Age verification, as a concept, is nothing new. Federal and state governments have long required businesses selling certain age-restricted products, services, and content to verify a person’s age in order to prevent children and teens from accessing things they legally are not allowed to access.
The process for doing so at brick-and-mortar retailers has long been established, and typically involves a store clerk checking and authenticating a customer’s physical ID. What is less established is the process for doing this digitally — especially for platforms hosting adult content, or other content deemed potentially harmful to children.
For years, online businesses have answered this challenge with age gating — wherein a user self-reports their age or otherwise confirms they are old enough to access particular types of content — to keep underaged individuals off of their platforms and websites. But this strategy has always had its flaws, and was relatively easy to bypass.
As more and more states pass and consider legislation requiring stricter age verification online, digital platforms hosting adult or age-restricted content need a plan for how they will comply.
Below, we take a look at this evolving regulatory landscape, speak to the risks of non-compliance, and outline a number of age verification strategies that may work for your business.
The New Regulatory Landscape: A legal maze in the making
Currently, there is no federal legislation in the United States that would require digital platforms — such as social media companies, online marketplaces, and adult content publishers — to verify the ages of their users. This dearth of nationwide regulation has left the question up to individual states, many of which have begun to enact or consider their own laws.
Currently, 18 states have already passed legislation that requires certain digital companies to perform age verification on its users, including:
- Alabama
- Arizona
- Arkansas
- California
- Florida
- Georgia
- Idaho
- Indiana
- Kansas
- Louisiana
- Mississippi
- Montana
- North Carolina
- Ohio
- Oklahoma
- Texas
- Utah
- Virginia
A further eight states are nearing the passage of age verification laws, while seven additional states have introduced legislation.
Complicating things further is the fact that each law contains nuances as to which businesses must comply with age verification requirements, how much age assurance is required, which verification methods are acceptable, and what the penalties are for non-compliance. Even if the laws are more alike than not, the subtle differences embedded in this regulatory patchwork quickly makes compliance a nightmare.
To demonstrate these differences, let’s consider three high-profile laws:
Louisiana’s Act 440
Enacted in 2022 and going into effect in 2023, Act 440 applies to any website or platform that publishes, hosts, or distributes adult or p*rnographic content. If at least one third of the content on a website or platform is adult or p*rnographic content, and the website has users in Louisiana, the law requires that platform to perform age verification so that minors are denied access. The law specifies that a platform can verify the age of a user in one of three ways:
- By collecting a digitized ID card
- By collecting a government-issued ID (such as a driver’s license)
- By relying on public and/or private transactional data (educational records, mortgage records, etc.)
Utah’s SB 194 and HB 464
These bills collectively form Utah’s Social Media Regulation Act, and apply to social media companies that have Utah residents as users. The law requires those platforms to establish an age assurance program capable of detecting minors with at least 95 percent accuracy in order to create a “safer experience for them,” but does not specify what verification measures are acceptable. SB 194 and HB 464 also include requirements around privacy settings and supervisory tools for minor accounts, which platforms must comply with.
California’s Age-Appropriate Design Code Act (CA AADC)
The CA AADC is a sprawling law that applies to any website or online platform that is “likely to be accessed by children.” It establishes strict privacy requirements for minors and limits the ways that a business can use a minor’s data. In order to comply with the law, businesses must implement a risk-based approach to age assurance, wherein any age assurance methods used are “proportionate to the risks that arise from the data management practices of the business.” It does not, however, specify which methods a business must use.
The Business Risks of Inaction
Getting age verification wrong can be a costly mistake for your business — through both direct and indirect costs.
Penalties and Fines
First, let’s consider the fact that many age verification laws establish penalties and fines to punish companies that don’t comply with the law. These fines can vary significantly from state to state. Utah’s law, for example, sets penalties at $2,500 for each violation. Florida’s HB 3, meanwhile, allows for penalties of up to $10,000 per incident. Depending on the scale of the non-compliance, these fines can quickly add up to hundreds of thousands or even potentially millions of dollars, especially for the largest online platforms.
