Your Kid Scanned Their Face for TikTok. A Stranger Kept It for 3 Years.

A child uploads a photo of their face to prove they're old enough for an app. That image — along with their name, their phone number, maybe a scan of a government I.D. — can sit on a company's servers for up to three years. Not the app's servers. A third-party vendor most parents have never heard of.

If your kid has ever signed up for a social

If your kid has ever signed up for a social platform, this is about your family. And if you've ever scanned your own face to prove your age for a website, it's about you, too. Malaysia just drew a hard line on this. Starting 06/01/2026, the country's regulator ordered social media platforms to verify users are at least sixteen — and then delete that verification data once the check is done. So the real question isn't whether platforms can check your age. It's what happens to your face after they do.

Let's start with what Malaysia actually built. The rule comes from something called the Child Protection Code, issued by the country's communications regulator. Under it, platforms must keep kids under sixteen from owning accounts. But the part that makes this different sits in two old privacy ideas. One is called data minimization — collect only what you genuinely need. The other is purpose limitation — once you've used the data for that one job, you can't keep it around. For a parent, that means a face scan should do its one task and then vanish — not live on as a permanent file with your child's name attached.

And this isn't a polite suggestion. Malaysia's regulator says licensed platforms that fail to comply can face financial penalties. That's the piece most age laws around the world skip. Roughly half of U.S. states now require some kind of age check for social media or adult content. Most of them obsess over how well you block a kid. Almost none ask the harder question — how little should you keep afterward?

Here's why that gap matters. Security researchers at Malwarebytes reported on an age verification vendor that held onto people's data for as long as three years. Names. Faces. Government I.D. numbers. Phone numbers. Three years. For a check that takes about three seconds. When you scan your face to get into an app, you're usually not handing it to the app at all. You're handing it to a contractor you never chose — and you have no real way to know if it ever gets shared or sold.