• 5 min read
Meta, Google, TikTok and Roblox are expanding AI age checks, but false positives, biometric data and First Amendment concerns remain unresolved.
Image: TechXplore Social platforms are moving toward a system that tries to infer a user’s age from behavior, images and social connections—because the child-safety controls regulators want are difficult to enforce without first identifying which accounts belong to children.
The pressure is particularly high for Meta. A recently announced $18 billion settlement with 48 states, the District of Columbia and U.S. territories gives the company a year to strengthen age-assurance systems and subjects their performance to regular outside audits. The settlement resolves claims that Meta deliberately designed Facebook and Instagram to keep young people engaged in ways that harmed their mental health.
Meta has said the measures could become an industry standard. The agreement also sets targets for false-positive rates—cases where minors are classified as adults—and requires Meta to check the ages of a user’s friends if it removes that user after identifying them as under 13.
The legal pressure extends beyond Meta. Google, TikTok and Roblox are also increasing their use of age-assurance systems as governments and public opinion in the United States and other countries turn toward stricter child protections. New Zealand, for example, has proposed barring under-16s from major social platforms and AI companions, a move we covered in the country’s proposed social-media restrictions.
AI estimates age; it does not verify identity #
The distinction matters. A government ID can establish a birth date, but an AI model can only estimate how old someone appears or behaves. Meta accepts IDs for age checks and says it deletes them within 30 days, but many users are reluctant to give a company such as Meta or Google a driver’s license or passport.
Recommended reading
Illinois prosecutors shared immigrant data with ICE
Sophia Reynolds • • 4 min read
On Instagram, Meta’s systems can examine contextual signals such as birthday or school-related posts, the accounts a person follows, the posts they like or comment on, how long they linger on content, their social connections and the times they log in. A user who is consistently offline during school hours, for example, may be treated as likely school-aged.
Meta has also described using images for visual indicators such as height or bone structure. The company says that this process estimates a person’s general age rather than identifying the specific person in an image. It combines those visual signals with text and interaction data to find accounts it believes belong to minors.
Google has taken a similar approach on YouTube. Its age-assurance system uses AI and watch-history signals to distinguish adults from minors. The supplied reporting does not establish the system’s accuracy, the types of accounts it flags or whether Google’s current implementation satisfies the performance requirements in Meta’s settlement.
| Age-assurance approach | What the platforms examine or require | Technical and privacy limitation |
|---|---|---|
| Behavioral inference | Watch history, likes, comments, dwell time, friends, login times and posts | Produces an age estimate, not a verified birth date; can misclassify users |
| Image-based inference | Visual cues such as apparent height or bone structure in uploaded photos | Estimates general age without proving identity; adds sensitive image analysis |
| Government ID check | Driver’s license or passport | Establishes age more directly, but links an identity document to a private platform account |
| Video selfie or face scan | A short video used to estimate facial age | Can be inaccurate for some users and relies on biometric or facial data |
Roblox shows the trade-off. Unlike many social platforms, it allows children under 13 to sign up. The company requires a video selfie for users who want to chat, although a face scan is not required to use the platform generally. Roblox says the video is deleted after processing, but some users have reported inaccurate results.
Matt Kaufman, Roblox’s chief safety officer, said the company’s system can estimate ages within one or two years for people roughly between 5 and 25. That range may be useful for separating young children from adults, but it is a weak boundary when a platform’s rules depend on a specific cutoff such as 13, 16 or 18.
App stores are not a settled escape hatch #
Some platforms, including Meta, have argued that Apple and Google should perform age verification at the app-store level rather than requiring each service to build its own system. That would put the initial check at the point where a user downloads an app.
Apple and Google oppose the proposal. Google has argued that an app-store model would not cover desktop computers or other commonly shared devices, could fail for pre-installed apps and would not necessarily address access through browsers. It would also shift a sensitive identity and age database to the companies that control the major mobile distribution channels, rather than eliminating the underlying privacy problem.
The reporting does not establish that any nationwide U.S. app-store age-verification regime is in force. For American users, the practical result is a patchwork: individual services may deploy behavioral scoring, ID checks or selfie-based estimates, while state and federal rules continue to define what must be restricted and how those checks can operate.
Accuracy and anonymity are the unresolved costs #
Age assurance is intended to prevent children from reaching content and social features judged unsafe or inappropriate for them. But the same systems can affect adults who are incorrectly flagged, including people trying to access news, health information or ordinary online communities.
Facial age estimation can be less accurate for women and for certain racial or ethnic groups. A false positive can block access or force an appeal, while a false negative leaves the child-safety measure ineffective. Meta’s settlement addresses the problem by requiring explicit attention to false-positive rates and independent audits, but the supplied material does not include the thresholds, audit methodology or results.
The privacy objection is broader than whether a company deletes a selfie or ID after a stated period. Age checks can create records connecting an offline identity, a face or a behavioral profile to online activity. The Electronic Frontier Foundation warns that this information can be leaked, hacked or misused, and that age-gating could spread beyond pornography or social media to news, health services and anonymous speech.
That raises a constitutional question in the United States: if “harmful to minors” is defined broadly or subjectively, laws requiring age checks could burden adults' First Amendment rights. The reporting does not say how courts will resolve that issue. Proving that a system can estimate age is not the same as proving that it can protect children without creating a broader identity system for everyone.
Frequently asked questions #
How are social media companies checking users' ages?+ #
They use government IDs, AI analysis of behavior and images, and video selfies or face scans. These systems generally estimate age rather than verify a birth date.
Does Roblox require a face scan?+ #
Roblox requires a video selfie for users who want to chat, but users can access the platform without submitting a face scan.
What happens to IDs submitted to Meta?+ #
Meta says it deletes submitted IDs within 30 days. The reporting does not establish whether all related age-assurance data is deleted on the same schedule.
Is app-store age verification required in the United States?+ #
The supplied reporting does not establish a nationwide U.S. requirement. Apple and Google have disputed proposals that would make app stores responsible for age checks.
Sophia Reynolds Security Editor
Sophia unpacks the invisible wars happening on our networks. Covering cybersecurity, privacy legislation, and cryptography, she exposes how our data is weaponized and defended. Before joining for(geeks), she spent years as a penetration tester. She's the reason the rest of the team uses physical security keys.