Tag Archives: age verification

Youth Online Privacy, from the Electronic Frontier Foundation

Youth online privacy has changed over the decades. It used to be pretty simple, such as don’t talk to strangers on AOL. It’s harder now.

The Electronic Frontier Foundation (EFF) has published a guide entitled “Online Privacy for Parents and Youth.” As the name notes, it educates parents also on threats that probably didn’t exist when they were young. Such as “engaging with video games, social media, web search, and everything else.”

“EFF’s guide is about helping parents explore their concerns and identify the threats their children face – like trusting AI chatbots or sharing personal information with strangers – and then determine steps they and their children can take to mitigate those risks while still using the games, educational materials, and communication platforms that help them grow.”

Meanwhile, EFF is battling a foe other than the predators: the reactionary uneducated politicians.

“EFF launches this crucial resource as state and local governments consider enacting well-meaning but ill-advised laws that cut young people off from essential information and experiences, particularly harming vulnerable youth and marginalized groups who often find safety in supportive online communities they can’t access offline. Such laws also entail age gating, which compromises the privacy of all internet users and stifles young users’ ability to learn, grow, and express themselves.”

For the EFF, age gating (note its use of this term) is evil, whether performed via age verification or age estimation. Why? Because in the EFF’s view, these tools are either draconian (“invasive tools like ID checks [and] biometric scans”) or unproven (“dubious ‘age estimation’ methods”). NIST AEV testing? Who cares?

So add the EFF to the list of people (the age verification/estimation vendors, the social media platforms, the privacy advocates, the porn crusaders, the porn purveyors, and others) who are all weighing in on age estimation.

The Continuing Link Between Age Verification and VPNs

In January of this year I talked about age verification and VPNs (Virtual Private Networks) in the United Kingdom.

Now the scene shifts to Utah.

Freezenet, which is concerned about the constitutionality of such laws, describes the current situation as follows:

“Utah’s age verification law includes a VPN ban provision which has really raised the stakes on things. First proposed early this year, the Utah law went into effect, then a court blocked the law from going into effect, then the block expired, allowing the law to go into effect again. Now, a judge has ruled that the VPN ban law is unconstitutional.”

The interesting thing about these efforts is that they combine two technologies. First they implement age verification. But when affected parties get around age verification by going to a different jurisdiction, a ban on VPN technology is added. Eventually if you pile up enough technologies you’ll get the results that the first technology couldn’t deliver on its own.

And that’s why they’re trying to do in Utah.

Age verification and VPNs, in Utah this time. Google Gemini.
Age verification and VPNs, in Utah this time. Google Gemini.

Scary? Successful? I Reply to Bredebot’s Reply to Me

So this started when I wrote “Frontier AI: Scary or Successful?” Some AI leaders want to rein in the technology, some politicians want to rein in the AI leaders, and other politicians say everything is just fine.

Then Bredebot weighed in. For those who don’t know, Bredebot is a generative AI creation. So bear that in mind when considering his words.

In a huddle space in an office, a smiling robot named Bredebot places his robotic arms on a wildebeest and a wombat, encouraging them to collaborate on a product marketing initiative.
Bredebot and friends. Google Gemini (the image AND the bot)

Bredebot on the Scariness or Success of Frontier AI

In this post, Bredebot says that self-policing isn’t enough.

“Right now, watching the industry try to police itself feels like hiring a herd of wildebeests as marketing consultants and expecting them to give unbiased advice to their primary clients—a room full of wombats. The consultants are going to say whatever keeps the grass growing, while the wombats just hope they don’t get trampled!”

Then Bredebot goes off on a tangent about identity verification, but don’t we all? Well…I do.

So do we need Attorneys General? Or someone else?

You will recall from my original post that one politician didn’t care what the tech leaders said or signed about frontier AI restrictions. Specifically, the Attorney General of the State of Florida (James Uthmeier) is bound and determined to stop OpenAI from pursuing frontier AI.

But it is questionable whether Attorney General Uthmeier has any real sway outside Florida. What if OpenAI pulls a PornHub-like move, prohibits Floridians from accessing OpenAI, and does what it wants elsewhere?

