Meta may soon have to make more decisions about how old its younger users are, but that does not necessarily mean asking everyone for an ID or a video selfie.
Under a recent settlement, Meta will be required to strengthen how it determines the ages of younger users on its platforms. Yet the approach does not prescribe universal identity document checks or facial age estimation for every user.
That distinction matters. Regulators increasingly expect online platforms to keep minors away from age-restricted content and experiences. At the same time, laws such as the Children’s Online Privacy Protection Act (COPPA) can restrict how online services collect personal data from children.
A wider challenge for platforms
How can platforms improve age assurance without making full identity verification the default for every user?
Different methods can serve different purposes. Age estimation may help determine whether someone appears to be above a certain threshold. Behavioral and contextual signals can flag when a claimed age may be unreliable. Credential-based proof can confirm that a trusted authority has verified an age or age attribute.
Among these approaches, digital credentials may offer a way to confirm an age threshold without disclosing a person’s full identity. The remaining challenge is ensuring that the credential is being used by its legitimate holder.
A credential still needs to be tied to its holder
Henry Patishman, Executive Vice President of Identity Verification Solutions at Regula, comments:
“If a platform only needs to know whether someone is over 18, it should not need to collect names, dates of birth, or full identity documents, unless there is no other option.
But proving that a credential says someone is over 18 is not the same as proving that the credential belongs to the person presenting it. That binding must happen and can happen in privacy-preserving ways. For example, through device-level authentication, secure on-device biometrics, or biometric matching that never exposes the underlying image to the platform. The platform may only ever receive a yes/no age result, while the binding happens locally.”
For platforms, the implication is clear: collect only the identity data proportionate to the risk, while maintaining enough assurance for the decision at hand.
Working out which age assurance method fits your risk level? See our guides to age verification approaches, age verification system implementation, or how to choose between on-device and server-side age checks.
