Why "Upload Your ID" Is the Wrong Answer to "Are You 18?"

Here's something that should make you stop and think: a website can confirm you're old enough to be there without ever knowing your name, your birthdate, or what you look like. The technology to do this already exists. And yet, most age verification systems still ask for way more than that. The question worth asking — and one that regulators are finally starting to ask too — is: why?

Typing "I'm over 18" into a box is basically dead. Nobody believes it works, and regulators have stopped pretending it's acceptable. By the end of 2025, roughly half of all U.S. states had passed laws requiring actual age verification for access to adult content, gambling, alcohol purchases, and certain social media platforms, according to Usercentrics. More laws are arriving through 2026. So websites are scrambling to actually verify age — and that's where things get complicated fast.

Because "verifying age" sounds simple. It is not simple. And how a company chooses to do it will either protect your privacy or quietly turn a routine age check into something that looks a lot more like a background check.

The Gap Between What a Site Needs and What It Collects

Think about what an age check actually requires. A site needs to answer exactly one question: Is this person old enough? Yes or no. That's it. It doesn't need your name. It doesn't need your address. It doesn't need a scan of your driver's license sitting on some server somewhere.

But here's what most existing systems actually collect: your date of birth, your full legal name, your government ID number, sometimes a photo of your face, and the name of every website you verified your age on. That last part is the one people don't think about. Every time you use the same third-party age verification tool across multiple sites, you're potentially building a log of your online activity — all tied to your real identity.

The TLT LLP legal guidance on digital age verification puts the operator's problem plainly: a system must confirm whether a customer is the required age and that the ID information relates to the real person providing it. Two things. Age, and identity match. That's the job. Everything else a company collects beyond that is technically extra — and increasingly, regulators are treating "extra" as a liability, not a safety feature. This article is part of a series — start with Meta Smart Glasses Facial Recognition What It Means For You.

How Age Verification Actually Works (The Technology Part)

There are a few different ways to check someone's age online. They are not all equal — and the differences matter more than most people realize.

The old way: self-declaration. You type in your birthday. The site believes you. This is basically an honor system, and everyone knows it doesn't work. As the Age Verification Providers Association notes plainly: "self-declaration is not age assurance." Regulators agree.

The heavy way: document verification. You upload a photo of your driver's license or passport. A system reads it, matches it against your face via a selfie, and confirms the ID is real and belongs to you. This works well for proving identity — but it's far more than an age check needs. Now a website has your ID scan, your face image, and a record of why you needed to verify. High accuracy, high privacy cost.

The smarter way: facial age estimation. This is where it gets genuinely interesting. A camera takes a single image of your face. Software analyzes the geometry — the depth of lines, the structure of features — and compares those patterns against training data from thousands of people with known ages. The output? Not your identity. Not your name. Just: this person appears to be over 25 (or whatever threshold the site needs). According to IAPP's analysis of facial age estimation, that's all the system needs to produce — a non-identifying age estimate, nothing more.

No name stored. No ID image on a server. Just a number that says "old enough" or "not old enough." The face data is processed and discarded.

"Facial age estimation uses computer vision and machine learning to estimate a person's age based on patterns in their face — the only output is a non-identifying age estimation." — IAPP, on facial age estimation and children's privacy

Think of it like a bouncer at a bar. A good bouncer looks at you and makes a judgment call — you're clearly over 21, you're in. A bad bouncer photocopies your license, writes down your address, and keeps a file on every person who ever walked through the door. Same result, wildly different data footprint. The technology now exists to be the good bouncer. The question is whether companies choose to use it. Previously in this series: Your Phone Becomes Your Passport In 2026 Heres What Could Go.

The Misconception That's Costing People Their Privacy

Here's what most people assume: if a company asks for more information during an age check, it's because they need it to be more secure. More data in = more safety out. It feels logical. It's also wrong.

It's not hard to see why the assumption sticks. Banks require mountains of documentation to open an account. Doctors need your full history before treating you. We're trained to associate thoroughness with trustworthiness. So when a website asks for your ID photo, your selfie, and your date of birth, it feels like they're being responsible.

But collecting and storing identity data doesn't add security — it adds risk. According to Online and On Point's analysis of age verification risks, collecting and transmitting identity data expands a company's attack surface and increases exposure if systems or vendors are compromised — because ID images and verification data are high-value targets for fraud and identity theft. Every ID scan a company stores is a prize sitting in their database, waiting for a breach.

A company that collects only an age signal — yes or no, over the threshold — has almost nothing worth stealing. A company that collects your full government ID has created a liability they may not even know they're holding.

What Regulators Are Actually Saying Now

In February 2026, the FTC issued a policy statement with a message that should reshape how every operator thinks about this: it will not pursue enforcement action against operators who collect minimal information solely for age verification purposes, according to the IAPP's coverage of the FTC's age verification regulatory work. That's not just a suggestion. That's a safe harbor — legal protection, in plain language — for companies that choose the privacy-respecting path.

Read that again: the regulator is telling companies that asking for less keeps them out of trouble. The operator who says "we only verify age, we don't store identity" is not cutting corners. They're following exactly what the government now recommends. Up next: Metas New Glasses Can Log Your Face At A Party And Youll Nev.

Meanwhile, operators who still default to heavy ID collection are accumulating legal risk with every scan they store. At CaraComp, we work with facial recognition and age estimation systems regularly — and the gap between what the technology can do (minimal, accurate, privacy-preserving) and what companies actually implement (maximum collection, minimal thought) is one of the most consistent patterns we see. The technology isn't the obstacle. The decisions operators make about what to ask for — and what vendors they trust — are what shape the user's privacy experience.

TLT LLP's guidance for operators makes clear that businesses now need to enter formal agreements with registered digital verification providers and negotiate specific data minimization clauses. It's not enough to plug in a third-party tool and assume it handles things responsibly. The operator is accountable for what that vendor collects, stores, and transmits.

So next time a website throws up an age verification screen and asks you to upload your driver's license — pause for a second. Ask yourself: does this site need to know my name? My address? The ID number on my license? Or does it just need to know I'm old enough?

Because here's the real aha moment: the companies doing age verification right will never ask you that question. You'll take a quick selfie, the system will say "yep, over the threshold," and it'll throw the image away. No file. No record. No breach waiting to happen. You'll never even know it worked — which is exactly how a good age check is supposed to feel.

The ones that make you feel like you just applied for a passport? Those are the ones worth thinking twice about.