The internet is asking for your ID. Half of U.S. states and the UK now require identity or age checks for certain sites and services — and the thing you hand over to prove you're an adult is becoming one of the most sensitive data trails you leave anywhere.
The checkpoint spread fast
Twenty-five states now mandate age verification for adult content, nine of them passing laws in 2025 alone, per the tracking site State of Surveillance. The UK went further: under rules in force since July 2025, platforms must run "highly effective" age assurance, and BleepingComputer reports the government's new regime will require ID or a face scan before you can even create a social media account. Ofcom's accepted menu — photo-ID matching, facial age estimation, banking checks, digital ID, mobile-carrier lookups — has one common thread: simply stating your age no longer counts.
So a normal person's year now includes uploading a driver's license to one service, scanning their face for another, and doing it again every time a new law kicks in.
What you're actually handing over
Verification usually runs through third-party vendors — Yoti, AU10TIX, Jumio, Persona — that process your ID or face scan and build a biometric template. That's where the risk concentrates, and the record is not comforting.
Discord lost 70,000 ID photos in an October 2025 breach. A dating app leaked 72,000 verification selfies. AU10TIX itself — a company whose whole job is handling IDs — has had its own high-profile security failure, as the EFF notes. And unlike a password, a face doesn't rotate. Once biometric data leaks, it's compromised for life.
It gets worse than breaches. State of Surveillance found that Persona — used by Reddit and Discord — wasn't just estimating ages: face scans fed 269 separate verification checks, including screening users against adverse-media categories from terrorism to espionage. Persona and Facetec have also reused verification data for advertising. You came to prove you're 18; you left enrolled in a screening system.
Why privacy experts keep shouting
The EFF's core warning is structural: age verification quietly ties your online activity to your legal identity, ID by ID, site by site — infrastructure that looks a lot like mass surveillance built one compliance step at a time. Marketplace reports the same anxiety from privacy researchers as social-media age checks spread: who receives the data, who stores it, and who controls it are questions most laws barely answer.
What you can do about it
You can't opt out of the laws, but you can limit the blast radius. When a service offers options, pick facial age estimation over document upload — an estimate is less durable than a stored ID. Before uploading anything, check who the verifier is and search their retention policy; "deleted immediately after verification" and "retained" are very different sentences. Never verify through a link in an email or DM — ID-upload phishing is the scam this wave invited. And where a service you barely use demands documents, ask the honest question: is this account worth my passport?
Proving your age is becoming unavoidable. Donating your face to an ecosystem with this track record doesn't have to be.
Image: cottonbro studio, via Pexels
