Freedom House Age-gating transforms the internet G overnments around the world have advanced policies to prevent minors from accessing certain internet content, usually citing concerns about children’s safety and mental health. Policymakers in 10 of the 38 countries covered by FOTN had proposed, passed, or implemented age-assurance laws for social media platforms or other nonpornographic online content as of June 2026. Age-assurance mandates require services to deploy certain methods to assess the likely age of users, including methods that involve the collection of sensitive personal data like face scans and photos of government identification. While protecting children online is an important policy aim, the first wave of age-assurance laws presented new risks for privacy and security and threatened online anonymity. Australia’s under-16 social media ban, the first of its kind, entered into force in December 2025. The law requires covered platforms to take “reasonable steps” to verify the WHAT IS AGE ASSURANCE AND HOW DOES IT WORK? “Age assurance” describes methods and technologies that internet services, including websites or social media platforms, use to assign, estimate, or verify a user’s age. As governments around the world adopt laws designed to protect children on the internet, performing age assurance in a privacy-protecting way has become a pressing rights and cybersecurity issue. Age-assurance laws require internet services to confirm a user’s self-attested age. The methods currently available for age assurance rely on previous mass data collection or involve processing sensitive information. Because the process can be technically complicated and expensive, many companies contract all or some age-assurance functions to third-party providers to manage costs, convenience, and legal liability. The largest social media platforms collect extensive data from their users and are able to deploy “age estimation” or “age inference” techniques: trawling and analyzing data for behavioral patterns or other signals that indicate whether a user is an adult or a minor. This is possible when a service retains data that can be analyzed to estimate a user’s age, such as the content of queries and the lifespan of an account. Companies can also purchase data collected by data brokers or signals from another third party, like credit card companies, to attempt age estimation. Other methods require the provider to capture and analyze sensitive personal information. Companies can estimate a person’s age through face analysis, which entails scanning a photo of the user’s face for indicators of age, like facial hair or wrinkles; this method often results in false positives for older teens and false negatives for young adults. Companies can also process a government-issued identification card, a method called “age verification,” which often requires a face photo for identity verification purposes. The cybersecurity risks of age assurance only grow when a third-party company is involved. For example, the social platform Discord disclosed in October 2025 that a third-party customer service vendor had been compromised. The vendor processed requests from Discord users to challenge the platform’s age-estimation results through age verification, and 70,000 government ID photos collected for those appeals may have been exposed in the breach. freedomhouse.org 7