Governments around the world are increasingly turning to age gates to protect children from potentially harmful content and experiences online. Australia’s nationwide social media restrictions for children under 16 are part of a much broader push for age verification, with lawmakers and regulators in the U.K., European Union, and many U.S. states considering or implementing similar requirements.
The U.K. is preparing to follow Australia’s lead with its own social media restrictions for children under 16, while American states have increasingly pursued legislation requiring age verification at different layers of the tech stack. Some proposals would require social media platforms to determine the ages of their users, while others would push those requirements down to app stores and even operating systems.
These proposals have also raised concerns that more governments could eventually restrict the use of privacy tools like virtual private networks (VPNs) to prevent people from circumventing age restrictions. However, as we recently covered, eliminating those workarounds would require increasingly invasive forms of identity checking, network surveillance, and device control that are simply incompatible with a free society.
Preston Byrne, a technology lawyer qualified in both the U.S. and U.K. who has represented several American websites in legal disputes with foreign regulators, argued on X that the U.K.’s proposed restrictions would be no more effective than Australia’s. “Parliament enacted a law that won’t work,” Byrne posted. “Ofcom is proposing implementation rules that also won’t work. A law that is doomed to fail is not a good law.”
In late October, the U.K.’s communications regulator, Ofcom, outlined four methods it considers capable of reliably establishing whether someone is at least 16 years old: photo identification matching, digital identity services, banking-based checks, and facial age estimation. However, Ofcom acknowledged that some facial age-estimation technologies have a margin of error of several years at age 16, meaning platforms may need to require additional verification from users whose estimated ages fall within a certain range. It also noted that 16- and 17-year-olds without photo ID may need to obtain it to access age-restricted services. The government expects the restrictions to take effect next spring.
These policies are part of a much larger debate about which layer of the tech stack age restrictions should be implemented at (if at all) and how much personal information people should have to surrender to use the internet. For now, the age gates being proposed for social media platforms offer a useful starting point for examining how these regulations could or should work.
Representatives from Common Sense Media (CSM) and the Center for Humane Technology (CHT), two organizations that have advocated for a safer and healthier online environment, shared their perspectives with Gizmodo. Both argue that protecting children online requires more than simply restricting their access to social media through age gates. They also support addressing harmful platform features and ensuring that any age-assurance requirements protect users’ privacy.
However, they differ in how much value they place on age gates as a tool for protecting children. Irwin emphasizes structural changes to platforms, while Johnson argues that imperfectly enforced age restrictions can still serve a useful purpose.
“The framing of ‘safety versus privacy’ is itself part of the problem that the Center for Humane Technology is working against,” CHT Policy Communications Specialist Lizzie Irwin told Gizmodo. “It lets platforms off the hook while putting the burden on individuals to prove who they are.”
CSM Senior Advisor for Data Privacy Ariel Fox Johnson also sees privacy versus security as the wrong framing:
“Privacy versus safety is a false trade off — it’s possible to protect privacy and free expression, and at the same time offer age-appropriate experiences for kids. One common misconception with assessing age is that it’s the same thing as assessing identity–the two should not be conflated. You can figure out how old someone is without knowing who they are, and there are increasing technical options for companies to do this.”
Age Gates Don’t Address the Underlying Problems
For Irwin, the central problem with blanket age restrictions is that they focus on controlling who can access a platform rather than addressing the design choices that can make those platforms harmful in the first place. CHT would prefer to see lawmakers target features such as algorithmic amplification, variable-reward notifications, social comparison mechanics, and infinite scrolling, which can encourage compulsive engagement and negatively affect users regardless of their age.
“No system of regulations will be effective if the underlying architecture of the social media platforms stays intact,” said Irwin. “Harmful design features don’t become safe when the user turns 18.”
Johnson similarly noted, “Not all age rules are about gating content–in many cases, they can and should be about gating harmful product features and designs.”
According to Irwin, once someone passes an age check, they are generally treated as an adult without further safeguards. “Instead of being a viable system to protect children, it’s a liability shield for platforms,” she added.
Irwin also argued, “Age assurance applied at the design-feature level is more minimally invasive, more constitutionally defensible, and almost certainly higher impact than blanket access restrictions.”
To be clear, Irwin isn’t necessarily opposed to establishing users’ ages, but she emphasizes the distinction between age assurance and identity verification.
Can Online Age Checks Work?
