Age assurance for social platforms, from minimum-age laws to age-appropriate design Written on
Age assurance for social platforms, from minimum-age laws to age-appropriate design
Trust and safety and product teams at social platforms are being asked two different questions at once. Can you keep users below the minimum age off the service, and can you give the young users who remain an experience built for their age? Minimum-age laws are arriving fast, and an 18-plus gate answers neither question well. The platforms that cope are treating age as a signal they route on, not a single yes-or-no check at the door.
In a nutshell
- Minimum-age laws are moving from proposal to enforcement. Australia's under-16 rule is live, France has legislated an under-15 ban, and the European Parliament has called for a harmonized limit of 16.
- A minimum-age rule and age-appropriate design are two separate duties. One keeps under-age users out; the other shapes the product for the young users who stay.
- Australia's rollout shows that available technology does not guarantee an effective system. Retries, existing accounts, and account lifecycle decide whether a check holds.
- A single 18-plus gate is the wrong shape for social. The minimum age differs by market, and platforms that tailor the experience for minors need to tell age stages apart too.
- The strongest approach estimates age in a low-friction first step and escalates only uncertain or higher-risk cases, storing as little as the decision allows.
What do the new minimum-age laws require?
Three regimes now set the direction. Australia's under-16 social-media obligation took effect on 10 December 2025, and covered platforms must take reasonable steps to stop Australians under 16 from creating or keeping accounts. France has gone next, passing a ban on social media for children under 15, with new accounts blocked from September 2026 and existing accounts covered from January 2027. At EU level, the European Parliament has backed a harmonized digital age of 16, with access from 13 allowed under parental consent, though that resolution is a direction of travel rather than binding law today.
The common thread is that responsibility sits with the platform, not the child or the parent. Australia's framework is deliberately technology-neutral, so no single vendor or method is mandated, and government identification cannot be the only route on offer. A platform has to show that its whole system is reasonable, and that the data behind it is handled lawfully.
Minimum age and age-appropriate design are two duties
Keeping under-age users out is only the first obligation. The second is age-appropriate design, and it applies to the young users a platform is allowed to keep. Under the EU Digital Services Act, very large platforms must take proportionate measures to protect minors, and the act leaves the specific measures to the service. In the UK, the Children's Code is the framework that names age stages, treating 13 to 15 and 16 to 17 as different groups with different needs.
These two duties pull in different directions. A minimum-age rule wants a clean boundary at one age. Age-appropriate design wants to tell a 13-year-old apart from a 17-year-old so that recommendations, direct messaging, location sharing, and default privacy settings can change with the user. A single adult-or-child gate cannot serve both. It answers the boundary question and goes silent on everything above it.
What does Australia's rollout teach social platforms?
Australia ran the largest public test of this so far. Its Age Assurance Technology Trial assessed more than 60 technologies from 48 providers and concluded that there is no substantial technical barrier to age assurance. Then the social-media rollout exposed a harder truth, that an available method does not make a platform's process effective.
Platforms reported removing or restricting roughly 4.7 million under-16 accounts by mid-December 2025, which showed real scale. But the regulator's March 2026 compliance reporting flagged problems that had nothing to do with whether the technology works. Some platforms prompted users to attempt an age check even when the account already declared an age below 16. Some let a user repeat the same method until it returned a 16-plus result. Others made it hard to report an account belonging to someone under 16, and did little to stop new under-age accounts from being created. Each of these is a system-design failure. The decisive controls sit around the model, in who gets checked, how often a user can retry, what happens after contradictory evidence, and how re-registration is caught.
Why an 18-plus gate is the wrong shape for social
A single 18-plus gate is the wrong shape for social, because social platforms rarely have just one line to enforce. The minimum age itself differs by market, 13 in some, 15 in France, 16 in Australia and the EU proposal, and separate features such as adult content or certain monetization can sit at 18. Platforms that also tailor the experience for the minors they keep, as the UK Children's Code expects, need to tell 13 to 15 apart from 16 to 17 as well.
All of that runs on one input, an estimated age the platform can test against whichever threshold applies. A yes-or-no adult check never produces that number, so it cannot enforce a market's minimum age or drive an age-appropriate default. Facial age estimation returns an estimated age from a single image, and the platform compares it against the line that matters for the market and the feature. The estimate is a signal to build from, not a ready-made classification handed back by the vendor. A transparent estimate can support age-appropriate defaults while preserving an alternative route for any user the system reads incorrectly, so a wrong guess never becomes a locked door.
