Age verification device: Windows is now the machine

Your kid's laptop might soon know their age better than the apps do. Microsoft just rolled out something called an Age API, a tool that lets Windows itself tell apps whether a person is a kid, a teen, or an adult, without ever handing over a birthday. That's a big deal, and it's the start of a much bigger shift: an age verification device built right into the operating system, not bolted onto a single app.

TL;DR: Microsoft's new Age API turns Windows 11 into an age verification device that hands apps a broad age bracket instead of your exact birthday, following the same playbook Apple and Google already started, and it's happening because states like California, Colorado, and New York now legally require it.

What an age verification device actually is, and why your phone is becoming one

Here's the plain version. An age verification device is any piece of tech, your phone, your laptop, a kiosk at a store, that checks how old you are before letting you do something. Up until now, that job mostly lived inside individual apps. You'd sign up for a social app, type in your birthday, maybe upload an ID. Every app did its own thing, badly, separately.

Microsoft's new setup changes that. Windows 11 now has an Age API (an API is basically a messenger that lets one piece of software ask another piece of software a question and get an answer back) that apps can use to ask your device, "How old is this person, roughly?" The device answers with a bracket, not a birthdate: under 10, 10 to 12, 13 to 15, 16 to 17, or 18 and up. That's it. No exact age, no ID scan, no stored document. Just a range.

This isn't happening because Microsoft woke up one day feeling generous about your privacy. It's happening because the law now demands it. California's AB-1043, Colorado's SB26-051, and New York's S8102A all require operating system makers to collect age information when you first set up a device, then pass a signal (not your full identity, just a category) to apps through an API when they ask. In other words: this age verification device model isn't optional anymore in some places. It's homework Microsoft, Apple, and Google all have to turn in. This article is part of a series, start with Biometric Data Definition Why Basfs Apple Suit Isnt Privacy .

---

Microsoft age API vs. the old app-by-app system: what actually changes for your family

Let's get specific, because "age assurance" (the umbrella term for any method used to figure out how old someone is) can sound abstract until you picture your own kid's device doing it. Right now, if your teenager wants to use five different apps, five different apps ask for their birthday, and five different companies now hold that data, with five different levels of security about it. That's not privacy. That's just risk, copied five times.

Under the new model, Windows handles the question once, at setup, and apps borrow the answer instead of collecting it themselves. Microsoft's system even splits the concept in two: there's a declared age range (what the account owner said, or what a parent set up), and there's a separate verification status that tells an app whether that age was actually confirmed or just self-reported. That distinction matters a lot. A number labeled "Verified" carries legal weight. A number labeled "Unverified" is closer to an honest guess. As the technical breakdown from Bleeping Computer put it in covering the rollout, the system uses functions like GetUserAgeRangeAsync and GetAgeVerificationStatusAsync, meaning apps get two separate signals: how old you probably are, and how sure the system is about it.

The industry group representing age-check companies has argued the declared age range approach should be treated legally as a parental control tool, not a true age assurance system, a distinction with real consequences for who's accountable when it gets something wrong.

Summary of Age Verification Providers Association position, as reported by Biometric Update

That unresolved fight is worth sitting with. If a declared age range counts as real verification, apps get to relax. If it doesn't, this whole setup might just be moving the paperwork around without actually solving the problem regulators are chasing.

Age verification process: what happens when an app asks your device "how old"

Picture the actual moment. You open an app that has an age restriction. The app quickly reads a signal from your device instead of showing you a form. The age verification process now looks less like a customer filling out paperwork and more like two machines shaking hands. The device already stored an age bracket from setup, the app calculates whether you clear the threshold it cares about, and it lets you in or blocks you. No new data collected. No new records created by that app. The catch is that the device itself now holds something valuable, a running account of age status for everyone who uses it, and someone has to be trusted to keep that accurate and safe.

---

Why age verification matters more once it lives inside a machine you already own

People treat "age verification" like it's just about keeping kids off adult content. It's bigger than that. Once age checks move from apps to devices, three companies effectively become the referees for a huge slice of the internet. Apple already does this with its Declared Age Range system. Google does it through Play's age signals. Now Microsoft's Windows machines join in. That's not a small club, and it's not one you get to vote on.

