The internet was built without an age field. For thirty years, 'verify your age' meant checking a box asserting you were over 18 — a fiction everyone understood. That era is ending through legislation rather than engineering: state by state in the US, and country by country abroad, laws now require that the assertion be checked. Louisiana's 2022 adult-content law opened the domestic wave; Texas's app-store age-verification act and Utah's social media laws extended it; the UK's Online Safety Act made it national policy in a major market.
Whatever one thinks of the policy, the engineering consequence is the same: millions of users are being asked, for the first time, to prove something about their real-world identity to use ordinary internet services.
Why it matters
The case for the laws is straightforward and polling-friendly: children's exposure to harmful content and addictive design is a documented harm, self-declaration has obviously failed, and parents cannot supervise what platforms optimize against them. That coalition has proven strong enough to pass laws across the American political spectrum.
The case against is about architecture, not goals. Verifying age at scale means building systems that map real identity to internet usage — ID scans, face-estimation selfies, mobile-operator attestations — and every such system creates a database or a data flow that did not previously exist. Civil-liberties groups, including the ACLU and EFF, argue that age-verification infrastructure is identity infrastructure: it chills anonymous speech, creates breach targets of unusual sensitivity, and historically has not stayed confined to its original purpose. Courts have begun sorting the question, with mixed results — the Supreme Court's 2025 decision upholding Texas's adult-content verification law was the landmark.
How it works
The compliance stack has three layers. The oldest is document verification: upload a government ID to a third-party service, which returns a pass/fail. The newest and fastest-growing is estimation: a selfie analyzed by a model that estimates age without learning identity — vendors like Yoti built businesses on the promise that estimation satisfies verification while avoiding identity databases. The third layer is platform attestation, the model Texas's app-store law pushes toward: the app store or operating system verifies once and vouches to apps, so users prove their age to Apple or Google rather than to every service.
Each design trades the same variables differently — accuracy, privacy, cost and circumvention resistance. Document checks are accurate and invasive; estimation is privacy-friendlier and probabilistic at the boundaries; platform attestation minimizes data spread and maximizes platform gatekeeper power. Regulators writing rules are, often without quite saying so, choosing among these architectures.
Evidence
The legislative record is public: Louisiana Act 440 (2022) began the state wave; Texas HB 1181's adult-content requirements were upheld by the Supreme Court in Free Speech Coalition v. Paxton (2025); Texas's App Store Accountability Act (SB 2420) extends verification to app stores; and the UK's Online Safety Act received royal assent in 2023 with Ofcom publishing its enforcement guidance. The Free Speech Center at MTSU and the National Conference of State Legislatures both track the state-law tally, which has passed twenty states on adult content and continues to grow into social media.
On the technical side, the age-assurance vendor ecosystem is documented in Ofcom's published guidance and the NIST face-analysis evaluations, which measure the accuracy and demographic variance of age-estimation systems — the closest thing to an independent benchmark the industry has.
The competing read
Supporters frame verification as the internet growing up: alcohol, gambling and driving all require proof of age in the physical world, and the online exemption was always an accident of architecture rather than a principle. The harms targeted are real, the technology has matured, and the privacy objections are engineering requirements to be met — estimation without identity retention — rather than reasons to do nothing.
Critics answer that the physical analogy fails on data permanence: the bartender checks your ID and remembers nothing, while the verification pipeline creates records, processors and breach surfaces. They note the uneven burden — verification gates lawful adult speech to reach unlawful minor access — and the enforcement asymmetry, where large platforms comply, small sites leave or block, and determined minors route around with VPNs, as UK traffic data after the Online Safety Act's implementation suggested. Both sides claim the empirical evidence; the honest position is that the laws are young enough that the evidence is still being created.
What happens next
Three fronts will define the next phase. First, the courts: challenges to the social-media variants of these laws are working through the federal circuits, and the app-store model raises dormant-commerce-clause questions the adult-content cases did not. Second, the standardization effort: interoperable, privacy-preserving age attestation — proving 'over 18' without revealing identity — is an active standards problem, and its resolution determines whether the identity layer is minimal or maximal. Third, the international divergence: platforms are already making region-specific architecture decisions, and a fragmented map of age rules may do what thirty years of policy debate could not — partition the consumer internet by jurisdiction in practice, not just in law.