Your Kid's Face Scan Doesn't Vanish — And the Math Behind It Locks Out Real Adults Too

Here's something that will immediately reframe how you think about every "verify your age" prompt you've ever clicked through: the hardest part of an online age check isn't catching a 14-year-old trying to sneak onto an adult platform. It's the quiet math problem hiding inside the algorithm — the one where making the system safer for kids automatically, unavoidably, locks out real 19-year-olds who have every right to be there.

Nobody told you that, because the companies selling age verification products don't exactly advertise it. But once you see it, you can't unsee it — and you'll never look at an age gate the same way again.

The Bartender Who Remembers Too Much

Picture a bartender checking ID. They glance at your birthdate, confirm you're over 21, hand it back. That's the whole transaction. They didn't write down your address. They didn't photograph your face. They didn't share your driver's license number with three other businesses. They answered one question — old enough? — and moved on.

Now picture a digital age verification system that takes a selfie of your face, extracts a biometric template (a mathematical map of your facial measurements — think of it like a fingerprint, but for your face), stores that template on a server, and then shares it with third- and fourth-party companies you've never heard of. All to answer the same single question: old enough?

That's the gap between what age verification needs to do and what many current systems actually do. And according to Tech Xplore, researchers have found that the process used to verify a person's age frequently broadcasts personal information to multiple third-party companies — which means the privacy cost of "checking your age" can be wildly out of proportion to the question being asked.

The Hidden Math Nobody Talks About

Here's where it gets genuinely interesting. Age estimation — having an AI look at a face and guess whether the person is over 18 — sounds like it should be straightforward. Faces look different at 15 versus 35. Easy, right? This article is part of a series — start with Biometric Kiosk Mistakes What Can Go Wrong.

Not quite. According to NIST (the National Institute of Standards and Technology, the U.S. government body that tests these systems), even the best facial age estimation algorithms have a mean error of roughly 1.88 to 2.7 years when estimating ages between 13 and 24. That's not a flaw in a bad product — that's the honest performance of the leading systems, on the hardest age range, which is exactly the range that matters most for child safety.

So if your system is set to flag anyone the AI estimates as under 18, a 17-year-old who reads as 19 to the algorithm slips through. That's the failure you're trying to prevent. The fix seems obvious: raise the bar. Set the system to flag anyone who reads as under 25. That way, you catch more actual minors.

But here's the kicker. Raise that threshold to 25, and now you're blocking every 19, 20, 21, and 22-year-old whose face happens to read young. One provider's own testing found that with the bar set to 25 — seven full years above the legal age — their error rate for actually catching 13-to-17-year-olds dropped to 0.1%. That sounds like a huge win for safety. But the flip side is a steady stream of legitimate adults in their early twenties getting rejected at the door.

There is no setting that eliminates both problems at once. Every system must choose which error it's willing to make more of. This isn't a bug. It's mathematics.

Age Estimation vs. ID Verification — These Are Not the Same Thing

Most people assume these are the same process. They're not. Not even close. And confusing them is exactly how we end up with systems that collect far more data than they need.

Identity verification answers: "Who are you?" It checks your face against a document, confirms your name, your address, your birthdate. It creates a record. It's what banks and governments need.

Age estimation answers something much narrower: "Are you old enough?" A well-designed age estimation system processes your face in real time, produces a single number (the estimated age), and then — crucially — discards the image. No biometric template is created. Nothing is stored. The only output is a yes or a no. Previously in this series: Your Banks Selfie Check Just Got A 35 Million Watchdog.

According to research reviewed by Tech Xplore, age assurance systems are specifically designed to shift the question from "how old are you exactly?" to "do you belong to the right age group?" — and that shift in framing is itself the privacy protection. The system throws away the identity information it never needed in the first place.

Even more interesting: researchers studying these architectures found that age estimation models, by design, perform at or near chance when tested for face verification — meaning they genuinely cannot confirm who a person is, only roughly how old they look. That's not a failure. That's the point. A system that can't identify you can't expose your identity.

"There's no form of age verification that is not privacy invasive... There's basically no perfect system." — Senior Policy Analyst, Electronic Frontier Foundation, as reported by The Fulcrum

That quote is honest. But it's not the whole story. "Not perfect" and "all equally invasive" are very different things — and the difference matters enormously when we're talking about what happens to your kid's face scan after the website decides they're old enough.

Why Everyone Gets This Wrong

The misconception is completely understandable: people assume that if a system is checking your age, it must also know who you are. Like, how can it check without knowing? But that's like assuming a scale must know your name to tell you how much you weigh. The two questions are separate. Always have been.

The confusion persists because many commercial age verification products bundle both together — they collect a full biometric profile, run identity checks, verify a document, and then also estimate age. When that's all you ever see, you start to think the identity collection is required. It isn't. It's a design choice. And it's often a profitable one, because that data has value.

As of early 2026, 25 U.S. states plus the U.K., Australia, and Spain have passed laws requiring age verification online. That's a fast-moving legal wave. But the same research found that most sites covered by these laws don't actually enforce them. So right now, in many cases, the only sites doing aggressive age verification are collecting the most sensitive data — while providing the least actual child protection because enforcement is so inconsistent. The privacy harm scales up before the safety benefit kicks in. That's a bad trade. Up next: 1 In 30 Times The Face Scanner Rejects The Right Person Here.

At CaraComp, we spend a lot of time thinking about what facial analysis systems actually need versus what they end up collecting — and age verification is one of the clearest examples of a system where the data appetite routinely exceeds the task. Understanding the difference between "age check" and "identity check" is exactly the kind of thing that should inform how these laws get written and enforced.

The Question Worth Asking Every Time

Next time an app or website asks you to verify your age — or asks for your child's — the right question isn't "is this safe?" The right question is: what does this system actually need to answer?

If the answer is just "old enough or not," then a system that collects your full ID, creates a biometric profile of your face, and shares it with third parties is collecting roughly 50 times more than it needs. And according to research from The Conversation, cryptographic alternatives already exist that can confirm age group membership without ever exposing the underlying identity data at all.

The bartender doesn't need your home address. The bouncer doesn't need to photograph your face and sell the image. And an app that wants to know if your kid is old enough to use it doesn't need a biometric profile of your child — not if the engineers behind it were actually asked to solve the smallest possible version of the problem.

The real question isn't whether age verification works. It's whether we're willing to demand that it work without taking more than it needs. Because right now, "verify their age" and "collect their identity" have been treated as the same task for long enough that most people don't even realize they're allowed to ask for the difference.