. ## The Nuances of Age Verification Data Age verification processes vary widely, and each method carries distinct privacy implications. Users are often left to investigate individual providers to understand their data practices. Key considerations include: * **Data Collected:** What specific information does each method require? * **Access:** Who can view the data during verification? Does any information beyond an age confirmation leave your device? Which third-party services are involved? * **Retention:** How long is the data stored, and by whom? Is it deleted immediately, or does it persist, posing a risk in the event of a data breach? * **Audits:** Are there independent, security-focused audits (e.g., by **NCC Group** or **Trail of Bits**) to verify providers' claims regarding data access and retention, beyond mere compliance certifications? * **Visibility:** Who is aware of your age verification attempt? Does the third-party provider build a profile based on your verification activities across different platforms? **Ofcom** has outlined several age verification methods. Let's examine some in detail. ## Common Age Verification Methods and Their Risks ### Facial Age Estimation This method, offered by companies like **Yoti** or **Persona**, involves analyzing a photo or video of a user's face to estimate their age. While **Yoti** claims immediate and permanent deletion of facial images post-estimation, most third-party services upload your photo to their servers. Users should be wary of potential leaks of current facial images, especially if background elements could reveal location or other sensitive information. Some services, such as **k-ID** and **Private ID**, perform on-device analysis, meaning only the age result leaves your phone, enhancing privacy. If using this method, ensure your selfie background is neutral and non-identifying. ### Photo-ID Matching Considered one of the most sensitive methods, photo-ID matching requires users to upload a government-issued document like a driving license or passport, alongside a selfie. This data is then compared to confirm identity and age. Providers like **Yoti** and **Incode** are commonly used. While some platforms, like **TikTok**, claim to initiate data deletion processes with providers like **Incode** post-verification, **Incode**'s privacy policy indicates it doesn't automatically delete user data. Users can, however, request data deletion directly from **Incode**. The past serves as a cautionary tale: **Discord** previously used a system where users submitted ID photos to a general help forum, leading to a significant data breach. While **Discord** has since changed its system, it highlights the risks associated with third-party data handling. ### Open Banking and Credit Card Checks **Open Banking** allows age-check services to securely access banking information to confirm if a user is over 18, without sharing the full date of birth. Similarly, credit card checks are used, particularly for adult content services, leveraging the fact that individuals must be over 18 to obtain a credit card in the UK. While seemingly less intrusive, these methods still involve sharing financial data with third parties. ### Email Verification Email-based age estimation involves providing an email address to a third-party technology that analyzes its usage across other online services (e.g., banking, utilities) to estimate age. While this aggregates some data, the primary new information obtained is your intent to verify age via that email address. ### Mobile Operator Checks This method involves granting permission for an age-check service to confirm if age filters are applied to your mobile phone number. The absence of such restrictions confirms you are over 18. This approach relies on existing mobile network operator data, but still introduces a third party into your data flow. ## The Elusive Goal of Perfect Privacy in Verification Unfortunately, a truly perfect, privacy-preserving age verification service remains elusive. Each method presents trade-offs between convenience, accuracy, and user privacy. As the digital landscape increasingly demands age assurance, IT security professionals and privacy-conscious users must remain vigilant, scrutinizing the practices of verification providers and advocating for stronger data protection standards and transparent auditing.