On-Device Age Checks: A Safer Way to Screen

Key points

• Four governments (UK, EU, US, Australia) will enforce age verification laws in 2024 and 2025.
• Traditional age checks send images to third parties, risking data breaches.
• On-device age estimation keeps images on your phone or laptop, reducing privacy risks.

Governments in the UK, EU, US, and Australia are rolling out new laws in 2024 and 2025 that will require websites to verify the age of their users. If your site handles adult content, sells alcohol, or hosts a social feed, you must prove your users are old enough to access your services. Traditionally, this involves sending a photo of your face or an ID to a third-party company, which stores it for the verification process.

This method has its risks. As first reported by ThreatVectr, data breaches of these third-party vendors have led to databases of faces and IDs ending up on criminal forums. Companies like AU10TIX and a contractor used by Discord have fallen victim to such incidents.

A newer approach is gaining attention: on-device age estimation. This method uses software to run a small machine learning model directly on your phone or laptop. A machine learning model is a program trained to perform tasks like guessing ages based on facial features. This means the image is processed locally, and only a yes or no answer is sent back to the website. No image is stored or sent to a server, reducing the risk of data leaks.

For everyday users, this change can be significant. Instead of uploading sensitive personal documents, you simply point your camera and get verified in seconds, without worrying about your data sitting in some cloud storage.

Is this actually safer?

Mostly yes, but it is not foolproof. The primary safety advantage is the removal of a central database of faces, which greatly minimizes the risk of mass data theft. However, other security concerns remain. There is a need to ensure that the model used for age estimation is secure and genuine, as a compromised model could be manipulated to provide false results.

Additionally, the privacy of the communication between your device and the website needs protection. If the process is not secure, an attacker might forge the verification result.

There are also fairness concerns. Tests by the US National Institute of Standards and Technology have shown these models can be less accurate for women and people with darker skin tones. This could lead to incorrect age assessments and potential discrimination issues.

For companies adopting this technology, it is crucial to ask questions about where images are processed, who signs off on the models, and what happens when errors occur. As more regions enforce stricter age verification laws, understanding these details will be key to protecting user privacy and complying with regulations.