Age Verification for Online Safety Act: 12-Year-Old Scans as 15
Quick answer
Does age verification under the Online Safety Act actually work?
Not reliably. Age checks under the UK's Online Safety Act can be fooled, so a pass is only a weak signal. A face scan estimates age from appearance, and children use fake birthdates, borrowed logins, other people's devices and a VPN. Parents should treat a pass as one input, alongside supervision.
A 12-year-old drew a moustache on his upper lip with an eyebrow pencil. He held a phone up to his face. The age check read him as 15. That one story sums up age verification for online safety act rules in the UK, and it should make any parent stop scrolling for a second.
Age verification for online safety act rules can flash a reassuring "verified" label while children still slip through, so treat that label as a hint and never as proof.
Maybe you have a kid who is just getting a phone. Maybe you are the family tech support. Either way, you have probably seen an age pop-up and thought, "Good, that's handled." This piece is about why that feeling is not safe to lean on, and what to do instead.
Age Verification for Online Safety Act Checks: The Moustache Problem
The story comes from The Cyber Express. The UK's Online Safety Act (a law meant to make websites and apps protect children from harmful content) began rolling out in July 2025. Platforms had to prove they were keeping young people away from adult material. Many of them chose the quickest tool: age estimation, where a camera looks at a face and guesses an age.
Here is the catch. A face scan is a guess, not a fact. It looks at skin, bone shape and shadows. It does not know your birthday. So a pencil moustache, a bit of makeup or a bad light can push the guess in the wrong direction. A 12-year-old got to "15" without breaking a sweat.
Online Safety Act Age Verification: What the Check Actually Saw
Think about what happened in that moment. The system never asked for proof of identity (a document that says who you really are). It never asked whether the face was a live person or a photo. It saw a face, did some math, and printed a result. The screen said "verified." The child was never really verified at all.
Five million checks a day sounds like a wall. It is closer to a turnstile that some kids can hop over. Volume is not the same as protection.
Why Do Age Checks Fail? Children and VPN Users Keep Finding the Gaps
Age checks fail because each method has an easy side door. A fake birthday costs nothing. A parent's login is already sitting on the family tablet. A VPN (a tool that hides where you are connecting from, so a site thinks you are somewhere else) can dodge a country's rules. None of these tricks needs special skill, only a determined kid and ten spare minutes. This article is part of a series, start with Deepfake 97 Of School Victims Are Girls Most Under 15.
The numbers in the research are blunt. Among the ways children get around the rules, 13% typed in a fake birthdate, 9% used someone else's login, and 8% borrowed another person's device. Those are not hackers. Those are ordinary kids with ordinary access to a family phone.
Then there is the VPN surge. Reporting from The Canary points to low-tech workarounds and a jump in VPN downloads after the checks arrived. Here is the part that stings. A VPN does not just skip the check. It can push a child toward corners of the internet that have no rules at all. The law meant to move kids away from harm may, in some cases, move them toward worse.
The legislation "will not bring about the changes that children need and deserve."
Barnardo's, the UK children's charity, warning about loopholes in the Online Safety Act
Even France's data protection authority, the CNIL, reached a sobering view. As summarized by SecJuice, none of the age-verification methods available today meets three basic tests at once: reliable results, coverage for everyone, and strict protection of personal data. Pick two. You rarely get all three.
Security Trade-Offs: More Face Data Means More Risk
So why not just make the check tougher? Because a tougher check asks for more of you. Scan a face and you create face data (a stored map of the features that make a face yours). Upload a passport or a digital ID and you hand over your identity. Each step improves the odds of catching a fake and raises the security stakes if that data leaks.
Picture a parent who uploads a photo ID so a teenager can use a chat app. Now a company holds an ID, a face and a name in one place. If that company is breached, the damage is hard to undo. You can change a password. You cannot change your face.
Age Verification for Online Safety Act Platforms: What Is Checked and What Is Not
Not every check is equal. Here is a quick guide to the common kinds, and what each one really proves. Previously in this series: Age Verification Law States 29 Ask Adults For Id Or Selfie.
| Type of check | What it proves | Status of the weak spot |
|---|---|---|
| Typing a birthday into a form | Only that a user can type a number | Open: fake birthdates were the most common bypass |
| Face scan that guesses age | That a face looks roughly a certain age | Open: a drawn moustache fooled one system |
| Document or ID check | That a document exists, not who holds it | Open: borrowed IDs and logins still work |
| Short block after a failed try | That a child waited about 10 minutes | Resolved only as friction, not protection |
Notice the pattern. Each row proves something small. None of them proves the one thing a parent cares about: that the person on the other side of the screen is the age the platform says.
