Age Verification ID Laws: California Bill Could Force Face Scans on Users

Picture this: you're 45, you just want to scroll social media on your lunch break, and instead of the usual login screen, an app asks you to upload a photo of your driver's license or let it scan your face. No, you're not buying alcohol. You're not renting a car. You're just trying to check your feed, and a new law might be the reason you're suddenly handing over your most private information.

TL;DR: Age verification id checks are spreading from kid-focused apps into everyday online life, and California's AB 1709, now sitting on Governor Newsom's desk, could push millions of adults into proving their age with a government ID or a face scan just to use ordinary websites.

Here's the situation. California lawmakers passed a bill called AB 1709. It's supposed to keep kids off social media platforms that aren't built for them. Sounds reasonable, right? But the digital rights group EFF (Electronic Frontier Foundation, basically a nonprofit that fights for your privacy and free speech online) is begging Governor Newsom to veto it before it becomes law on January 1, 2027. Their argument isn't "kids don't need protecting." It's "this bill doesn't actually say platforms have to check ID, but in practice, that's exactly what's going to happen."

Why age verification id checks and verification systems worry privacy advocates more than they used to

Here's the twist that makes this different from every other "we're just protecting kids" law you've scrolled past. AB 1709 doesn't technically require companies to collect your government ID or scan your face. It just requires them to verify a person's ageand leaves the "how" wide open. That sounds flexible. It's actually the opposite. When lawmakers give companies freedom to use "any means" to confirm someone is an adult, companies tend to pick whatever method has the fewest false positives, and that almost always means uploading a driver's license, a passport, or letting an age gate scan your face and guess your age from it, a form of facial age estimation that skips a document entirely.

That's not a hypothetical. It's already happening at scale. Half of U.S. states have enacted or are advancing laws requiring platforms to block underage users, many of them leaning on AI-powered tools to do it. Utah, for instance, is mandating age verification on websites despite people simply using a VPN (a tool that hides your location) to get around it, according to ForkLog. Once you multiply that across a dozen states, you get a country where "prove you're an adult" is becoming as routine as typing a password, and the online policy debate keeps circling back to whether these laws respect user identity the same way they claim to protect it. Every new state policy on this topic adds another layer of verification that ordinary users have to navigate, and every added policy tends to outlive the platform it was written for.

How AB 1709 conflicts with California's own age verification tools and card verification methods

Here's where it gets messy. California already signed a different law, AB 1043, that takes a lighter-touch approach: device makers collect your birth date once, during phone setup, and generate an encrypted signal that just tells apps "this user is in this age range", no ID, no face scan, no document upload, and no card verification step at all. It's one of the more privacy-conscious age verification tools on the table right now, closer to genuine privacy-preserving age assurance than anything AB 1709 proposes. AB 1709 basically ignores that framework and opens the door to something far more invasive, which is exactly why the EFF sees it as a step backward, not forward. This article is part of a series, start with Biometric Entry One Setting Flags 42 Of Real Fans.

The EFF argues the bill would result in privacy-invasive checks that step on First Amendment rights, treating ordinary online speech the same way the law treats age-restricted products like alcohol or cigarettes.

reporting from Tom's Hardware

That First Amendment point matters more than it sounds. Buying beer isn't protected speech. Posting on a social platform is. When a law forces you to hand over ID before you're allowed to speak, read, or scroll, that's a different category of problem than an age gate at a liquor store checkout, and courts have historically treated it that way. Privacy advocates argue that any age check policy should start from the least invasive option, not the most convenient one for companies, and that every verification step added to a login flow should have to earn its place.

---

That number isn't a scare tactic, it's the whole argument in one data point. Discord already got hit with backlash after plans resurfaced for a global age verification system, and separately, a breach through a third-party provider exposed roughly 70,000 government IDs that people had uploaded to prove their age. This is the part nobody wants to say out loud: every time a platform asks you to onboard with your ID, it's not just checking a box. It's creating a new pile of sensitive data somewhere, sitting on a server, waiting for the next breach. Age checks don't just verify you, they collect you, and every one of those uploads becomes one more record users never wanted floating around.

