Age Verification for Online Safety Act: Boy, 12, Scans as 15

A twelve-year-old boy picked up an eyebrow pencil. He drew a moustache on his upper lip. Then he looked into a camera built to keep kids out. The system read his face and decided he was fifteen.

A pencil. That's all it took. If you've got a kid

A pencil. That's all it took. If you've got a kid with a phone, this story is about the lock you thought was on the door. And if you've ever wondered whether these online safety checks actually work, that's a fair question. It's one regulators are now asking too.

According to reporting from The Cyber Express, the moustache trick happened under Britain's Online Safety Act. That law rolled out in July of last year. Enforcement started on 07/25/2025. It requires many websites and apps to check a user's age before showing adult or harmful material. One common method is facial age estimation. In plain terms, a camera looks at your face and guesses how old you are. So the real question running through all of this is simple. When a website says a user is verified, what has it actually confirmed?

Start with the scale. Since enforcement began, more than five million age checks fire off in Britain every single day. That's a lot of faces, birthdates, and ID scans flowing into these systems. And kids are slipping past them in ways that barely qualify as hacking.

The most common trick isn't a moustache at all

The most common trick isn't a moustache at all. It's typing in a fake birthday. About one in eight children say they've done exactly that. Roughly one in eleven have logged in with someone else's account. And about one in twelve just borrow another person's device. None of that takes skill. It takes an older sibling, or a parent's tablet left on the couch.

So what about the kids who are a little more tech-savvy? They reach for a V.P.N. That's a virtual private network, a tool that makes your phone look like it's connecting from another country. Reports show V.P.N. downloads surged once the checks kicked in. Researchers studying age verification mandates see the same pattern again and again. Tech-literate teenagers route around the rules. And that has a side effect nobody wanted. It pushes kids off regulated platforms and into corners of the internet with fewer protections. For policymakers, that's a design failure. For a parent, it means your child may be somewhere harder to see, not somewhere safer.

France looked at this problem closely. According to France's data protection regulator, known as the C.N.I.L., no age check available today meets three basic tests at once. It has to reliably confirm age. It has to work for everyone. And it has to protect the personal data it collects. Every method on the market falls short somewhere. Not one passes all three.

Child welfare groups have noticed

Child welfare groups have noticed. The British children's charity Barnardo's warns that the law's loopholes mean it won't deliver the changes children need. That's a charity that wanted this law to succeed.

To be fair, there's a counterargument. Some checking is better than none. Every hurdle adds friction, and friction stops some kids. But look at how that friction plays out. In some cases, a child blocked from going live on a platform gets locked out for just ten minutes. Then they can simply try again. For a determined twelve-year-old, ten minutes is a snack break.

For anyone handling compliance or evidence, one point matters most. A face-based age check is an estimate, not a confirmed identity. Treating a pass as proof of age is a risk all by itself. For the rest of us, it means a green checkmark can say more about the system's confidence than about the child behind the screen.