Age Verification: UK Kids' Faces and IDs, No Delete Date

Earlier this year, a Discord data breach exposed photos of government I.D.s belonging to about seventy thousand people. The leak didn't come from Discord itself. It came from an outside company hired to check ages.

Picture that same setup, built for every teenager

Now picture that same setup, built for every teenager in the United Kingdom.

If your kid has ever signed up for an app, this story is about your family. The U.K. is set to ban social media for anyone under sixteen. Enforcing that ban means proving who's old enough. And proving it means handing over some of the most personal things a person has. Faces. Names. Birthdays. Home addresses. If that makes your stomach tighten a little, that's a fair reaction. The U.K.'s communications regulator, Ofcom, has now named four approved ways to check age. Photo I.D., a banking check, a face scan that estimates age, and a digital I.D. So here's the question running through everything today. When we protect kids from one kind of harm, who ends up holding the data we create doing it?

Start with the face scan, because it sounds the easiest. You look at your phone camera, and software guesses how old you are. But that guess can be off by a few years. A fifteen-year-old might pass. A seventeen-year-old might get blocked. That's why Ofcom recommends pairing the face scan with a second method. So the easy option isn't really easy. It often means two checks, and two sets of data.

Now, the I.D. route. Many people assume everyone has a passport or a driver's license. The article points out that a small slice of people don't. Think of children without formal documents. Kids who share a family device. Kids with disabilities. Trans and gender-nonconforming kids. Kids from marginalized communities. Researchers warn these are the children most likely to be wrongly blocked, or buried in hassle. For a lot of families, "choose your method" is really a choice between a few options that don't fit them.

Then there's where the data goes

Then there's where the data goes. Civil liberties groups say these checks funnel huge amounts of identity data into a handful of vendors. Those vendors become tempting targets for hackers. And for government requests. The Discord breach is the example. Seventy thousand I.D. images, taken through a compromised third party. For a company, that's a security incident. For a teenager, it's a photo of their face next to their name and birthday, loose on the internet.

Compare that with the United States. The Federal Trade Commission has laid out a simple pattern. Use the data only to check age. Limit who sees it. Get written promises from vendors. And delete it once it's no longer needed. According to the expert analysis in this article, Ofcom's guidance doesn't set comparable limits on keeping or sharing that data. So the rules on collecting are strict. The rules on deleting are not spelled out.

The other side deserves a hearing. The Molly Rose Foundation, a U.K. child safety charity, welcomed the guidance. They say age checks can work if social media firms do them properly. Their point is real. Doing nothing doesn't make the harm disappear. It leaves kids with the algorithms. And Australia shows the limits of the ban itself. Kids there got around similar rules with fake birth dates, a parent's account, and V.P.N.s.

So the real fight isn't whether to check ages. It's whether the check happens on your phone's app store or on each platform, and whether the rules for deleting data are as strict as the rules for collecting it.