Today, protecting children in the digital environment is a cause no one questions, but it hides a rather complex technological and legal quagmire . The idea is noble: to prevent children from seeing things they shouldn't, but the problem arises when we want to implement this without the rest of us having to hand over our entire lives in an online form.
The tension is palpable, as many lawmakers and social media platforms view age verification as a panacea. However, this has sparked intense debate about whether it's possible to protect children without creating a mass surveillance system where adults have to pass through a facial scanner or upload their ID just to access a website.
What exactly do we mean when we say age verification?
To avoid confusion with terminology, it's important to distinguish between a political objective and a technical tool. Age restrictions or guarantees are simply compliance standards ; that is, the intention is to prevent someone from entering if they are underage, but they don't explain the "how."
Where things get interesting is in the methods. On the one hand, we have age estimation , which is basically a guess based on the user's behavior, voice, or face. It's more convenient because it doesn't require paperwork, but it's quite unreliable, especially with people from certain ethnic groups, and it's easy to fool with a simple disguise or an AI trick.
On the other hand, there's age verification itself, which seeks absolute truth through reliable sources, such as a passport or driver's license. While it seems more secure, the risk here is that your biometric and personal data will be stored on servers that could be compromised or used to create commercial profiles of you without your knowledge.
The ways to prove that you are of legal age
Currently, there are several ways to pass this "filter", each with its pros and cons:
- Upload official documents: The user uploads a photo of their ID card or passport. Google, for example, uses this method, ensuring that the document is deleted after verification, although the date of birth is saved in the account to improve the user experience.
- Use of credit cards: The system takes advantage of the fact that you must be of legal age to have a card. It makes a bank authorization request (free of charge) to confirm that the card is valid and current.
- Token- or credential-based systems: It's the most modern and respectful option. Instead of handing over the document, the user presents a digital "token" that says "Yes, this person is over 18," but It does not reveal who the user is. nor his real name.
The response of the European Union and the DSA
The European Commission has not been idle and, under the Digital Services Act (DSA), is promoting a harmonized approach across the EU . The goal is for platforms to use a common standard that is easy to use and does not infringe on privacy, rather than having to invent a different method each time.
To achieve this, a solution called a "mini wallet" or digital identity wallet has been developed . This system allows a trusted entity (such as a bank or government agency) to verify your age, and you only need to share cryptographic proof. This way, the website knows you are an adult, but doesn't know exactly who you are , adhering to the principle of data minimization.
The AEPD's ten principles and the protection of rights
In Spain, the Spanish Data Protection Agency (AEPD) has been very clear in establishing that the protection of minors cannot be an excuse to spy on the population. Therefore, they have proposed a set of fundamental principles that any system should follow:
Most importantly, the system must be anonymous to internet service providers and user profiling based on browsing activity must not be permitted . Furthermore, it is emphasized that verification should only be required for genuinely inappropriate content and that parents must be guaranteed the ability to effectively exercise their parental authority , supported by tools such as the new parental control mode in some AI systems.
Risks and dilemmas in global implementation
Despite good intentions, in practice this is a minefield. Many platforms, such as Bluesky, have chosen to block access in entire regions rather than comply with laws that require them to collect sensitive user data, arguing that this infringes on freedom of expression.
There is a real fear that if uploading one's ID to view adult content becomes normalized, it will then spread to any sexual health forum or self-exploration community, eliminating online anonymity . Furthermore, automated systems can make mistakes, excluding adults from legal services simply because an algorithm failed to properly recognize their face.
The key to making this work without turning the internet into a panopticon is to prioritize privacy by design . You don't need to know someone's name, surname, or address to know they are over 18; a secure digital authentication that protects the citizen's identity while keeping children safe from the dangers of the online world is sufficient.
