Age Gating and Age Verification: Methods, Law, and Tradeoffs

The screen must ask age in a way that does not prompt or encourage a false answer: free-entry date of birth or age field, presented neutrally, with no pre-filled adult defaults, no 'you must be 13 or older to continue' warnings before entry, and no immediate retry after an under-13 answer (session or cookie-based retry blocking so a child cannot back-arrow into a different birthday). Under-13 answers must route to either a COPPA-compliant experience with verifiable parental consent or a no-collection path. The screen's limits matter as much as its form: it establishes the absence of actual knowledge only until contrary evidence arrives, user statements in chat or support tickets, audience analytics you rely on commercially, or content signals can create knowledge notwithstanding the gate, and 'willful disregard' standards in state laws are broader still.

Self-declaration: near-zero friction and privacy cost, near-zero assurance; legally sufficient only where a neutral screen is the standard. Facial age estimation: a live image analyzed for age range, then discarded, moderate assurance with good UX; accuracy degrades near threshold ages (a 12-year-old and a 14-year-old are hard to distinguish), so buffer ages ('challenge 25'-style margins) are standard practice; creates biometric-processing questions in BIPA-style jurisdictions even when images are transient. Document verification: government ID plus liveness matching, high assurance, high friction, high privacy stakes, and exclusionary for ID-less users. Database/credit methods: checks against credit bureaus or mobile-carrier records, adult-skewed coverage, low friction where it works. Vouching/parental confirmation and email-plus for parental consent contexts. Tokenized age attributes: a verified 'over-18' claim from a wallet or third party, the architecture regulators increasingly favor, since the service never sees the underlying ID.

The Supreme Court (June 2025) upheld Texas HB 1181's requirement that commercial sites with substantial sexually explicit content verify visitors are adults, applying intermediate rather than strict scrutiny and holding the statute a permissible exercise of the states' power to shield minors from content obscene to them. The doctrinal shift: hard age verification for adult content is constitutional even though it burdens adults' access, unwinding the assumption, running back to Ashcroft v. ACLU, that such mandates would fail. Consequences already visible: more states enforcing adult-content verification laws, renewed momentum for social-media age laws (whose separate injunctions turn on different reasoning about speech platforms), and platforms building verification infrastructure they had deferred. What Paxton did not do: bless every age-verification mandate, laws gating general-purpose social platforms still face NetChoice-line challenges on their own terms.

Substantially, and this is the design tension the mandates ignore at their peril. ID-based systems concentrate exactly the data breach economics favor: government identifiers, face images, and browsing context (which site asked) in one place, the AU10TIX exposure and adult-site verification leaks made the threat concrete. Legal exposure stacks: BIPA and biometric statutes (facial templates), state privacy laws (sensitive-data consent and minimization), retention rules under the 2025 COPPA amendments where children's data is involved, and deception exposure if 'we delete immediately' claims prove false. Engineering answers: verify through third-party providers returning only a pass/fail or age-band token; contractually and technically bar retention of raw documents and images; process on-device where feasible; log the verification event, not the evidence; and audit the provider like the critical vendor it is. The counterintuitive rule: the more assurance law demands, the less data the system should keep.

Run a proportionality analysis, the framework UK Ofcom, the eSafety regulators, and draft ISO standards converge on. Classify risk: what harm follows from a minor slipping through, data collection (COPPA tier), inappropriate content, contact risks, or commerce (alcohol, gambling, adult content)? Map legal minimums per market: neutral screen (COPPA mixed audience), 'highly effective' assurance (UK OSA for pornography), statutory ID verification (Texas-style laws), parental consent infrastructure (under-13 collection and some state social-media laws). Select the least-collecting method meeting the strictest applicable minimum, estimation with buffers over documents, tokens over raw IDs, third-party over in-house. Design the failure paths: what under-threshold users get (a compliant limited experience beats a hard wall that trains lying) and how appeals work for estimation errors. Document the analysis; every regulator examining an incident asks first why you chose the method you chose.