I watched a 12-year-old sketch a fake mustache on her phone camera and log into an older sibling’s account while her mother was in the kitchen. She giggled and said, “They can’t stop us.” I felt that small, fast trick land like an argument you can’t win at a policy hearing.
I spend my days reading rulebooks and watching how tech actually gets used. You’re hearing promises: age gates will barricade kids from harm online. I want to show you why that’s both seductive and shallow, and where the real work should be.
Governments from Canberra to Westminster to state capitals in the U.S. are pushing age checks: Australia barred kids under 16 from social media, the U.K. is preparing similar rules, and some American bills press platforms, app stores, even operating systems to verify ages. Ofcom listed four ways it trusts to check a user’s minimum age—photo ID matching, digital identity services, banking checks, and facial age estimation—but even regulators admit facial algorithms can be off by years around age 16. Preston Byrne, the tech lawyer who’s litigated against foreign regulators, bluntly called the U.K. approach “a law that won’t work.”
A teen showed me a loophole in five minutes: Age gates don’t fix the things that make platforms harmful
At a panel with designers and parents, I watched a former product manager trace how a notification bell hooked a college student. The point is simple: the harm lives in design, not just in who’s on the site.
Lizzie Irwin from the Center for Humane Technology presses this hard: limit algorithmic amplification, rethink variable-reward notifications, remove infinite scroll and the social-comparison mechanics that train compulsive behavior. That argument isn’t anti-safety; it’s a plea to change the machinery that hooks everyone—young and old.
Ariel Fox Johnson of Common Sense Media agrees age checks can help, but she flips the frame: an age gate that simply marks someone “adult” and walks away becomes a liability shield for platforms. I’ve seen this play out in law and engineering—one compliance checkbox, then silence.
When you treat access as the lever, you build paper-thin walls against a storm—a symbolic defense that collapses when motivated users and easy tools meet.
A parent in a kitchen told me her kid fooled a scanner in under a minute: Can online age checks work?
That same kitchen revealed how brittle the tech can be. A drawn-on mustache fooled an age-estimation model; a sibling’s account nullified a whole law.
How do online age checks work?
Regulators and companies are shopping for methods. Ofcom’s menu includes: matching a submitted photo to a government ID, handing checks to third-party digital identity services, using bank or payment-provider data, and running facial-age algorithms. Each choice trades off accuracy, privacy, and accessibility. Facial models can be wrong by several years; photo ID requires teens to have passports or driving licenses; banking checks exclude many young or unbanked users. Apple and Google could be asked to gate who can download apps; app stores already police content. Banks and payment networks sit in a different corner of infrastructure with their own privacy constraints.
Can age gates stop teens from using social media?
Short answer: no, not fully. An Internet Matters survey found about 32% of British children admitted bypassing checks. Kids borrow devices, use VPNs, trade accounts, or otherwise route around rules. Lizzie Irwin compares blunt bans to prohibition—driving behavior into darker corners of the internet. Ariel Johnson pushes back that imperfect enforcement still reduces exposure, the same way ID checks at bars reduce underage drinking even if they’re not foolproof.
Preston Byrne and privacy researchers warn of a second-order harm: building systems that could later morph into pervasive identity requirements. Bart Preneel and a coalition of cryptography academics signed an open letter warning that online age verification risks becoming a universal digital ID for every interaction.
At a city town hall, a grandfather asked “Do we have to give up privacy?”: Age assurance doesn’t have to equal identity verification
He held his wallet as if it proved a larger point: privacy is a currency many aren’t willing to spend for safety.
Ariel Fox Johnson makes a critical distinction: age assurance can be done without turning the internet into a registry of who did what and when. That means privacy-protective options—the ability to prove you’re above a certain age without handing over a full identity dossier. Options could include cryptographic tokens, attestations from schools, or privacy-preserving age checks that do not create long-term logs tied to your identity.
Ben Arc of Nostr and other privacy advocates say anonymity online is a feature worth defending while still creating safe youth spaces. The fear is real: once you require IDs or network-level surveillance to block VPNs, you change the nature of the internet. You create tools governments or corporations can repurpose.
There are laws that take a different tack. California’s Protecting Our Kids from Social Media Addiction Act and New York’s SAFE for Kids Act contemplate age-assurance with privacy safeguards. States like California, Vermont, South Carolina, and Missouri have flirted with design-based Age Appropriate Design Codes—rules that limit addictive mechanics rather than gate access alone.
Platforms and regulators can choose layered answers: product design limits plus privacy-first age checks for specific cases. That avoids building a single, monolithic system of identification.
And yes, you will hear experts who say bans are necessary and others who say they are symbolic. Preston Byrne calls certain laws doomed; Irwin calls access-only bans “political gestures.” Both warnings are useful, because they point us toward the middle road: change product architecture and keep identity light.
Here’s what I would watch for as these policies roll out: who collects and stores age attestations, whether app stores are forced to police age at install, whether banks or identity providers become gatekeepers, and whether facial-age tech is permitted despite high error rates around 16. Keep an eye on industry players—Meta (Facebook and Instagram), X, Apple, Google Play, and banks—because they will shape what is technically feasible and what consumers tolerate.
We can make safer spaces for young people without turning every login into an identity transaction, but that requires rules that shape product design and protect privacy at the same time. Platforms must be pushed to remove the hooks that keep kids scrolling, and regulators must avoid building infrastructure that can be repurposed into surveillance. I believe there is a path that protects kids and preserves anonymity, but it will demand trade-offs from companies and bold choices from lawmakers—are we ready to pick them, or will we let a symbolic ban be the policy we settle for?