Facial Age Checks and Minors: What the Rules Require
A face scan is now a legal instrument in several countries, and that changes what it has to prove. When a model guesses 24 for a 31-year-old, the mistake is harmless. When the same model stands at the door of an adult site or a gambling app, it is deciding whether a 15-year-old gets in. Regulators have started asking how often such a system is wrong, who tested it, and what happens to the picture afterwards.
Rules differ by country and they are still moving. The UK built its system around one statute and one regulator. The European Union spreads the duty across data protection, platform rules, and a planned digital age credential. The United States has a patchwork of state laws, several of them in court. What follows is a plain summary of where things stood in 2026, written for someone reading a privacy policy or building a sign-up form. It is not legal advice, and no summary of a moving area can be.
An estimate is not an identity check
Age assurance is the broad term: any method that gives a service reasonable confidence about a user’s age. Age verification is the strict version, where you prove a birth date with a document or a credential. Facial age estimation sits between them. The camera reads a face, a model returns an estimate or a band such as 18 to 24, and the service decides what to do with that band.
The band is the privacy feature and the weak point at once. It avoids storing a birth date, which is worth something. But it is still a guess with an error rate, and the error is not spread evenly. Accuracy tends to drop with darker skin tones, heavy makeup, poor light, and small or blurry images. A photo of an older sibling, a smoothing filter, or a camera held below the chin can move the result by years. A system with a good average score can still fail more often for one group of faces than another.
That is why the newer rules talk about effectiveness and testing rather than a single accuracy figure. The question a regulator asks is not “how accurate is the model” but “how often would a child get through, and how do you know”.
None of this changes the everyday version of the technology. A tool that reads one photo and returns a range, such as the how old do I look page, carries no legal weight. An exact birth date is simple arithmetic, which the age calculator handles without guessing.
What the UK requires, as of 2026
The Online Safety Act 2023 places duties on services that are likely to be accessed by children. Ofcom, the regulator, has published codes of practice and guidance setting out what counts as highly effective age assurance. A service has to use a method that a child cannot easily defeat, that has been tested, and that is backed by evidence. Asking “are you over 18?” and accepting the answer does not meet the bar for the highest-risk content.
Two details matter if you meet a face-based check on a UK site. Ofcom’s guidance does not bless one technology: facial estimation, digital ID, bank-based checks, and age signals from a mobile network can all qualify if they meet the standard. And the duty sits with the service, not with you. If a site lets a nine-year-old through because nobody tested the model on children, that is the site’s failure, and the regulator can act on it.
The EU: several pressures, no single age law
There is no EU statute that says “check every user’s age”. Obligations arrive from different directions. The GDPR treats a face image as personal data and sets conditions on children’s data, including the age at which a child can consent to online services, which member states set somewhere between 13 and 16. The Digital Services Act requires the largest platforms to assess and reduce risks to minors, which in practice pushes them toward knowing roughly who is a child. Alongside both, the European Commission has been developing a reusable age-verification app so that a person can prove an age band from a phone wallet instead of sending a passport scan to every site.
The direction of travel favours credentials over faces. A proof that says “over 18” carries less risk than a photograph of a teenager sitting on a server. That is a design preference in Brussels, not yet a uniform rule across member states.
US states: many laws, many challenges
The United States has no federal age-verification mandate for online content. Instead, a growing list of states requires adult sites to check age, and a smaller group has tried to push the duty up to app stores and phone operating systems. The methods vary: government ID in some places, any commercially reasonable check in others, plus rules about not keeping the data afterwards.
The courts have supplied the other half of the story. Several laws have been blocked or narrowed, others have taken effect while appeals continue, and a 2025 Supreme Court decision lowered the bar for states defending these laws against free-speech claims without settling every statute. For a site operator, that means checking the current position state by state. For a reader, it means the age gate you meet depends on where you live.
Practical: judging an age gate
A few checks separate a serious age gate from theatre, on either side of the form.
- Ask what the system returns: a band, a score, or a yes or no. A band with a stated error rate is more honest than a confident single number.
- Look for testing evidence on the group that matters, including children, and across skin tones and lighting conditions.
- Read what happens to the image. Processing on the device that discards the frame is a different proposition from an upload with an open-ended retention clause.
- Check the fallback. Someone wrongly rejected needs a route that does not involve paying.
If the answer to any of those is “we don’t say”, treat the gate as unproven. If you are deciding this for a business, take the specifics to a lawyer who works in the area. A summary like this one is a starting point, not clearance.
FAQ
Is facial age estimation legal for age checks?
In several countries, yes, as one accepted method, provided it meets the regulator’s standard and the data protection rules for face images. Legality depends on the jurisdiction, the purpose, and how the image is handled. Check the current guidance from the regulator where you operate before relying on it.
Does an age estimate count as biometric data?
Under the GDPR and UK GDPR, a face image is biometric data only when it is processed to identify a specific person. A model that turns a face into an age and then discards the frame is usually argued to fall outside that definition. The argument is contested, and the safer design assumes the strictest reading applies.
Can a child get past a face-based check?
Sometimes. A sibling’s photo, a parent’s face, makeup, or flattering light can all push an estimate upward. Serious deployments pair estimation with liveness checks, device signals, and limits on repeated attempts. No single method is treated as unbeatable.
What should a small site do?
Pick the lowest-risk method that satisfies the rule, such as a device or credential signal that reveals only an age band. Write down how you tested it, keep retention short, and make sure a wrong rejection has a human route. Where a service is strictly for adults, keeping children out at registration is often cleaner than guessing at the door.
Last updated: October 26, 2026. This article is for general information only and is not medical, veterinary or legal advice. For decisions about your own health, your pet, or a legal matter, consult a qualified professional.
Sources
- Information Commissioner’s Office, Children’s information rights: ico.org.uk
- European Commission, Data protection: commission.europa.eu
- Federal Trade Commission, Children’s privacy: ftc.gov
