On 9 September 2026 Steam switched on an over-18 gate for Australian buyers, and within days adults who had been customers for years were locked out. The same month, mandates kept rolling across the UK, the US and the EU, while 438 security and privacy researchers had already called large-scale age-based access control “dangerous and socially unacceptable”.
Nobody seems to have asked the scientists. The laws keep passing anyway, which is the puzzle at the centre of age verification and the identity-verification crisis. Mandates advance on political logic while implementations fail on technical logic, and the two never have to meet.
Why did Steam’s Australian over-18 gate fail so many legitimate adults, and what does that say about single-method brittleness?
The gate failed legitimate adults at scale because a single credential type cannot stand in for a whole population. In practice, only Mastercard-network debit cards flagged adults-only by the issuing bank passed. That is single-method brittleness, and it is worth keeping in mind before you commit to any one method.
Valve had to do something. Australian law requires an over-18 check to buy apps and games online, but specifies only “appropriate age assurance measures”, no method. Valve chose a bank card rather than a government ID or facial scan: a card links a payment to a name and address, while an ID is a larger exposure if leaked.
The reality was messier. Credit cards work because they are only issued to adults. Debit cards are different: minors can carry them, and they only passed where the issuing bank had flagged the card as adults-only on the Mastercard network. Reddit reports sorted the winners from the losers: Commonwealth, Westpac and Macquarie worked, while Bendigo, St. George, Revolut, ANZ and most Visa cards failed.
Only about 45% of Australians own a credit card, and among 18-24 year olds it is 25 to 30%. One credential turns every gap in card ownership or issuer flagging into a mass false rejection. Failures push users toward the low-assurance self-declaration tick-box Ofcom and the ICO agreed cannot meet the standard, and brittle gates invite VPN circumvention and a detection arms race. That is why the verification methods behind these failures are all trade-offs.
Why does point-in-time age verification fail against account sharing and hand-me-down credentials?
A point-in-time check establishes age at enrolment, not continuously. Account sharing and hand-me-down credentials move access after the gate, so a verified adult passes the account to a minor and the real false-accept rate climbs even when the check works. Regulators respond with ongoing behavioural monitoring and cross-transaction risk analysis, trading a binary gate for continuous monitoring of account activity.
The check proves eligibility at one moment and stores nothing about what happens next. A parent verifies, hands over the password, and the checkpoint is defeated without anyone breaking a rule.
Roblox says its initial check is necessary, but age assurance does not end at the selfie, because accounts can be shared or handed to a younger sibling. To keep checks current it built a machine-learning layer that checks whether an account’s ongoing behaviour still matches its estimated age.
Before your team commits to a point-in-time gate, note the fallback: the one-time check becomes standing surveillance of activity against estimated age. It is why the widening mandate/implementation gap keeps growing, and why the identity stored behind the check becomes a breach honeypot.
Why is age verification described as infrastructure that doubles as censorship infrastructure?
Most age checks are, in practice, identity checks. The rails built for age gating are general-purpose: once your platform can verify identity, it can gate or restrict by identity indefinitely, and the capability persists long after the child-safety justification fades. The cost is the chilling effect, as adults self-censor or are deplatformed.
As age verification is rolled out today, everyone must identify themselves to the service or a third party that can link them to their activity, so most age verification is identity verification.
The costs are already visible. When identity attaches to activity, fear for their own safety leads to self-censorship and a chilling effect, and anonymity and pseudonymity become collateral damage. Adults who refuse or fail verification are displaced, and the direction is removal rather than accommodation: Australia’s eSafety Commissioner removed roughly 4.7 million under-16 accounts by mid-December 2025. Storing the IDs is why storing an ID creates a breach honeypot.
None of this has slowed the build-out, which raises the question of why the wave keeps building them.
Why are age verification mandates advancing when 438 security and privacy researchers called them “dangerous and socially unacceptable”?
Mandates advance on political incentives rather than technical merit. Legislators capture the child-safety framing while the compliance cost falls on platforms and users, and accountability is shifted onto operators. The 438-researcher open letter documents the opposition without slowing any jurisdiction.
“Protecting children” is politically hard to oppose, and the “think of the children” argument does heavy lifting. The state pays little for the policy while keeping the optics, and duty-of-care models leave the operators holding the risk, so nobody in government owns the failures.
The catalysts made 2026 a tipping point: the UK’s Online Safety Act duties went live on 25 July 2025 with Ofcom investigating more than ninety platforms, the US Supreme Court upheld Texas HB 1181 on 27 June 2025, and the EU declared its age app ready on 15 April 2026. Forty-plus US states now have age-verification bills, and Australia’s duty-of-care model, enforced by the eSafety Commissioner, runs the same playbook. If your product ships in any of these markets, the regulatory regimes driving the mandates are the fuller map.
