Websites Are Being Made to Check Your Age, and the Hard Part Is Doing It Without Knowing Who You Are

A self-declared "I am over 18" checkbox has protected nothing for as long as it has existed, and lawmakers across several major markets have decided it will no longer do. A growing set of rules requires online services — adult content first, but increasingly social platforms, gambling, alcohol and marketplaces for age-restricted goods — to take real steps to confirm that a visitor is old enough before granting access. The obligation is landing on the operator of the service, and "we asked and they clicked yes" is no longer an answer that satisfies it. The uncomfortable part is that verifying an age and protecting privacy pull against each other, and the naive implementation sacrifices the second. The easy way to prove someone is an adult is to demand a government ID or a face scan and store the result, which turns every age-gated service into a database of identity documents tied to exactly the browsing nobody wants recorded — a breach waiting to happen and a surveillance tool by construction. A rule written only to check age can, implemented carelessly, build the most sensitive dataset a service has ever held. The better designs break the link between the check and the identity. Age can be confirmed by a third party that already knows it — a bank, a mobile operator, a digital-identity wallet — which then tells the service only a single yes-or-no fact and nothing else, so the service learns the visitor is an adult without learning who they are. Newer approaches estimate age from a face on the device and discard the image immediately, or issue a reusable, unlinkable token that proves the threshold was passed once. The engineering principle is data minimisation: collect the one bit the law actually requires and design so the rest is never seen, never stored, and never linkable back to a person. For any business that touches age-restricted goods or content, the practical work is to treat verification as a feature to be designed rather than a form to be bolted on. That means choosing a method proportionate to the risk, preferring a provider that returns a bare yes/no over one that hands you a copy of a passport, being explicit with users about what is and is not retained, and keeping in mind that a verification store you did not need is a liability you chose. The mandate is not going away and will widen; the services that come out of it well are the ones that prove age without becoming the identity database the rule never asked them to build.