Face Scan App Age Checks in Texas: Face ID Fight Hits SCOTUS

Imagine picking up your phone to download a weather app. Before it installs, your phone asks you to prove how old you are. You'd need to upload a government ID, or let a camera scan your face. For a weather app. That's not a hypothetical. That's what's already happening in Texas, and the Supreme Court just got pulled into the fight about whether it should keep happening.

Here's the part that should make you stop scrolling. Texas Senate Bill 2420 doesn't just target apps with adult content. Under this law, before a Texan can download the Wall Street Journal app, a calculator, or a recipe tool, they must first prove their age. That's a genuinely new thing. We've seen age checks pop up on websites that host explicit content. But this law moves the checkpoint to the front door of your entire phone, the app store itself, before you've even looked at what an app contains.

A federal appeals court let the law take effect. Then Washington Examiner reported that Justice Samuel Alito stepped in, requesting Texas officials respond to an emergency petition by 4 p.m. on June 22. That's the Supreme Court saying: hold on, we need to look at this. This isn't just a Texas problem anymore.

The Checkpoint Is Moving, And That Changes Everything

How a Face Scan App Replaces the Old ID Check

A face scan app works differently than typing in a birthdate or handing over a driver's license. Instead, the camera on your phone captures your face, and software estimates your age from facial features like bone structure and skin texture. Some versions call this facial recognition, though age estimation and identity matching are not the same process, even if they use similar cameras and similar data pipelines.

Think of the internet like a mall. Until now, the age check happened at the door of individual stores, the ones selling things meant for adults. What Texas is doing is moving the bouncer to the parking lot. Before you even walk in, you prove who you are and how old you are. Every store, every visit, no exceptions.

That's a massive shift. And it raises a question nobody's fully answered yet: what exactly are you handing over when you prove your age, and where does that information go?

The two main methods being floated are uploading a government-issued ID (your driver's license, your passport) or using facial age estimation, where a camera looks at your face and guesses how old you are based on your features. Both carry real risks. Your ID contains your name, address, date of birth, and ID number. That's a gold mine for identity thieves. Peer-reviewed research published by the International Association of Crime & Justice Sciences found that collecting personally identifiable information (PII, your name, address, ID numbers, the stuff that makes you you on paper) for age verification creates high-value targets for cybercriminals. Gather enough of it in one place, and it's not a question of if that data gets breached. It's when. This article is part of a series, start with One Stolen Badge Shouldnt Unlock Your Whole Office Heres Wha.

That Carnegie Mellon number tells a quiet story. Most people, when actually faced with "upload your ID to continue," just don't. They leave. Which means age verification doesn't just filter out kids, it filters out adults who value their privacy, adults who don't have a government ID, and adults whose ID doesn't match how they present themselves online. That last group includes transgender people, undocumented immigrants, and anyone whose legal identity is complicated. A law designed to protect children quietly walls out some of the most vulnerable adults.

When the Camera Guesses Wrong

Face Scan Accuracy and the Data Behind It

A face scan sounds simple, but the data behind it is not. Every face scan app relies on a dataset of faces used to teach the software what a 14 year old face looks like versus a 30 year old face. When that training data skews toward certain groups, the resulting facial recognition tool inherits those blind spots, and no amount of polished app design fixes a flawed dataset.

Facial age estimation sounds cleaner than uploading an ID. No documents, no personal data, just look at the camera. But "looks clean" and "is clean" are two different things.

Here's the hidden problem: these systems don't know your age. They guess it, based on patterns they were trained to recognize. And the Electronic Frontier Foundation has documented something important about how those guesses go wrong. People with Black, Asian, Indigenous, and Southeast Asian backgrounds are more likely to be misclassified by these systems. An adult in their 30s gets blocked because the algorithm read their face as younger than 18. That's not a minor glitch you fix with a software update, it's a structural problem baked into how these models were built and trained.

So the "neutral" tool turns out not to be neutral at all. It works better for some faces than others. And when it's the gatekeeper for downloading apps, ordinary, everyday apps, getting blocked isn't an inconvenience. It's exclusion.

"There's a lot of products where kids are playing and where they're spending time, and have product safety regulations and product safety tools, and the laws targeting product features or laws require more privacy protected defaults." Common Sense Media, as cited in expert analysis of age-verification legislation

That argument, treat digital products like physical ones with safety standards, is genuinely persuasive. Parents feel it. It's why 18 other states have passed similar laws, often with bipartisan support. Nobody wants their 11-year-old sliding into spaces built for adults. That's a real concern, and it deserves a real response, not a dismissal.

The problem is that "real concern" and "effective solution" aren't the same thing. According to Route Fifty, experts are divided on whether age verification technology is accurate enough to be a gatekeeper at all, and on whether the First Amendment (the right to free speech, including the speech you receive when you read an app) even allows the government to put a checkpoint in front of ordinary information. Previously in this series: Feds Want Your Id Before You Spend A Digital Dollar You Have.

