# Who is liable when the device signals an inaccurate user age?


*Operating system age controls are a useful layer of protection but cannot replace age checks by the website itself. Most rest on an unchecked date of birth, cover only some devices and describe the account holder rather than the person using the device. Apple’s iOS 26.4 adult check is not passed to websites as a verifiable result, and where Apple and Google do share an age signal, their terms cap their liability and require the website to indemnify them. A device signal should be used to grant adults access only if it meets the same certified standard as any other age check and someone stands behind it. *



**Why not just rely entirely on operating system age controls?**



The controls currently built into phones and computers were designed to help parents who choose to do so to manage a device, not to tell a website that the person in front of the screen is an adult. They are a valuable safety layer but they cannot carry the whole burden of protecting children online.



**Parent-set controls can alert services to some child users**



When a parent sets up a child's phone and marks the account as belonging to a minor, that setting is good evidence that a child is using it. A potentially harmful website or app can safely act on it by refusing access.



The reverse is not true. Most of these settings rest on a date of birth typed in when the account was created, with nobody checking it is true. A 15 year old can buy a handset with cash, activate it with a prepaid SIM and enter any birth year they like. On a shared, borrowed device, the setting describes whoever set it up rather than whoever is holding it – and a device passed on to a child may inherit an adult setting if not reset. So a setting that says "adult" reliably tells a website very little, and treating it as proof would hand every teenager a singular route around the law.



We also know from the experience of the last 20 plus years that adoption is a practical obstacle. Parental controls only protect children whose parents find, understand and configure them, and take-up is consistently low. A protection that depends on voluntary action by parents cannot be the basis by which digital services meet their legal duty to protect all children.



**Operating systems may not pass age check results to websites**



Apple's recent update in certain jurisdictions since the release of iOS 26.4 is the clearest example. Apple asks account holders to confirm they are over 18, using things like account history, a payment card or an ID scan, and only lifts its own content filter for those who do. That is a genuine improvement, but it is an internal Apple process. Apple does not send websites a signed confirmation that this user has been checked. 



The practical result is that a site can only tell it is being visited by an Apple device with the filter switched off, once it confirms the device is running a recent version of iOS in a jurisdiction where this functionality is applied. That is a clue rather than a check, and one that is easy to fake, as a website's assessment of which operating system is in use can be readily altered.



The protection also has limits that no website can see or verify:




It covers one company's devices. A child using an Android phone, a Windows laptop, a games console or a smart TV is unaffected by anything Apple does.



It covers recent devices. Older handsets, including the hand-me-downs younger children often use, fall outside it entirely.



It is checked once, against the account rather than the person. Once an adult has completed it, the filter stays off for anyone who later picks up that device.



It depends on a filter that operates according to Apple’s undisclosed lists and keyword rules so cannot be relied upon to be either consistent or comprehensive.



With the exception of Apple’s own apps such as FaceTime and Messages, it only governs services reached through the browser. Children are also exposed to adult content through apps, messaging, file sharing and AI chatbots, and through web pages opened inside an app rather than in the browser itself.




Pornhub unblocked access to new users with an updated iPhone on this basis. It would not be able to demonstrate to a regulator how any individual user's age was confirmed, because it can only assume Apple has done so effectively. We do not think that meets the UK or Australian legal standards, and the regulators have not stated that it does.  Indeed, Ofcom is currently conducting a formal investigation into Aylo’s approach.



Apple’s alternative tool which does share an age range is available only to downloaded apps, not to websites visited through a browser.  That age is currently entered by the person setting up the device so is effectively still only a form of voluntary parental control described above, except in a limited number of jurisdictions e.g. Australia, Brazil, Utah and Singapore, where additional assurance is required for adults.



A legal duty cannot rest on a control that one company is free to change, withdraw or decline to offer in a given country, and that the website has no means of confirming was ever applied to the person in front of the screen.



**Where an age signal is shared, nobody stands behind it**



Both Apple and Google have built mechanisms that can share a person's age with a website or app, and both are technically well designed: the website can be told only that the person is, for example, over 18, rather than receiving a date of birth, and the underlying credential is signed by the authority that issued it, e.g. a state driving authority or the wallet provider itself. The assurance therefore comes indirectly from that issuing authority rather than from Apple or Google.