What happens if California's age verification id bill becomes law, and what it means for compliance

If Newsom signs AB 1709, here's the timeline: it takes effect January 1, 2027. Companies get roughly a year and a half to figure out their process for compliance, and given how these things usually go, expect the cheapest, fastest option to win, which is exactly the ID-upload or face-scan route the EFF is worried about. California's Attorney General would have enforcement authority, meaning noncompliant platforms could face real financial penalties, which is its own kind of pressure pushing companies toward whatever solution looks "good enough" rather than genuinely privacy-preserving. Previously in this series: Tsa Digital Id 21 States 17 Wallets No Guarantee Podcast.

And it's not just California. Microsoft confirmed that Windows 11 will use age verification to heavily limit features, starting with Teams, according to Neowin. Canada is wrestling with Bill C-34. Pakistan's Islamabad High Court has directed authorities to respond on social media age checks. This is a global age gate moment, not a California-only story, and once your operating system starts asking, there's nowhere left to hide from the question. Every one of these laws creates its own compliance burden, and platforms operating across borders may end up building several parallel age verification systems just to stay compliant everywhere at once, each with its own policy for how long records get kept.

Age verification id and gaming: a preview of what's coming to everyone else

Gaming platforms have been running age verification longer than almost anyone, and they're a useful preview of where this goes. Companies there already juggle fraud prevention, chat moderation, and payment checkout systems that all quietly ask "how old are you, really?" As more general-purpose platforms, social networks, chat apps, even operating systems, copy that model, the amount of identity data floating around multiplies fast, and so does the number of places it can leak from, and so does the number of users affected by any single vendor's breach.

Device-level signal (AB 1043 style)	Direct ID or face scan (AB 1709 risk)	Status
Birth date set once at device setup	Government ID or face scan uploaded per platform	Enacted 2025
Encrypted age-range signal shared with apps	Raw document or biometric data stored by company	Enacted 2025
Lower fraud detection accuracy for edge cases	Higher detection accuracy, higher privacy cost	Pending 2027
Compliant with narrower privacy laws	Compliant with law, but flagged as privacy-invasive by EFF	Pending 2027
Harder for platforms to monetize	Creates a new data asset companies may not want to give up	Pending 2027

Does age verification id mean giving up your privacy to prove a customer's age?

Not necessarily, but it depends entirely on which method a platform chooses, and right now, most laws don't force them to pick the privacy-friendly one. A well-built system can confirm a customer's age using a device-level signal or a one-time check through a trusted third party, without storing your actual ID. A poorly built one just asks for your driver's license and keeps a copy. The law rarely tells companies which to set up, it just tells them to comply, or else. A better standard, sometimes called an age check baseline, would require companies to justify why they need more than a simple age range.

If you've ever wondered whether a request for your ID or a face scan is legitimate or just a data grab dressed up as "compliance," that's exactly the question this whole fight is about. One thing worth watching before you hand anything over: check whether the platform tells you, in plain language, how long it keeps your document and whether it deletes it after the check. If a company can't answer that in one sentence, that's your answer.

What "compliant" actually means for platforms right now, and how privacy factors in

Being compliant with a law like AB 1709 doesn't mean being safe with your data, it just means meeting a legal minimum. Companies can be fully legal while still storing more of your personal information than necessary, because the law focuses on whether kids are blocked, not on how invasively adults get checked. Real privacy protection means limiting what's collected in the first place, not just complying with the letter of a policy once the data already exists.

---

Look, nobody serious is arguing kids should have unrestricted access to adult platforms. That fight is over, and it was won a long time ago. The real fight, the one playing out right now on Governor Newsom's desk, is whether the solution to that settled problem requires every adult in California to learn to live with ID checks baked into ordinary online life. If AB 1709 becomes law without fixing the "any means necessary" loophole, the answer that history writes won't be about the kids it protected. It'll be about the adults who quietly started needing a government-issued ID just to prove they're allowed to exist on the internet.

age verification id: Frequently Asked Questions