Nobody Can Actually Check a Child's Age Online
Every major platform sets 13 and verifies it by asking. Every alternative method fails on privacy, accuracy or cost — which is why the rules keep changing instead.
Almost every major platform sets a minimum age of 13 and verifies it by asking for a date of birth, and every proposed alternative — document checks, face estimation, parental vouching — fails on privacy, accuracy or cost, which is why regulation keeps moving while enforcement does not.
The number is thirteen. The verification is a dropdown menu.
That gap is the whole subject, and it has not meaningfully narrowed in twenty years.
What is actually in place
| Platform minimum age, most services | 13 |
|---|---|
| Verification method, most services | Self-declared date of birth |
| 13, or 16 in some regions | |
| US COPPA threshold | Under 13 needs verifiable parental consent |
| India, DPDP Act | Child threshold 18 |
| EU, Digital Services Act | Profiling-based ads to minors prohibited |
| UK, Age Appropriate Design Code | "Likely to be accessed by children" test |
Note what the last three have in common: they regulate the platform's behaviour, not the child's access. That is not an oversight. It is what regulators do when the access question has no good answer.
And the thirteen itself is not a developmental finding — it is the age at which a US privacy law stops applying.
Why every alternative fails
Document checks. Requiring ID means collecting identity documents from every user, including every adult, to gate a minority. That creates a database that is itself a target, and it excludes anyone without documents — disproportionately the people already least served. The privacy cost is universal; the benefit is not.
Face-based age estimation. It returns an estimate with an error range, not an age. Near a threshold the error range is wider than the decision being made, so at exactly the point where the answer matters most, the method is least able to give one. Accuracy also varies across skin tones and age bands, which turns a technical limitation into a fairness problem.
Parental vouching. Works when the parent is present and cooperative. The cases that most need a control are the cases where that assumption is weakest.
Device-level signals. A phone can know a child is using it and tell apps, which is the most promising direction — and it depends on the phone being the child's, correctly configured, and not shared. In much of the world, where households run about nine connected devices but children's own devices arrive around nine years old, that assumption does not hold.
What this means in a household
The practical consequence is unglamorous: you are the age check.
Not because platforms should be let off, but because the arithmetic is what it is. A stated minimum of thirteen with a dropdown behind it means the decision has already been delegated to the parent, whether or not the parent knows it.
What follows from that is in do parental controls actually work — the two settings almost everyone misses, and the fact that a child who will report a problem is worth more than any configuration.
What to watch
Regulation is moving faster than verification. A growing number of countries have introduced under-16 restrictions since 2024, and those laws are being written against the same technical constraints described above. Expect the enforcement mechanism to be the interesting part of each one, and expect most of them to land on the platform's obligations rather than on a working age check.
Watch for the word "assurance" rather than "verification". The industry moved to that word deliberately. Assurance means a confidence level. Verification means knowing. Only one of those is on offer.
See the underlying figures at parental controls statistics and social media and children statistics.