Apple Age Verification: One Check Ends a Dozen ID Uploads

Full Episode Transcript

More than seventy thousand people took a photo of their government I.D. and uploaded it just to prove their age on Discord. Then the outside company checking those I.D.s got breached. Seventy thousand faces, names, and birthdates. Out in the open.

Trusted by Investigators Worldwide

Run Forensic-Grade Comparisons in Seconds

Detailed facial comparison reports. Results in seconds.

Get Started

7-day refund guarantee**

If you've ever been asked to scan your license or

If you've ever been asked to scan your license or snap a selfie to get into a website, this story is about you. And if you're a parent, it's about your kids, too. Every app that asks for proof of age wants its own copy of your I.D. That's a dozen copies of your identity, sitting with a dozen companies you've never heard of. It's a reasonable thing to feel uneasy about. Now Apple is offering a different setup. You prove your age once, to your phone. After that, apps get a simple yes or no. They never see your documents. So the real question is this. When someone checks your age online, who ends up holding your identity?

Start in Australia. Since March of twenty twenty-six, Australia's eSafety Commissioner has required people to prove they're over eighteen before viewing adult content online. That rule created a scramble. Adult sites turned to outside verification companies with names like Yoti, Persona, AgeGO, and AgeVerif. Those services typically ask for a selfie, a short video of your face, a credit card, or a government I.D. And what happens to all that after you hand it over? According to independent evaluations cited by Lawfare, some of these vendors tracked users. Some sent personal data to advertising networks without permission. Some collected webcam feeds and I.P. addresses, basically, a digital return address for your internet connection. For a privacy lawyer, that's a consent violation. For the rest of us, it means the company that checked your age may also know what you browsed, and who it told. Up next: New York Missing Children Face Matching Helps Find 37 Kids.

Apple's approach flips where the check happens. You verify your age with Apple, using an I.D. or a credit card. Your phone then passes a tiny signal to apps. Over eighteen, or not. Apple learns your age. It doesn't learn your browsing habits. And the app learns your age bracket. It doesn't get a photo of your license. That Discord breach shows why this matters. You can't leak a document you never collected. For security teams, that shrinks the number of places hackers can hit. For a family, it means one check instead of a trail of I.D. copies scattered across the internet.

This isn't a someday idea. Aylo, the parent company of Pornhub, is already using Apple's child-safety features in Australia. One of the biggest adult platforms in the world chose the phone over the selfie upload. And the U.S. is moving the same direction. California's Digital Age Assurance Act takes effect in twenty twenty-seven. It requires phone operating systems and app stores to ask your age when you set up a profile. Then app makers have to treat that age as actual knowledge. In plain terms, an app can't claim it didn't know a user was thirteen. That pushes the whole industry toward checking age at the device level.

The Bottom Line

Not everyone's cheering. Critics say this could push phone makers to collect even more personal data. And what about a shared tablet? If a child grabs a parent's phone, the phone still says adult. There's a bigger worry, too. The U.S. has no federal privacy law limiting how companies collect, store, or sell your data. Without one, critics argue, that simple age signal becomes one more data point for platforms to exploit.

The safest I.D. check isn't the most accurate one. It's the one where the website never sees your I.D. at all. But that safety comes from trusting one company with the answer. And right now, no federal rule says what that company can do with it.

Websites are asking more people to prove their age. Uploading your I.D. to every one of them leaves copies everywhere, and some of those copies have leaked or been sold. Apple's way lets you prove it once on your phone, but it makes your phone maker the keeper of that answer. Whether you're a parent or just someone who's been asked for a selfie at a login screen, you now know the question to ask, who's holding my I.D.? The written version goes deeper, link's below.

Apple Age Verification: One Check Ends a Dozen ID Uploads

How does Apple age verification work without uploading my ID?