There are also questions about whether age gates can accomplish what their proponents intend. Children have already demonstrated that they can find ways around existing age-verification systems by using their parents’ accounts, VPNs, or other people’s identification, or even by fooling facial age-estimation software.
Irwin pointed to an Internet Matters survey of 1,270 British children aged 9 to 16 and their parents, which found that roughly 32% of children admitted to bypassing age checks. One parent discovered that their 12-year-old had drawn a fake mustache on their face to fool an age-estimation system, which subsequently estimated the child to be 15. “That’s not a sophisticated hack,” Irwin added.
Irwin said these examples demonstrate the limitations of relying on age gates as the primary means of protecting children online. “Yes, I am concerned, and there’s already evidence of how quickly these systems fall apart,” she said. She also warned:
“Online piracy is a helpful comparison. Prohibition without structural change pushes the same behavior toward less regulated and less visible spaces. A teenager who wants access will find a way . . . The Center for Humane Technology believes that a ban without structural accountability is only a political gesture — and political gestures don’t survive contact with a motivated teenager and a free proxy server.”
Johnson offered a different perspective, arguing that the possibility of circumvention shouldn’t automatically disqualify age restrictions as a policy tool:
“Perfection should not be the enemy of the good. Just because some minors may be able to get around an age restriction doesn’t mean we should not do it. We don’t stop checking age at nightclubs or for adult purchases just because sometimes minors sometimes make their way around them.”
Irwin pointed to Age Appropriate Design Code-inspired legislation in states like California, Vermont, South Carolina, and Missouri as examples of the kind of legislation championed by the Center for Humane Technology. “What’s commendable about it is that it is design-based rather than access-based — and it’s future-proofed,” Irwin said.
Irwin further emphasized the importance of legislation that can evolve as the online landscape changes:
“We know the harms of today’s social media, but we can’t fully anticipate what’s coming, especially with AI’s rapid development, but what we do know is young people will be drawn to what’s newest on the market. A law that can iterate alongside new technology is far more durable than one that’s narrowly prescriptive about patterns we already know and is limited in its scope of product coverage where kids are likely to need safeguards. That’s the right approach, especially as the public demands action to hold platforms accountable for harm to minors.”
Johnson, meanwhile, pointed to New York’s SAFE for Kids Act and California’s Protecting Our Kids from Social Media Addiction Act as examples of legislation that could incorporate privacy-protective age-assurance requirements.
Age Assurance Doesn’t Have to Mean Identity Verification
According to Johnson, age-verification requirements should still meet several important conditions, so as to not become the sort of overbearing, invasive restrictions on internet use that everyone wants to avoid. “Age assurance should be privacy protective, proportionate to risks of harm, fair, and equitable,” Johnson said. “Any legislation requiring it should offer individual options, including ones that do not require ID.”
“The moment the regulatory regime depends on platforms to build dossiers on who accessed what and when, it’s no longer a child protection tool. It’s surveillance infrastructure dressed up as parenting,” Irwin added.
For many internet users, including Nostr.com’s Ben Arc, online anonymity and privacy are essential features of the internet that must be preserved. “All of us agree we should protect children from adult content, most of us agree the X algorithm is evil, few of us agree in losing the right to online privacy/anonymity,” Arc told Gizmodo. “As privacy advocates who understand the pitfalls of blanket censorship policies, it is our role to educate the well-meaning online safety advocates by building tools that solve problems like creating safe spaces for young people in a more nuanced way.”
Some critics see age-related regulation at any layer of the tech stack as unacceptable, arguing that it could be the first step toward building infrastructure for constant surveillance of internet activity tied to specific identities. “Offline age checks (e.g., for alcohol or casinos) are limited, local, and leave no lasting trace,” Bart Preneel, president of the International Association for Cryptologic Research, posted on X earlier this year in a thread announcing an open letter signed by more than 370 security and privacy academics. “Online age verification risks becoming a permanent ID requirement for nearly every digital interaction.”
This tension is unlikely to disappear as governments continue pursuing age restrictions across different parts of the technology stack. Even relatively privacy-conscious proposals require people to participate in some form of age-assurance system, and the distinction between proving someone’s age and establishing their identity may become increasingly important as these systems become more widespread.
For Irwin, the goal should extend beyond deciding who is allowed to use particular platforms to creating a healthier environment for everyone online. “Children deserve environments designed for their flourishing. So does everyone else.”