What You Should Actually Watch For

Face Scan, Beauty Scan, and Other Apps That Already Collect Your Face

It's worth remembering that plenty of ordinary apps already ask for a face scan for reasons that have nothing to do with age. A beauty scan filter, a skin analysis tool, or a face analyzer app used for fun all collect facial features the same way an age gate would. FaceApp popularized this years ago by letting users see an aged or de-aged version of their own photo, and millions of people uploaded a face scan without asking where that image ended up.

Here's where it gets practical. If you live in Texas, or if this law survives the Supreme Court challenge and spreads, you may soon be asked to verify your age before downloading apps. When that moment comes, these are the questions worth asking before you hand anything over:

Who is collecting this data? Is it Apple or Google, or is it a third-party vendor you've never heard of? The answer matters enormously for how your information gets stored and protected.

How long do they keep it? A one-time age check that immediately deletes your ID is very different from a company building a file on you that says "verified adult, Texas, downloaded these apps."

What happens when they're wrong? If a facial scan misreads your age and blocks you from downloading a news app, what's your appeal process? Right now, in most cases, there isn't one.

If you've ever wondered whether a photo or profile is really who it claims to be, or whether an AI system is making accurate judgments about real people's identities, that's precisely the question this whole fight is circling. The difference between a reliable identity check and a biased algorithmic guess matters enormously. It matters for investigations, for access to information, and for anyone whose face doesn't fit neatly into a training dataset built by someone who didn't think much about them.

The Bigger Question Nobody's Asking Loudly Enough

The legal fight at the Supreme Court focuses on free speech, whether blocking access to a news app before you prove your age violates the First Amendment. That's important. But there's a quieter question underneath it that deserves equal attention.

We are, right now, in the early stages of normalizing the idea that your face or your government ID is a ticket you show just to use the internet. Not for adult content. Not for financial services. For everything. The app store is the last chokepoint before the entire internet becomes an age-gated space, and once we accept facial age estimation as normal at that level, pulling it back will be very, very hard.

According to American Enterprise Institute analysis, these systems are both over-inclusive (blocking adults who look young) and under-inclusive (failing to block determined teenagers), which means they restrict lawful speech without reliably achieving their stated goal. That's the structural failure at the center of this whole debate, and it's one the Supreme Court is going to have to stare directly at.

Texas built a law on the assumption that the technology works well enough to be a gatekeeper. The research says it doesn't. And now nine justices, who almost certainly asked their clerks to explain what an "app store" is, get to decide which assumption wins.

Ask yourself this: would you feel safer knowing your teenager's age was verified before they downloaded Instagram, or more uneasy knowing a company now has a facial scan of your entire family just to let you check the weather?

Because right now, in Texas, you don't get to choose both.

Once a face scan app becomes the default gate on a phone, the question stops being about one weather download and starts being about every download after it. A face scan taken once for age verification does not automatically disappear once you've been approved, and most users never get a clear answer about how long that face scan stays on a server. Mobile operating systems handle permissions differently, so a mobile user on one platform may face different data rules than a mobile user on another, even when both are running the same face scan app.

Consider the mechanics behind secure face scanning technology for a moment. A well-built system captures the face scan, converts it into a mathematical estimate of age, and is supposed to discard the raw image immediately afterward. That is the promise behind most secure face scanning technology marketed to app stores and lawmakers, but the promise only holds if companies actually follow through, and users have no easy way to check whether they did.

Android and iOS both allow developers to request camera access for a face scan app, but neither operating system requires the same disclosure standard a bank or hospital would use for biometric data. Android users in particular should check app permissions regularly, since a revolutionary app marketed as a simple age check can quietly retain broader camera or storage access than the age-verification task requires. Reading the permissions screen before tapping "allow" is one of the few controls users actually have.

Recognition technology built for age estimation is not interchangeable with recognition technology built to confirm identity, even though both fall under the umbrella of facial recognition. A face scan app estimating whether someone is over 18 is making a probabilistic guess about a face, not confirming a name or a legal identity, which is exactly why the accuracy problems documented by researchers matter so much here.

Parents weighing whether to allow a face scan app on a family device should ask the same questions journalists ask about any data collector: what is retained, who can access it, and what happens during a breach. Those questions apply whether the app in front of you is a weather tool asking for a face scan or a beauty filter asking for the same camera permission for a completely different reason.

None of this means every face scan app is dangerous by design. Plenty of face analyzer tools and beauty scan filters operate honestly and delete data as promised. The problem in the Texas case is scale: turning a face scan into the default requirement for downloading nearly any app multiplies the number of companies holding facial data, and multiplies the number of places that data can leak from.

Data minimization, collecting only what's needed and deleting it fast, is the practical middle ground privacy researchers keep pointing to. A face scan app that verifies age and immediately discards the image is a very different product than one that stores a face scan indefinitely tied to a phone number or app-store account. Texas's law does not currently require companies to explain which version users are getting.

Until the Supreme Court rules, families are left making judgment calls with limited information. Asking an app what happens to a face scan after it is taken is a reasonable, practical step, even if the honest answer today is often "we don't fully know yet."