Why Age Verification Flaws Matter for Families
- False comfort: a "verified" label can make parents relax while the real protection is thin.
- Displacement: kids who dodge a check with a VPN may land on less regulated sites.
- Data exposure: stronger checks collect more information about your family, and that information has to be guarded.
What the Act Can and Cannot Promise
To be fair, the other side has a point. Some verification beats none. Even a 10-minute block before a child can try again adds friction, and a determined adult-content site now has to at least ask. A reasonable person would say the law did move the needle a little.
But friction is not a fence. A rule that is easy to dodge mostly stops the kids who were never going to try. The ones you worry about are the ones with a pencil, a VPN or an older cousin's login. That is why national lawmakers keep tweaking the verification requirements, and why the weekly news cycle on this topic is so loud. New age-verification laws from states and countries each add a layer, but the basic puzzle stays: how do you check a person's age without grabbing too much of their private life?
What Parents Can Do Tonight
You do not need to become a security expert. You need one habit: ask what a check really checks. Does the system confirm a live person is in front of the camera, or just any face? (That is called liveness, whether the camera is looking at a live person or a photo.) Does it keep your child's face data, and for how long? A platform that cannot answer in plain words is telling you something.
If you have ever wondered whether a photo or profile is really who it claims to be, that is the exact question face comparison technology exists to answer. The honest version of that tech does not just match a face to a guess. It checks the face against something that can be verified, and it keeps a record of what was checked. That is the standard to hold any age check to.
Meanwhile, keep the human layer. Talk with your kids about why the rules exist. Keep devices in shared spaces when you can. Check who else is logged in. Boring, yes. Also the only method that has never been fooled by an eyebrow pencil.
Age verification for online safety act rules is only as strong as its weakest side door, so judge a platform by whether it protects children and their data, not by whether it shows a green label. Up next: Age Verification For Online Safety Act Boy 12 Scans As 15.
Here is the question I keep chewing on. If a pencil can fool the machine, and a VPN can skip the machine, who exactly is the machine protecting?
Age Verification for Online Safety Act: Frequently Asked Questions
Does an "age verified" label mean my child is safe online?
No. The label only says a check ran, not that it worked. In the reporting, a 12-year-old fooled a face scan with a drawn-on moustache, and children also use fake birthdates, borrowed logins and other people's devices. Treat the label as one small signal. Real safety comes from the platform's settings, your own supervision, and honest conversations at home about what young people see online.
What is the Online Safety Act in plain English?
It is a UK law, rolled out in July 2025, that pushes websites and apps to protect children from harmful content. Platforms must use age checks to keep young people away from adult material. The goal is good. The trouble, according to critics like Barnardo's, is that loopholes let determined kids get around the rules, so the protection is weaker than it sounds.
Can a VPN get around age verification?
Often, yes. A VPN hides your location, so a site may think you are somewhere the rules do not apply. Reporting links the age checks to a surge in VPN downloads, especially among tech-savvy teens. The bigger worry is that VPN users can end up on less regulated sites with fewer protections for children, which can raise their exposure to harm rather than lower it.
Is a face scan or a document check better for privacy?
Neither is simple. A face scan creates face data about your child, and a document check hands over identity information such as a name and birth date. Stronger checks collect more data, which raises the security risk if a company is breached. Ask how long the data is kept, who can access it, and whether it is deleted after the check finishes.
Why did France's data authority say no method is good enough?
As summarized by SecJuice, the CNIL found that no age-verification method meets three needs at once: reliable checks, coverage for everyone, and strong privacy and data protection. Improving one tends to weaken another. A stricter check collects more information, while an easier one is easier to fool. That tension is why national laws keep struggling to produce a clean fix.
What should parents ask a platform about its age checks?
Ask three plain questions. Does the check confirm a live person, or can a photo pass? Is face or identity data stored, and for how long? What happens when a child fails, and how soon can they try again? Platforms that answer clearly are usually taking the work seriously. Vague answers about "advanced security" are a signal to keep your own guardrails in place.
Ready for forensic-grade facial comparison?
Full forensic reports with detailed similarity scoring. Results in seconds.
Run My First SearchMore News
Age Verification Law States: 29 Ask Adults for ID or Selfie
Twenty-nine states now have age checks in force, and your favorite site may be next to ask for an ID or a selfie. Here is what to look for before you hand anything over.
ai-regulationAge verification: Pakistan Says No Law Makes Apps Check Kids
A parent may assume apps are checking their child's age. Pakistan's regulator just told a court it has no legal power to make anyone do it.
digital-forensicsDeepfake: 97% of School Victims Are Girls, Most Under 15
A new analysis found that 97% of school deepfake victims were female. Here is what that number means for your child, and the first thing to do if a fake image ever shows up.