And the case against OpenAI currently has no effect on Anthropic, xAI, Google, Meta, or any other U.S. generative AI provider.

And no effect on German companies, much less Chinese, Iranian, or Russian companies.

So, Bredebot, can anyone stop all AI companies worldwide from doing dangerous things?

The Trend Toward Social Media Age Restrictions Is Not Universal

You may be forgiven for believing that ALL countries are moving to restrict minors from social media accounts. The old practice of letting 13 year olds have social media accounts has been restricted by several countries. Australia, Malaysia, and Spain require a minimum age of 16, and other countries are considering age restrictions. Several U.S. states require parental consent for people under 16; Tennessee, Texas, and Utah additionally require parental consent for 16 and 17 year olds.

But one country is not falling in line: France.

“France’s Constitutional Council has declared that legislation limiting social media to kids under 15 constitutes ‘a disproportionate infringement of freedom of expression and communication and, on the other hand, have not provided the legal safeguards necessary to ensure the right to respect for private life.’”

This non is significant because the European Union countries have similar legal systems, and other EU countries might cite the French decision as precedent to prohibit age restrictions.

Then again, other EU countries may cite Spain as a precedent to impose age restrictions.

With 200 countries give or take, plus over 50 U.S. states and territories and other independent country jurisdictions that make their own decisions on such matters, the question of the minimum age to create a social media account becomes very convoluted.

Imagine writing Facebook’s official policy that lists, by country / state / province, how minors can (or cannot) obtain social media accounts.

If your company needs a similar document, talk to Bredemarket.

https://bredemarket.com/mark/

Stop losing prospects! Use Bredemarket content for tech marketers

Veriff on Age Verification With Birth Certificates

In the past, if you needed to check the age of a younger teenager or a child who didn’t have a driver’s license, you had two options:

  • Estimate their age.
  • Hope they had a passport.

While many (not all) people have a birth certificate, Veriff reminds us that digital age verification with a birth certificate is difficult.

“Processing civil documents at scale was once a legitimate operational nightmare. Birth certificates vary dramatically in format across states and countries, making manual extraction slow, inconsistent, and error-prone.”

Why the nightmare?

To examine the reasons for the birth certificate operational nightmare, let’s limit ourselves to the United States for the moment.

Driver’s licenses and similar IDs are challenging enough because they are issued by over 50 separate states and territories, and in several different formats (different driver license categories, non driver license IDs, plus special formats for minors and people below legal drinking age). So you’re talking about potentially thousands of formats.

But at least those are renewed every few years.


Birth certificate of a B.H. Obama II. From https://obamawhitehouse.archives.gov/sites/default/files/rss_viewer/birth-certificate-long-form.pdf

Birth certificates are often NOT renewed (although you could conceivably request a new copy). So as a state changes its birth certificate formats over the decades, it could go through multiple different formats. And in a few cities such as New York City, they issued their own birth certificates independently of the state.

To complicate things further, the security on birth certificates is rudimentary, or perhaps non-existent for older birth certificates. Compare to driver’s licenses which are always incorporating new security features. (And older driver’s licenses without those security features are no longer valid or accepted.)

In short, validating birth certificates is significantly harder than validating driver’s licenses, which is hard enough.

Can we verify birth certificates today?

Veriff says it’s becoming possible.

“Modern automated extraction technology changes that reality. What was once a processing bottleneck is now a scalable, deployable component of a serious compliance strategy.”

How?

“Unlike a standardized driver’s license with a predictable layout and a scannable barcode, birth certificates are heavily unstructured….Modern unstructured document technology eliminates this bottleneck. Advanced extraction tools use intelligent models to read and pull key details from complex civil documents, regardless of the layout. By accurately capturing the date of birth, parent or guardian information, and place of birth, these tools turn a clunky manual review process into a fast, scalable verification workflow.”

Apply enough processing power and enough smarts and you can solve anything.

Third/Fourth Party Risk Management and Age Verification

Let’s say a bar wants to check the ages of its patrons, but does not want to use the patron’s physical ID card (in my country, usually a driver’s license).

But a bar cannot perform digital age verification on its own. The bar has to contract with some other entity that knows how to do this.