How do you check age without adding signup friction?
Every extra step in signup costs real accounts, so the goal is to spend friction only where risk requires it. A waterfall does that. Most users clear a low-friction first step, and only uncertain or higher-risk cases escalate.
The table below shows the three decisions a social platform actually makes, and the signal each one needs.
| Decision | What you need to know | Typical method |
|---|---|---|
| Keep under-minimum users out | Is this user above the minimum age | Facial age estimation first, escalate cases near the threshold |
| Apply age-appropriate defaults | Which band the user falls in | Estimated age, which the platform maps to its own bands |
| Open a higher-risk feature | Higher confidence on age, and identity for payment or real-money features | Conservative estimation with liveness, escalating to document or wallet verification |
Read top to bottom, the same user can move through the flow without meeting every method. A clear adult passes the first step and never sees the rest. A user near the boundary escalates to a stronger check. A user reaching for a payment or real-money feature verifies once. Proportionality becomes a routing rule instead of a line in a policy.
How should social platforms handle privacy and persistent accounts?
Social users hold accounts for years, which changes the privacy problem. Session-by-session anonymity, the model that suits an anonymous adult-content visit, is a poor fit when the same person signs in every day for a decade. The right goal for social is data minimization, checking age with the least information the decision needs and keeping as little of it as possible afterward.
That points to methods that return a narrow result and store nothing sensitive. Facial age estimation can operate without learning identity and without retaining a biometric record, so a platform can act on the estimate and hold no face image. Where a stronger check is required, the platform should keep the age fact it needs and discard the raw capture, rather than letting an age check harden into a permanent identity profile of a teenager.
Conclusion
Minimum-age laws have moved age assurance to the center of the social product. The platforms that handle it well treat the law as two jobs, not one. They keep under-age users out with a system that resists retries and re-registration, and they give the young users who remain an age-appropriate experience built on a real age signal. Both jobs run on the same foundation, an estimate that most users clear in seconds, escalation reserved for genuine uncertainty, and a data trail kept as short as the decision allows.
Where Youverse stands
Youverse builds age assurance for platforms that have to keep minors out and design for the young users who stay. YouAge is the everyday route, estimating age from a single selfie in under a second and storing no biometric data, so most users clear a check and the platform still gets the age signal that age-appropriate design needs. YouLive protects the moments that call for a stronger check, adding ISO/IEC 30107-3 certified liveness and injection detection so a verification resists photos, masks, and generated video. Because social accounts persist for years, YouAuth anchors a verified result to the person who created it through distributed face authentication, which helps prevent an adult account being handed to a child, and no central biometric database is ever built. Each user is routed to the least intrusive method that fits the decision.
Frequently asked questions
Does a minimum-age law replace age-appropriate design?
No. A minimum-age law decides who may hold an account. Age-appropriate design decides how the product behaves for the minors who are allowed on it. Most social platforms have to satisfy both at once.
Does social need age bands or just a single minimum age?
It depends on the market. A hard minimum-age ban, like Australia's, mainly needs a reliable check at one threshold. Age-appropriate design regimes, like the UK Children's Code, expect the experience to differ for 13 to 15 and 16 to 17, and that is where bands apply. Both run on the same estimated age, tested against whichever line applies.
Why did Australia's rollout run into problems if the technology works?
The trial found the technology feasible. The early failures were about system design, allowing unlimited retries, ignoring a declared under-16 age, and weak handling of existing and new accounts, rather than the accuracy of any single model.
How do we add age checks without hurting signup conversion?
Use a waterfall. Let most users clear a low-friction estimate, and reserve document or identity verification for cases near the threshold or reaching for higher-risk features. Friction is spent only where the risk is real.
What data does a social platform need to keep after an age check?
As little as the decision allows, and for most users that is close to nothing. Facial age estimation processes a selfie to return a result, but the strongest setup keeps no image and stores no biometric data. Identity documents are collected only when a case escalates, so most users never hand one over, and anything gathered then should be held only as long as that decision requires.
Continue the series
