On-Device Age Checks: A Safer Way to Screen

Key points

• The UK, EU, Australia and several US states are enforcing age verification laws in 2024 and 2025.
• Traditional checks send your face or ID to third-party vendors, which have repeatedly suffered breaches.
• On-device age estimation processes the image locally and sends back only a yes-or-no result.
• Models of this kind perform less accurately on darker skin tones and on women, according to US government testing.

Governments across four jurisdictions are now demanding that websites confirm users are old enough before showing adult content or selling age-restricted goods. As first reported by ThreatVectr, identity vendor Incode is promoting on-device age estimation as a way to meet those rules without accumulating fresh stores of sensitive data. We first picked up the age verification beat on 16 July 2026 with Britain's formal probe into TikTok's child safety checks, and the legislative pressure has only grown since.

The standard approach asks you to upload a selfie or an ID document to a company you've never heard of, which then stores it. That storage has failed badly before. Breaches at AU10TIX and at a contractor used by Discord both resulted in databases of faces and government documents appearing on criminal forums. The data was gathered for legitimate compliance reasons yet kept far longer than necessary.

On-device estimation works differently. A small machine learning model, a program trained to estimate age from facial features, runs entirely on your phone or laptop. Your camera captures the image, the model decides whether you clear the required threshold, and only that single answer goes back to the website. The image is deleted locally. Nothing reaches a vendor's servers.

For most users the practical difference is immediate: instead of handing a passport photo to an unfamiliar company, you point your camera and you're done in a second.

Is this actually safer?

Mostly yes. Removing the central database removes the worst failure mode: there's nothing to steal at scale. But several risks remain below that headline improvement.

Model integrity matters a great deal. If an attacker can substitute a tampered version of the software, they can force it to approve anyone. The channel carrying the yes-or-no answer back to the website also needs securing; a forged result could bypass the camera entirely. Regulators in Britain and the EU are already asking whether "it runs locally" is sufficient assurance, and the answer is probably no.

Accuracy is the other concern. Testing by the US National Institute of Standards and Technology found that age estimation models perform worse on women and on people with darker skin tones. A wrong result affecting one person is an inconvenience; the same error pattern applied across millions of users is a discrimination problem.

Companies evaluating these products should ask three things: where exactly the image is processed, who authorises updates to the model, and what the audit trail looks like when the system makes an error. Those questions won't make the technology perfect, but they'll separate vendors who've thought this through from those who haven't.