There's a real upside here that deserves credit. Fewer apps holding your kid's exact birthday means fewer places a hacked database can leak it. That's genuinely good. But "good for privacy inside the app" and "good for privacy overall" aren't the same sentence. The information didn't disappear, it just moved one layer up, into the operating system itself, where you have less visibility and, frankly, less control than you think. Previously in this series: Utah Age Verification Law Vpns Out Id Data In Podcast.

Age verification software vendors and the parent-control gray zone

Age verification software built by outside vendors used to be the thing apps bolted on to check IDs or scan a face for an age estimate. Now that job is partly getting absorbed into the OS itself, which raises an odd question nobody's fully answered: if the device says you're an adult and it's wrong, who's responsible, the device maker, the app, or the parent who set up the account? Right now, the honest answer is "it depends," and that's not a comfortable place for a family to be standing.

---

Old app-by-app age check	New OS-level age verification device model
Each app collects your exact birthday separately	Device holds a declared age range, apps just ask for it
Data stored in dozens of separate app databases	Age signal centralized in one operating system account
No standard for verified vs. self-reported age	Separate verification status flag: Verified or Unverified
Enforcement handled app by app, inconsistently	Enforcement pushed to device makers under state law, enacted in California, Colorado, and New York
Parents configure controls inside every single app	Parents theoretically set it once at device setup

If you've ever squinted at a login screen wondering whether the age gate in front of you is even real, or just theater, that's the exact question this whole shift exists to answer. Here's the one thing worth actually doing tonight: open your kid's device settings and look for the age or family setup section, the one tied to their Microsoft, Apple, or Google account. Check what age range is on file. If it's wrong, fix it now, because that single number may soon be quietly answering "how old are you" to every app on that device without anyone asking your kid directly again.

Age verification: will vending machines and stores start reading your device too?

Here's where this gets a little strange, and a little future-facing. The same logic that lets a social app ask your phone "how old is this person" could, in theory, extend to physical machines. Think about a vending machine that sells something age-restricted, or a self-checkout scanner in a shop that flags an item requiring an ID check. Right now those systems mostly rely on a barcode scan and a cashier eyeballing you, or a standalone scanner reading a physical ID. But the underlying trend, an operating system holding a trusted age signal that any machine can quickly read, points toward vending machines and retail machines eventually skipping the ID card entirely and just asking your device instead. Nothing in the source reporting says this is deployed yet for retail vending or shop scanners specifically, but the architecture Microsoft just built, an age signal any properly authorized machine can query, is exactly the plumbing that kind of combo of device and machine trust would need.

Some privacy researchers point to zero-knowledge proofs (a way for one system to prove a fact, like "this person is over 18," without revealing the actual underlying data, like the exact birthday) as the ideal version of this. A verification vending machine, or an age verification vending machine at a store selling restricted items, could theoretically confirm "yes, adult" without learning anything else about the customer at all. That's the dream version. What Microsoft shipped is closer to a cousin of that idea: not full zero-knowledge cryptography, but the same spirit of "share the category, not the identity."

Is a declared age range the same as real age verification?

No, and that gap is the whole controversy. A declared age range is closer to a parental setting, something typed in once and trusted going forward. Real age verification, the kind regulators actually mean when they write these laws, usually implies some proof behind the number, an ID scan, a credit check, a facial estimate. Industry groups have specifically pushed back on lumping the two together, arguing declared ranges should be governed as parental controls, not treated as equivalent to verified age. Up next: Ai Voice Cloning Scam 1 2 Seconds Fakes A Childs Voice.

---

So here's the part nobody's saying out loud yet. We spent a decade training people to distrust every app that asked for their birthday. Now we're about to train an entire generation to trust one silent checkbox buried in device setup instead, and just hope it was filled in correctly the first time. That's not less trust. That's just fewer places to notice when the trust was wrong.

age verification device: Frequently Asked Questions