The letter is the part to hold onto. It calls it “dangerous and socially unacceptable” to introduce a large-scale access control mechanism without understanding the implications for security, privacy, equality and autonomy. That reframes the child-safety label as identity verification, and it has not slowed any jurisdiction down: lawmakers do not understand the technology, and they do not understand that these proposals are unpopular, as the EFF’s Aaron Mackey put it. The letter reads as a canary, a warning that has yet to stop the machinery.
The mandate/implementation gap is part of the design: mandates run on political incentives, so the failures never count against them. Each documented failure shows what the rails become, standing identity and censorship capacity already harder to roll back. So judge the next mandate by its incentives and its rails, and read expert objection as a warning sign rather than a deciding verdict. Ask who pays the compliance cost and what the rails can do beyond child safety. That is how the mandate gap plays out across the cluster.
Frequently Asked Questions
How do I know if a platform is actually checking my age or just gathering my identity?
You usually cannot tell from the interface, and that is the point. An age check that asks for a card, a licence, a passport, or a facial scan is really an identity check, because it must tie a verified person to the account. Genuine age assurance aims to confirm a threshold, often without identifying you, though most deployed systems still collapse age into identity.
Is age verification the same thing as age estimation?
No, and conflating them hides the cost. Age verification confirms a person’s age against an authoritative record, such as a government ID or a bank credential, so it identifies the user. Age estimation infers a likely age band from signals like facial features or account behaviour, without necessarily identifying anyone. Regulators increasingly accept estimation as “highly effective” assurance, which is why the two now blur together.
What happens if I refuse to verify my age?
In practice you get locked out, not merely gated. Age verification systems treat refusal as a failed check, so the service is withheld until you comply, which is why critics call the outcome displacement rather than protection. Australia’s bulk removal of roughly 4.7 million under-16 accounts shows the enforcement direction: the default is removal, not accommodation, and privacy-conscious adults are caught in the same net.
Can a VPN really defeat age verification?
Sometimes, but that is a symptom rather than a solution. A VPN can hide your location, yet many checks now bind to a payment credential, a device signal, or an account identity that survives the IP change, so the workaround only helps when verification is purely geography-based. The bigger effect is the arms race it triggers, where platforms invest in detection instead of fixing the brittle gate.
Doesn’t almost everyone have a credit card, so isn’t card-based verification fine?
No, and the numbers show why. National credit-card ownership sits around 45%, and only 25 to 30% among 18 to 24 year olds, so a card-only gate excludes a large share of legitimate adults before it catches a single minor. It also rewards card access rather than age, which is a poor proxy for eligibility.
What should a CTO watch for before adding age verification to a product?
Watch the credential your gate depends on and who it silently excludes. Ask which single method you are relying on, what happens when that method fails for a legitimate adult, and whether the fallback is a weak self-declaration or an invasive monitoring regime. Also confirm where identity data is stored, because a stored ID record is a breach honeypot, and whether the capability you build will outlive its stated purpose.
Will age verification expand beyond adult content?
It already has. The same identity rails built to gate minors are general purpose, so once a platform can verify a person it can gate, rank, or restrict by identity for any reason. The UK’s Online Safety Act, Texas HB 1181, and the device-level turn toward OS age verification show the scope widening from pornography to social media, gaming, and the operating system itself.
Can age verification be done without collecting anyone’s identity?
In principle yes, and this is the strongest technical objection to current mandates. Age assurance can use privacy-preserving methods that prove a threshold without revealing a name, such as zero-knowledge proofs or on-device estimation, so the user is never identified to the service. The problem is that most deployed systems do not use them, so the privacy failure is a design and procurement choice, not a technical inevitability.
Does this matter if my platform isn’t aimed at children?
Yes, because the obligations rarely depend on your audience. Duty-of-care and “highly effective age assurance” regimes push obligations onto any service children might reach, so a general platform with no child focus can still be required to estimate or verify age. The rails you are forced to build are general purpose, and that is the point critics keep making.
What does “highly effective age assurance” actually require?
It is a regulatory standard, not a specific technology. Ofcom’s framework demands assurance that is highly effective at correctly determining age, which in practice means methods accurate enough to satisfy the regulator, whether that is a card check, an ID scan, facial estimation, or a combination. The standard sets a bar for reliability but leaves implementation open, which is exactly why implementations vary and fail.
Why do platforms adopt these checks if they know they’re weak?
Because the compliance cost of refusing is higher than the cost of a bad gate. Adopting a check lets a platform claim good faith and reduce its legal exposure, even when the method is known to be brittle and pushes legitimate adults out. The incentive rewards visible compliance rather than working assurance, so platforms ship the cheapest gate that satisfies the regulator.
What do these failures actually cost users?
More than the headline figures suggest, because the costs are diffuse and ongoing. Legitimate adults are locked out of services they are entitled to use, privacy-conscious users self-censor or withdraw once identity attaches to activity, and the monitoring fallback turns a one-time check into standing surveillance. The people affected pay quietly while the state captures the child-safety optics, which is why the gap persists.