But critically, neither company stands behind the result. Both explicitly limit their liability if the information turns out to be wrong and they are proven to be at fault, Apple to just $50[i] and Google to $10,000[ii], and both require the website relying on the signal to indemnify them for legal claims arising from its use. Google's terms expressly extend that further, to include actions brought by government authorities. So, if a website that relies on the signal that is wrong and is prosecuted, it carries the entire legal risk itself, and may end up paying the wallet provider’s legal costs as well. These two corporations also control who may use the mechanism at all, and either can withdraw access at any time. Apple's rules exclude the adult industry outright.



California's **Digital Age Assurance Act**, where parents type in the age that is then shared by the operating system on request with apps, removes liability by statute, leaving little incentive to ensure the system is effective at protecting children. Operating system providers and developers who make a good faith effort to implement this mechanism receive broad protection from liability, including for wrong signals.



Of course, laws can be passed which require the operating system to obtain and share a reliable age signal, and to assume liability for error. That could be effective and convenient. But such a law creates no obligation on any website to ask for the signal or act on it, so on its own it changes nothing. It depends on the operating system knowing the age of the particular person using the device, which could work reasonably well on a recent phone but remains weak on shared computers, consoles and televisions. It moves responsibility away from the party that creates the risk, profits from it and is best placed to identify it within its service and manage it, onto a company with no role in the transaction between the supplier and the consumer. Apple and Google can be expected to resist such laws, and they may well succeed in stopping them in court, if not earlier in the legislative process through lobbying and the leverage of their investment decisions.



Websites that outsource age assurance to an independent provider do so by contract, with clear terms determining liability, with guarantees and indemnities, and will usually undertake due diligence of their suppliers or confirm they are certified against relevant standards.



Device signals can play a part but only under two conditions:



1.     A device signal may be used to deny access to a child at any time, but may only be used to grant access to an adult if the underlying check meets the same effectiveness standard the law requires of any other check elsewhere in the technology stack (app store, publisher, network), and has been independently certified and documented in the same way.



2.     The ultimate duty to protect children stays with the website. If an operating system provider is willing to meet the standard and stand behind its signal, a website may contractually agree how it will rely on it. If the device OS providers continue to disclaim all responsibility, then websites cannot discharge their obligations.



Relying entirely on operating systems would concentrate child protection, and the personal data used to prove age whether or not it is retained, in a handful of global companies, none of which has agreed to be accountable for getting it right, while removing responsibility from the platforms that profit from their products. It could also create exactly the kind of centralised store of identity data that opponents of age verification claim to fear, and entrench the market position of a small number of firms. The alternative already exists: technology neutral standards, independent certification and reusable, interoperable age checks that let a person prove once that they are an adult and then use that proof across many sites, without any central party holding a record of who went where. Until someone else is accountable for an alternative age signal, the duty to check age remains with the website. 







[i] Apple's Verify with Wallet on the Web Terms and Conditions provide that the website, and not Apple, is solely responsible for verifying the validity of transactions, and that Apple "will not be liable under any circumstances for any Unauthorized Transactions or erroneous Transactions". The service is provided "as is" and "with all faults", with warranties of accuracy expressly disclaimed, and the terms acknowledge that it may contain inaccuracies or errors. The website must defend and indemnify Apple against all claims, losses and legal costs arising from its use of the service or any violation of applicable law, with Apple entitled to take over the defence at the website's expense. Apple may suspend or terminate access at any time, for any reason or no reason. Access is limited to approved business categories, which do not include adult content, and the acceptable use guidelines for this feature bar any website primarily offering sexual items or services, along with tobacco, vaping, firearms and controlled substances.



[ii] Google's Verify with Google Wallet Relying Party Terms of Service state, in capital letters, that Google makes no commitment about the data's reliability, authenticity, completeness or accuracy, or its suitability for age, identity or credential verification, and that it is provided "as is". Google is not responsible for inaccuracies or errors in data reported to it by the third party that issued the credential. The website must indemnify Google against all liabilities and expenses, including legal fees, relating to any allegation or third-party proceeding "including actions by government authorities", arising from its use of the data or violation of the terms. Google may deny or revoke access at its sole discretion at any time, including after a business has integrated the service.