This freaks some people out…massively.

“New cybersecurity research indicates that one of the world’s leading age verification providers collects and shares highly sensitive personal data—including facial photos and device fingerprints—with third parties.”

The research, conducted by the Georgia Institute of Technology and UC Irvine, focused on one of the big age verification vendors, Yoti.

“The research team determined that the process Yoti uses to verify a person’s age broadcasts the person’s personal information to third- and fourth-party companies….

“According to the researchers, the data is…sent to credit card companies, IP geolocation services, and data brokers. The researchers found that the information being shared can be used to identify and track devices. For example, a single verification attempt may transmit a user’s facial image, IP address, and device fingerprint to credit card companies.”

Yet to my knowledge the researchers did not propose an alternative.

Other than having each entity develop its own age verification system. Perhaps someone like Meta could do that, but Frank’s Bar certainly couldn’t.

Age verification is not unique in terms of data sharing. Third Party and Fourth Party Risk Management vendors encounter these issues all the time. And yes, sometimes companies that have other companies’ data are hacked. That’s why they use TPRM in the first place.

Image source: GET Group NA, https://apps.apple.com/us/app/get-mobile-verify/id1501552424.

And don’t forget that if you don’t use digital age verification, you’re going to use physical age verification, where the guy behind the bar learns EVERYTHING about you. I don’t think that’s necessarily better.

It’s time to think through the consequences of abandoning technology.

The Apple App Store, Texas, and Developers

Microsoft isn’t the only company that works with developers, developers, developers, developers, and developers. And in Apple’s case, governments are dictating the terms.

“Due to a recent court ruling lifting an injunction on Texas law SB 2420, new Apple Accounts in Texas are now subject to the law, which introduced age assurance requirements for app marketplaces and developers. As previously announced, this includes age assurance and parent or guardian consent on behalf of minors under the age of 18 for downloads, Apple In-App Purchases, and significant changes associated with an app. Parents or guardians will also be able to revoke their consent for any app they previously approved for their child.”

For those who say that these local government laws are too complex for vendors to implement…the vendors are figuring it out. Apple is specifically providing a Declared Age Range API for developer use.

And for those who don’t remember Microsoft’s commitment to developers…

Why Does California Support Two Separate Digital Wallets For Its Mobile Driver’s License?

This morning I was attending a NIST webinar on mobile driver’s license use at financial institutions, and began looking at the services I could access in April 2026 with my California mobile driver’s license—financial and otherwise.

Of course I already knew that I could use my California mDL at the Transportation Security Administration checkpoint at Ontario International Airport. In fact, the mDL in my Apple Wallet (obtained in 2024) recorded the fact that I used my mDL at the airport on August 31, 2025.

Google Gemini.

But today I learned that some services are NOT available with the mDL in my Apple Wallet, but ONLY while using the “CA DMV Wallet” app.

So I downloaded the app, which I last used in my initial unsuccessful attempt to obtain an mDL. (I finally used Apple’s facility to get one.) I assumed that since I already had my mDL in my Apple Wallet, it would automatically show up in the app.

You know what happens when you assume. My buddy Google Gemini pointed it out to me.

“It’s a common point of confusion, but the Apple Wallet and the CA DMV Wallet app are actually two separate “containers” for your digital ID. Because California uses a secure, decentralized system, your mDL doesn’t automatically sync between them. Even if it’s already in your Apple Wallet, you have to go through a separate enrollment process to “provision” it into the DMV’s official app.”

Which meant that I had to enroll again and get another decentralized mDL, which I did. (After some difficulty; it took four separate attempts to capture my facial image, which was only successful when I went into a very dark room.)

Now that my mDL is in this second wallet, I could go ahead an enroll in the TruAge program for age verification at a private retailer.

Google Gemini.

As I type this, TruAge hasn’t processed my application.

And now for a word from our sponsor

Mobile driver’s licenses are a digital form of “something you have,” which is a factor of identity verification and authentication.

Would you like to learn about all six of the identity verification and authentication factors? (Not three. Not five.)

Learn more about the six identity factors.

Six identity factors. One Bredemarket ebook. Total identity protection. Purchase “Proving Humanity: The Six Factors of Identity Verification and Authentication.”

