In her recent piece for the R Street Institute, Shoshana Weissmann argues that laws requiring online age verification are unworkable because “most children don’t have IDs” and “age-estimation technology errs by years.” These criticisms paint an outdated and overly pessimistic view of modern age assurance technology. As the trade body representing companies leading the development of privacy-preserving and effective age verification, we at the Age Verification Providers Association (AVPA) would like to offer a more balanced perspective.
- Age assurance is not the same as ID checks
Much of the R Street critique assumes that age assurance means uploading an ID. In reality, most age verification today uses a range of methods, many of which do not require a photo ID at all. The best systems allow for progressive or “successive” verification: if a low-friction method like facial age estimation or a credit bureau check cannot confirm the user is an adult, only then is the user prompted to provide more robust proof.
Critically, we support user choice and parental control. Any adult, or a parent or guardian for their child, can pick the most convenient method – or opt out of potentially harmful content and functionality altogether. Regulation, especially in the UK and EU, rightly requires providers to offer proportionate and privacy-preserving methods.
- Facial age estimation is improving fast – and it’s privacy-first
The R Street article rightly notes that facial age estimation tools aren’t perfect, but it neglects the pace of progress and the underlying privacy protections. The technology is improving monthly, not yearly. The best solutions now deliver over 98% accuracy at determining whether someone is over or under a threshold like 18, 16, or 13 – not by identifying the person, but simply estimating their age from facial features. No biometric template is retained, and no one is tracked. And for most adults, if you are estimated to be over, say 21, there is almost zero chance you are actually under 18.
The National Institute of Standards and Technology (NIST), cited in the article, continues to study and benchmark these tools. But regulators such as the UK’s Information Commissioner’s Office and France’s CNIL have already approved facial age estimation for use in live services – precisely because it offers strong privacy and reasonable accuracy.
- Children don’t need government ID to verify age
It’s true that younger children often don’t have a driver’s licence – but that’s a red herring. Most age verification systems used in online services don’t depend solely on government-issued documents. Instead, they use authoritative sources – such as education databases, mobile carrier records, or secure reusable digital wallets – to confirm age without requiring any child to handle a passport or licence.
Where stronger identity proof is required, such as for gambling or adult content sites, systems can involve a parent’s digital ID or link a child’s account through verifiable parental consent. The claim that no such system works is demonstrably false – and many are already live.
- International standards provide strong governance
The AVPA helped develop ISO/IEC 27566-1 – the first global standard for age assurance – which requires providers to offer age verification in ways that are auditable, effective, privacy-preserving and non-discriminatory. We also contributed to the development of IEEE 2089.1 on age-verification. These standards ensure that technical claims are backed by independent evaluation, not marketing spin or guesswork.
- The FTC decision doesn’t close the door
The article references the FTC’s recent rejection of a proposed new mechanism for verifiable parental consent, involving facial estimation and third-party providers. But this decision was not a wholesale rejection of the concept – it merely stated that the proposal lacked sufficient detail and independent evaluation. The FTC actively encouraged resubmission with stronger evidence.
Indeed, the EU, UK and Australia are forging ahead with exactly the kind of independent, third-party age verification the FTC is still reviewing. France now requires all adult content sites to implement “double-blind” age verification using two independent methods – and to do so without collecting or storing personal data themselves.
- Do nothing is not a responsible option
The article concludes by saying “lawmakers must grapple with reality.” We agree. And the reality is that children are routinely exposed to adult content, age-restricted apps, and online harms – often before they even hit puberty. We cannot allow perfection to be the enemy of progress. Modern age assurance can deliver highly effective protection without violating rights or demanding identity documents from every child.
What we need is smart regulation that sets minimum standards, requires privacy-by-design, and allows for continuous improvement. That’s exactly what international frameworks and market innovation are delivering.
The Age Verification Providers Association (AVPA) is the global trade body representing organisations developing and delivering privacy-preserving age assurance technologies. We are committed to helping policymakers, platforms and the public make informed decisions based on facts, not fear.
