To get ahead of tighter youth-protection laws, leading tech companies are trialing new, far-reaching methods for determining age. While Discord is betting on cryptographic proofs delivered through digital wallets, platforms such as Google and OpenAI are turning to artificial intelligence for behavior analysis. The debate over protecting minors is thus increasingly becoming a fundamental question about global data privacy and the surveillance of all internet users.
The simple click on a checkbox to confirm you are of legal age is increasingly becoming a thing of the past on the modern internet. Driven by regulatory pressure at home and abroad, the classic, easily circumvented self-declaration is giving way to complex technical procedures. Today the range spans from biometric facial recognition and automated behavior analysis to digital identity proofs.
Lawmakers Put Platforms on the Hook
The backdrop to this accelerated development is a noticeable tightening of legislation, especially in the United States. Legislative initiatives such as the App Store Accountability Act and the Parents Over Platforms Act aim to shift legal responsibility for youth protection away from individual website operators and directly onto the major platform and store operators such as Apple or Google.
To get ahead of looming lawsuits and hefty fines, the tech companies are already putting preventive control mechanisms in place. Whoever is liable protects themselves, and does so as comprehensively as possible.
Two Paths: Cryptographic Proofs vs. Behavioral Surveillance
In practical terms, two opposing technological approaches are currently taking shape:
1. The Wallet Approach (Example: Discord)
The communication service Discord is currently experimenting with integrating digital wallets. Using Google Wallet, users can provide a cryptographic proof.
- The principle: The platform itself gets no insight into the ID card or personal data. It merely receives a cryptographically signed confirmation that the wallet’s holder has passed a certain age threshold.
- The catch: The procedure is only as secure as the verification underlying it. Before the wallet can issue such a proof, the ID data must have been submitted once to the wallet provider and verified there.
2. The Behavior-Based AI Approach (Example: Google & OpenAI)
Google and OpenAI are taking a different route. Here, algorithms scan ongoing usage behavior, the nature of search queries and general account activity in the background.
- The principle: If an account’s behavior shows patterns typical of minors, the system raises the alarm.
- The consequence: When there is reasonable suspicion, the account is temporarily restricted. The user then has to actively submit an official photo ID to lift the block and manually prove they are of legal age.
The Dilemma: Protecting Minors Requires Total Data Capture
This technological arms race brings with it an unresolved fundamental problem under data-protection law: to reliably identify and protect minors on a platform, the data of all users must inevitably be captured and analyzed. A selective check that affects only children and teenagers is not technically possible.
Critics have long warned that storing sensitive ID data on third-party servers poses a massive security risk. That these warnings are justified was recently demonstrated by a data breach at an external verification provider that Discord also uses for its age checks. Even when platforms assure users that documents are deleted immediately after the match, the files often remain in the servers’ cache long enough to become a target for cyberattacks.
💡 Background: The Key Technical Terms Briefly Explained
- Digital wallets: Apps on smartphones (such as Google Wallet or Apple Wallet) in which, alongside payment cards, digital identity proofs, tickets or indeed verified age certificates can increasingly be stored securely.
- Cryptographic proof: A mathematically encrypted procedure by which the authenticity of a piece of information (e.g. “user is over 18”) can be confirmed without the underlying raw data (such as name, date of birth or ID number) having to be transmitted to the recipient.
- Behavior-based AI analysis: A system in which artificial intelligence analyzes human behavior patterns (typing speed, search terms, online hours) and matches them against the patterns of specific user groups in order to make predictions about characteristics such as age.
