Customer identity verification: Roblox may check every user

Customer identity verification, the process banks and other financial institutions use to confirm that someone is who they say they are, is heading toward your kid's game night. Malaysia's government is now studying whether platforms like Roblox should check age with more than a birthday box. Nothing is mandatory yet. But the "type any year and tap continue" era is starting to look shaky.

Customer identity verification comes to online games: what Malaysia is studying

Here is the plain version. Malaysia's Communications Minister, Fahmi, says the government will study the feasibility of eKYC for online gaming platforms, according to The Sun Malaysia. eKYC means "electronic know your customer." It is an all-digital verification process for proving a person is real and their details are true, with no bank branch visit.

Read that again, though. Study the feasibility. Right now there is no official obligation, no deadline and no fine. Anyone telling you otherwise is guessing.

Customer verification versus the birthday box

Today, most games run on the honor system. A child types a birth year, the game believes it, and everyone moves on. Real customer verification (proving the person is real and the age is true) asks for more. Think a photo of an ID document, plus a selfie to show the face matches.

That is also a shift in customer identification (knowing who someone actually is, not just what number they typed). A birthday box knows nothing about the user. An ID check knows quite a lot.

---

Malaysia gaming age verification: what is decided, and what is not

Why would a government care about a kids' game? The research points to two reasons. One is child safety. The other is the worry that gaming platforms could be misused by extremist and terrorist groups. That second reason matters, because it makes the case for stronger ID gates, not just rough age guesses.

Fahmi has also pushed back on the idea that technology can raise children alone. The Malay Mail headline on his remarks said it bluntly: This article is part of a series, start with Atlantic City Hotels Own Face Costs Star Hotel Guest 1 250.

Devices are not babysitters

Fahmi, as quoted in the headline of Malay Mail

Fair enough. Parents are still in the picture. But the platform is being asked to do more of the heavy lifting.

Customer identification and the six age brackets

Meanwhile, Roblox is not waiting for Malaysia. According to Gulf News, starting in early January 2026, every Roblox user must complete an age check to reach chat. The check uses a face-based age estimate or an ID check, done by selfie or video. A vendor processes it, and each user lands in one of six age brackets.

So the industry has already moved first. Policy is catching up to something families can see on their screens.

Sounds precise, right? It is not, quite. A three-year miss means a 15-year-old can look 18. So, per PPC Land, deployments use a "challenge age," a cushion well above the legal line. For an 18 limit, 25 has become standard. Anyone who looks younger than 25 gets pushed to a stronger check.

---

Customer identity verification methods: guessing from a face versus checking a document

Not all checks are the same. Two methods dominate this story, and they leave very different footprints. The iProov explainer draws the line well: estimation is probability, verification is document-backed.

Question	Age estimation	Document eKYC
What it does	Guesses an age range from a face, without naming who the user is	Ties verified identity documents to a face, combining document verification with biometric verification of the person
How sure is it	Probability, with a 2 to 3 year error margin	Definitive proof of age when the document is real
What it leaves behind	Little, if the image is not kept	A persistent record that links face, customer identity and age in one database
Main weak spot	Teens can pass as adults, and adults as teens	Fake documents and weak liveness checks

That third row is the one parents should circle. Estimation can pass and forget. A document check, by design, remembers.

Authentication, liveness and fraud: where the checks can break

Now the uncomfortable part. Authentication (proving the person at the screen is the person on the ID) is only as good as its liveness check (whether the camera sees a live person or a photo, a video, or a deepfake). The research warns that facial systems can be fooled by deepfakes and image tweaks. And those protections are not uniform from one platform or country to another. Previously in this series: Bank Biometric Verification Uae Banking Kills Sms Codes.

So a strict rule on paper can still be weak in practice. The risk is real: fraud rarely goes through the front door when a side window is unlocked. Malaysia's study will have to look at that variance, not just at who gets asked for ID.

---

What does online identity verification mean for a child who is a user?

In short, a child might one day be asked to prove their age with a selfie or an ID before playing or chatting. Online identity verification (proving who you are over the internet) would make that routine. That is protective if done carefully. It is also a lot of personal detail to hand over, so the details matter.

Compliance and security: what a client of any platform can fairly ask

Here is the one useful thing you can do before any rule arrives. When a game asks for age proof, pause and ask three things. First, what is being collected? Second, how long is it kept? Third, is there a less intrusive option? Those match what the brief behind this story urges families to demand. If the answers are vague, that tells you something about trust.

Good security means the platform keeps only what it needs. It means security measures you can actually read about, and a clear promise on deletion. Real compliance (following the rules a law sets) should be something a company can explain in a sentence, not hide behind. Ask plainly. A company that cannot answer is telling you its security story is thin.

And if you have ever wondered whether a photo or profile is really who it claims to be, you are asking the exact question this kind of technology exists to answer. Comparing a selfie to an ID photo is face comparison: are these two images the same person? It answers that and nothing broader. The question to press on is what happens to the data afterward.

Here is my take. Every consumer-facing app will be pushed to prove its users are real, and children will not be exempt. The real fight is not whether kids get checked. It is whether the check is the lightest one that does the job, and whether the data is wiped afterward. A selfie that is checked and deleted is a very different thing from a selfie that lives in a file forever.

One last thing to chew on. If a game can prove your child is 12 by keeping their face and ID on file, who exactly is being protected when that file leaks?

Customer identity verification: Frequently Asked Questions