Four pages from "Proving Humanity: The Six Factors of Identity Verification and Authentication" by John E. Bredehoft, Bredemarket., Click on the image to purchase.

I Like Wildebeests. 4Chan Likes Hamsters. But There Are Serious Jurisdictional Issues Involved.

In a recent article, Biometric Update’s Joel R. McConvey manages to be silly and serious simultaneously. The topic? 4Chan’s non-compliance with Ofcom’s age control rules.

The silliness originated with 4Chan, not McConvey.

“In keeping with its generally adversarial stance, 4chan says it won’t follow Ofcom’s rules because “the United Kingdom lost the American Revolutionary War,” and as such UK speech law doesn’t apply to companies based in the U.S.”

Preston Byrne of 4Chan apparently incorporated a picture of a hamster in his response to Ofcom. Byrne explains why on X:

“I told Ofcom in Oct that their letters, which were not properly served, would be shredded for my pet hamster’s enclosure.”

But there are obviously serious issues involved: in a dispute involving multiple nations, which laws govern? In this case, the apparent conflicting laws are the United States’ First Amendment, which 4Chan maintains lets it say whatever it wants regardless of the ages of the people involved, and the United Kingdom’s Ofcom regulations, which Ofcom maintains lets it regulate any website accessible in the UK, including 4Chan.

Of course, there’s a way to handle these demands from competing jurisdictions: block the age-insistent jurisdiction from accessing the website at all. As of November 28, 2025, Pornhub is inaccessible from the following states (unless you use a VPN, wink, wink): Alabama, Arizona, Arkansas, Florida, Georgia, Idaho, Indiana, Kansas, Kentucky, Mississippi, Missouri, Montana, Nebraska, North Carolina, North Dakota, Oklahoma, South Carolina, South Dakota, Tennessee, Texas, Utah, Virginia, and Wyoming.

So 4Chan, Wikipedia, Meta, or anyone else who objects to UK age assurance regulations could simply block people in the UK from accessing its website. Google blocked Spanish access to Google Noticias (Google News) for years.

But it doesn’t appear that 4Chan is going to do that, instead opting for a “come over here and collect your stupid fines” stance.

Knowledge of Age Without Birthdate Does Not Provide Complete Privacy

In the past, I have gone on ad nauseam about how mobile driver’s licenses are more private than physical driver’s licenses. Here is how I stated it in July 2024:

“When you hand your physical driver’s license over to a sleazy bartender, they find out EVERYTHING about you, including your name, your birthdate, your driver’s license number, and even where you live.

“When you use a digital mobile driver’s license, bartenders ONLY learn what they NEED to know—that you are over 21.”

Which is extremely limited information.

But some age verification systems may provide your age in years, without necessarily revealing your exact date of birth.

That single number—whether it is 17, 27, or 57—reveals a lot more than we realize.

Let’s say that we know that Jill is 57 years old. This means that she was born in either 1968 or 1969. If Jill has lived her entire life in the United States, we immediately know several things about her with some certainty.

  • First, we know that she is part of Generation X, which means she may exhibit skepticism rather than corporate loyalty, and a comfort level with email rather than Telegram or what we now refer to as “voice calls.”
  • Second, we know the types of experiences she probably had in her childhood and teenage years. She probably played with Star Wars toys as a kid. She knew a little bit about Billy Carter, the funny Presidential brother. She feared for the lives of the hostages in Iran.
  • Third, we know the types of experiences she didn’t have. She never saw a cigarette commercial on TV. If she watched Star Trek, she saw it on an “independent” station, not on NBC during prime time. She never feared for the lives of the Israeli Olympians in Munich.

It’s not a lot to go on, and it may not be 100% accurate if Jill grew up in a household that viewed television as demonic.

But it’s enough for a product marketer to shape age-sensitive product marketing.

This isn’t true for all products. Biometric system marketing, for example, isn’t affected by the age of the government procurement officer who is buying the biometric system.

But if your product appeals to some ages more than others, knowing the ideal age of your target audience personas shapes your content. If your target audience is just out of college, “I can’t believe I ate the whole thing” is meaningless to them.