Age Verification Explained: Methods and Data Collected

This article is part of a series explaining how the internet works. Age verification matters because the gap between what's being asked of you and what's being collected is wide. 

The question is simple. Are you old enough to see this? That's one bit of information. Yes or no. The systems built to answer that question routinely collect a photograph of your government ID, a live image of your face, or your financial details. That's not one bit. That's your identity.

Two Different Things With Similar Names

First, a distinction that matters and gets blurred constantly. Age verification confirms that you clear a threshold. Over 18, over 16, whatever the local law requires. It doesn't need to know who you are.

Identity verification confirms who you actually are. Your name, date of birth, ID number. Some age verification methods can determine your age without knowing your identity. Facial age estimation, for example, can return an age range without ever learning your name. You can tell from a photo if you’re looking at a teenage boy or a man of beekeeping age.

Other methods do both at once. An ID upload proves your age by proving your identity, which is why it gives away the most. When a law says "age verification," it usually doesn't specify the method, speaking in riddles like “use reasonable methods to safely verify. Platforms pick and choose those methods, and they tend to pick whatever is cheapest to implement and easiest for them to defend to a regulator. Sadly, that's frequently the most invasive option.

The Five Methods, and What Each One Takes

Here's what you're actually handing over, by method.

1. Self-declared age: You type a birthdate or tick a box. With this method, the website trusts that you’re telling the truth, even if that means you can’t use the website. So most people lie. It's also why regulators stopped accepting it.
2. Credit or debit card check: The logic is that children don't have bank cards. You hand over your sensitive payment details to answer a yes-or-no question, which is a lot of identity for one bit.
3. Facial age estimation: Software looks at a live selfie and estimates your age range. It collects biometric data. Your face is now data, even if the system never learns your name.
4. Third-party digital ID: A separate company, partnering with the website you want to visit, vouches for you. Your information stays with them, under their retention rules rather than the website's. You generally don't get to choose which company. Examples of such companies include Persona, Sumsub, and iDenfy.
5. Government ID upload: You take a photo of your ID, usually alongside a selfie for matching. This method is the most comprehensive. Your full legal name, date of birth, document number, and your face, all to browse a website.

Why an Online Check Is Different From a Bouncer

This comparison does more work than anything else in explaining the problem. When someone checks your ID at a door, they look at it and hand it back. They see your age. They don't keep a copy. Nothing persists.

An online check makes a copy. That's how it works. The image travels to a server, gets processed, and sits somewhere.

The Electronic Frontier Foundation makes this point directly in its resource hub on age verification, arguing that every age verification system is a surveillance system at its core. Online, there's no way for you to verify that your information was deleted, or that it won't be copied, sold, or stolen.

That's not a hypothetical concern. Companies that promise to delete identity documents, including verification providers specifically, have already had breaches. Our own research found 88 documented breaches of identity and verification data since 2011, affecting at least 2.15 billion records. Verification providers appear in that record, so the companies hired to handle identity data securely do lose it.

Also, the technology isn't reliable. Facial estimation systems have higher error rates for some groups than others, varying by skin tone, gender, and disability. ID-based systems exclude people who don't have documents or whose appearance no longer matches them. So the check fails for the people it was never designed around, and those failures land on the user rather than the system.

What a VPN Does and Doesn't

A VPN doesn’t remove an age verification requirement. If a website asks for ID, it still asks. We're not going to pretend otherwise, and anyone suggesting a VPN is a way around these laws is overselling.

What it affects is everything else. Age checks got added on top of tracking that was already happening. Every website you visit, age-gated or not, can log your IP address, estimate your location, and record your browsing pattern. A VPN changes what those websites see: they get the VPN server's address instead of yours, and your internet provider stops seeing which sites you visit.

A verification wall adds one layer of identity exposure. A VPN reduces a different layer, the one that applies everywhere and has nothing to do with your age. That's worth something. It isn't a solution to age verification, and we'd be lying if we said it was.

However, age verification is usually geographically targeted. For instance, the UK has banned social media for under-16s, so people with a UK IP are asked to verify their age. But a person in Ireland, with an Irish IP, won’t. And it’s naive to think that people won’t look for loopholes to avoid it. One well-documented loophole online is changing your virtual location, so you won’t have to answer any questions. Mysterium VPN doesn’t condone circumventing the laws and regulations of where you live.

Why Knowing This Matters

The reason to understand the mechanics of age verification is that the decision looks different once you do. "Verify your age" sounds like a formality. "Upload your passport to a company you've never heard of, which will keep a copy of that password under rules you won't read" is the same request, described more accurately. 

You might still do it. Plenty of times there's no alternative. But it's a different decision when you know what it involves, and that's the whole point of this series. You deserve to know.