Legal Fees
Beyond this, businesses must consider the legal costs associated with any lawsuit. In a worst case scenario, your business may be found liable to not only pay damages, but also cover the court costs and attorney fees of any claimant, as is the case in Louisiana’s law (discussed above). Even in a best case scenario, where your business is not found liable for damages, you’ll still need to cover potentially significant legal expenses associated with your defense.
Damage to Brand Reputation
Finally, it’s important to consider the indirect costs that your business may encounter by failing to comply with age verification requirements. This can include damage to your brand’s reputation, as well as the trust you have built with your users — especially if your platform caters to a younger userbase. Repairing this damage can take years of concerted effort and significant resources.
Age Assurance Solutions That Fit Your Needs
As noted above, some laws currently on the books specify which methods of age verification are acceptable and which are not. Others give businesses more flexibility in designing a risk-based approach to age verification, much like the way anti-money laundering regulations give financial institutions flexibility in designing an AML program.
As you design your strategy, it’s important to balance the need for assurance against both your need to minimize friction and maximize conversions, as well as your users’ expectations for privacy. Some users may feel uncomfortable creating an account just to access adult content, for example. Meanwhile, users who are old enough to legally sign up for a social media account may be too young to have certain government IDs, such as driver’s licenses — necessitating alternative verification methods. It’s important to keep these considerations in mind as you decide which verification methods your platform will ultimately rely on.
That being said, here are three common age verification methods you may want to consider, each of which brings with it different levels of friction and perceived intrusion:
ID Document Verification
With ID document verification, a user is prompted to capture and upload a photo of their government-issued ID, such as a driver’s license, ID card, or passport. The ID is then analyzed for signs of tampering and fraud, and (optionally) authenticated against an issuing database. To aid in the detection of fraudulent IDs and deepfakes, a user may also be prompted to capture and submit a selfie, which can be biometrically analyzed against the portrait in the ID.
ID document verification offers a high degree of assurance, but it can also introduce friction to the onboarding flow, especially in cases where a user may not have an ID on them. Some users may also find it intrusive, or may be otherwise hesitant to provide their ID to an online business.
Age Estimation
With age estimation, a user submits a selfie which is then analyzed with machine learning and AI techniques to determine the user’s age within an acceptable margin of error.
Because age estimation does not require a user to submit PII or an ID document, it offers the lowest friction and privacy intrusion of the discussed verification methods. It also offers a balance of assurance and friction that falls between both ID verification and database verification.
It’s important to note that not all age verification solutions are created equal. In recent testing by the National Institute of Standards and Technology (NIST), Incode emerged as the top performer for age estimation and verification solutions.
Database Verification (non-document)
With database verification, a user supplies information about themselves — for example, their name, phone number, address, date of birth, etc. — which is then cross-checked with information contained in government, public, or private databases.
Database verification still introduces some friction to the onboarding flow, but less friction than is introduced by ID document verification. Likewise, many users will find database verification to be less intrusive. That being said, it may provide less assurance than ID verification and is dependent on database coverage.
The Future of Age Assurance: Prepare Now for What’s to Come
While there is currently no federal law requiring social media platforms or adult content websites to implement age verification, there’s no guarantee it will stay that way. A number of bills have been considered, and more are likely to be considered that could require nationwide age verification. Federal legislation may even be the favorable outcome, especially versus the currently fragmented regulatory landscape that state laws have introduced.
Whether you currently operate in a state that requires verification or you are simply planning for possible federal law, coming up with an age verification strategy now puts you ahead of the curve.
How Incode Can Help
In choosing an age verification solution, it’s important to look for a flexible, reliable partner with a track record of keeping pace with rapid technological advancements. With Incode, you get all three.
Whether you are interested in deploying facial age estimation, ID document verification, or database verification, Incode’s platform can help you achieve the level of assurance you want and need to stay compliant with applicable regulations.
Want to learn more about how Incode can help you design and build an age estimation strategy that works for your business? Get in touch with an Incode Identity Consultant, or request a free demo today.
