Clicking “I am over 18” used to be a formality. Now, in the UK, a growing number of US states, Australia and parts of the EU, that click is being replaced by a passport upload, a face scan or a credit card check. The people being asked are ordinary adults who want to read an article, watch a video or join a community. What most of them do not know is where their data goes when they comply. This guide explains how age verification online works, what each method collects, and the safer options that already exist.

Why Age Verification Is Suddenly Everywhere

• UK: Under the Online Safety Act, platforms that host pornography or other content harmful to children have had to use “highly effective” age checks since July 2025. Simply ticking a box to say you are an adult no longer counts.
• US: More than 20 states now require age verification on adult websites, starting with Louisiana in 2022. In 2025, the US Supreme Court upheld Texas’s version of the law.
• Australia: Since December 2025, social media platforms must take reasonable steps to stop under-16s from having accounts.
• EU: The Digital Services Act requires large platforms to protect minors, and the EU is piloting an app that lets people prove they are over 18 without sharing other details.

These laws differ in what they cover and how old you must be. But most share one feature: they tell platforms to check age while leaving much of the choice of method, and of the data collected, to the platforms and the companies they hire.

The Main Methods and What Each One Collects

The method is almost always the platform’s choice, not yours. Here is what the common ones involve:

• Government ID upload: You photograph a passport or driving licence, often with a selfie to match. A verification company now holds a copy of one of the most sensitive documents you own.
• Facial age estimation: A camera estimates your age from your face. Providers usually say the image is deleted straight away, but you are relying on their word, and on their security.
• Credit card check: A verifier confirms you hold a card, which adults are more likely to have. Your card details pass to another company.
• Mobile network check: Your phone company confirms whether the account holder is an adult, without sharing your name with the site. This is one of the less invasive mainstream options.
• Bank or digital ID app: Your bank or a certified digital identity app confirms you are over 18 and passes on only that answer.

Most people are offered only one or two options. The site tends to pick what is cheapest or easiest to set up, not what is safest for you.

Who Keeps Your Data After the Check

The website you are visiting is rarely the one storing your ID. A specialist verification company in the middle usually does. These companies are unknown to most people, yet some hold identity checks from millions of users across many platforms.

The risk is not theoretical. In October 2025, Discord disclosed that government ID images from around 70,000 users, sent in to appeal age checks, had been exposed through a breach at a third-party customer support provider. A leak like that can tie your passport to the platforms you were trying to use, which is more damaging than either piece of information alone.

Retention varies widely. Some providers delete documents within minutes of the check; others keep them for months or years. The platform may also record that you passed verification, linking your legal identity to your account even if the verifier deletes everything.

What the Laws Require, and What They Leave Out

The UK’s regulator, Ofcom, now lists the kinds of checks it accepts, including photo ID matching, facial age estimation, mobile network and credit card checks, open banking and digital identity services. That is progress. But platforms can still choose document uploads over less invasive options, and much of the data protection depends on separate privacy law rather than the age verification rules themselves.

In the US, state laws mostly require platforms to verify age without prescribing a method or strict limits on what verifiers may keep. Australia lets platforms decide what “reasonable steps” look like.

The common gap: few rules require the least invasive method that works. That leaves the decision with commercial companies, and it turns child-protection rules into a large new store of identity documents.

Safer Options That Already Exist

Several approaches can confirm your age without handing a copy of your passport to a stranger:

• Reusable age tokens: A trusted organisation, such as your bank or mobile network, checks your age once and gives you a token. Sites see only “over 18: yes”, never the data behind it.
• Digital identity wallets: Apps that hold a verified credential on your phone and share only the single fact a site needs. The EU’s planned digital identity wallets are built on this idea.
• Zero-knowledge proofs: A cryptographic method that proves a fact, such as being over 18, without revealing anything else. Think of a locked box that answers yes or no but never opens.
• Device-level checks: Your phone or computer confirms an age range from the account already set up on the device, so the check stays local.

These exist today, mostly in pilots and early products. Data-heavy methods remain common because they are cheaper and quicker to deploy. The trade-off between privacy and compliance is a choice, not a technical necessity.

Proving one fact about yourself, like your age, without exposing who you are is the core idea of Wes Kussmaul’s Escape the Plantation, and you can get a free copy at the end of this article.

Practical Steps You Can Take Now

• Find out who the verifier is. The company is usually named on the consent screen or in the privacy policy. Read its policy, not just the website’s.
• Check retention. Look for how quickly the verifier deletes your document or face scan, and whether it shares data with anyone else.
• Pick the lightest option. If you are offered a choice, use a mobile network, bank or digital ID check rather than uploading a document.
• Watch for fake verification pages. Scammers copy age check screens to steal ID photos and card details. Only verify through the site you meant to visit, never through a link in a message.
• Ask what they hold. In the UK, the EU and several US states, you can ask a verification company what data it holds on you and request deletion. This guide to subject access requests explains how.
• Decide if you need the account. Avoiding the check entirely is always an option.

Age Checks and the Future of Anonymity

Once a platform has linked your account to your legal identity, it becomes much easier to connect your browsing, posts and purchases to your real name. Identity systems, once built, tend to expand beyond their original purpose. We look at that wider debate in Digital ID Privacy: Who Holds Your Data Changes Everything and Can You Refuse a Digital ID?

The question is not whether age checks are ever justified. It is whether the method protects the people using it. Done well, age verification can prove one fact and reveal nothing else, keeping people both accountable and anonymous. Done badly, it builds a database of identity documents that will eventually leak.

Frequently asked questions

What is online age verification?

It is a check a website or app uses to confirm you are old enough to access certain content or features. Methods include uploading ID, facial age estimation, credit card checks and confirmation from your mobile network or bank.

Is online age verification safe?

It depends on the method and the company doing the check. Methods that pass on only a yes or no answer are much safer than uploading a passport or driving licence, which creates a copy that could be leaked, as happened to around 70,000 Discord users in 2025.

Does the website see my passport or driving licence?

Usually not. Most sites pass you to a third-party verification company, which processes your document and sends back a yes or no. The risk is that this company now holds your document, under its own privacy policy.

Can I verify my age without uploading ID?

Often, yes. Many services also accept facial age estimation, a mobile network check, a bank check or a digital identity app. If you are offered a choice, pick the option that shares the least.

Do I have to verify my age to use social media?

It depends on where you live and what you are doing. In Australia, platforms must keep under-16s off social media. In the UK, platforms must use age checks for adult and other harmful content, and some apply them to certain features. Rules in the US vary by state.

Related reading

• Digital ID Privacy: Who Holds Your Data Changes Everything
• Can You Refuse a Digital ID? What the Rules Say
• Digital Identity Explained: What It Is and What It Isn’t
• Instagram Account Hacked: How to Recover It

Proving your age should not mean exposing your identity. Wes Kussmaul’s Escape the Plantation explains how identity you own and control could prove a single fact about you, like your age, while keeping everything else private: accountable, but anonymous. Enter your email below to get your free copy and follow CDM Worlds’ work on safer online communities.