Governments converge on age assurance but diverge on how to implement it

Governments around the world are increasingly aligned on the view that minors need stronger protections against online harms, in the form of age assurance. The specific models of age assurance they are arriving at, however, are as diverse as the harms they are prioritizing.

Competing models are emerging. Australia and the UK are setting up marketplaces of age assurance technologies from age verification and biometric facial age estimation providers. Many countries across Asia are requiring the use of national IDs, while the EU is developing its dedicated app intended to preserve user privacy. In the absence of a national approach, American states have set out in every different direction.

Each of these approaches has potential benefits, but as the 2026 Age Assurance & Digital Age Credentials Market Report from Biometric Update and Goode Intelligence shows, none has yet been proven effective at applying the age controls societies want without unduly impacting all other internet users, as implementations, assessments and standards are still in development.

Age assurance provider marketplace

Australia’s system is based on a regulated marketplace of age verification, estimation and inferencing technologies. The first report on its early implementation results shows more than half of children on age-restricted platforms have still never been asked to confirm their age, three months after the law took effect. The finding suggests the challenge may currently lie as much with platform compliance as with technology performance.

The UK is taking a similar approach as it implements the Online Safety Act.

Several Asian approaches

Asia provides something of a microcosm of the range of policy options governments are considering to reduce children’s exposure to regulated platforms. A series of new regulations and proposals apply age assurance to restricting social media in different ways.

Social media restrictions can be broadly divided into three categories, with some overlap; hard access restrictions like in the Philippines, mandatory age assurance without bans like Vietnam, and verification integrated with a broader digital identity ecosystem like Malaysia and India.

National IDs

Multiple states and territories in India announced age restrictions for social media earlier this year, and similar policies are being discussed at the national level. Tech Times notes that both approaches proposed in the Draft Data Protection Rules of 2025 involve the use of government-issued IDs. A roundtable hosted in May by MediaNama concluded that all age assurance in the country “in practice, becomes Aadhaar verification, which carries significant privacy costs.”

Identity cards are the credentials used in China’s anti internet-addiction regulations. But as South China Morning Post reports, there are limits to the effectiveness of this approach. A father living in central China has sued gaming platforms for failing to implement the system with adequate identity assurance, after his son skirted the regulations using his adult sister’s ID. The father argues that platforms could easily use tools like facial recognition to prevent the kind of simplistic spoof his son used.

JazzCash Head of Legal Affairs Zainab Samantash argues in an opinion piece for Tech Policy Press that the approach Pakistan takes to restricting bank account ownership based on age shows the one it should take to restricting social media access. That approach is based on biometric verification of the user’s national digital identity, NADRA.

The comparison is contested because Australia’s early experience has primarily highlighted platform compliance challenges rather than widespread circumvention.

User-controlled ZKPs

The EU’s approach is to support online age restrictions set at the country level with its age verification app within the EU Digital Identity (EUDI) Wallet ecosystem. This approach is intended to make age verification “privacy-preserving” through zero-knowledge proofs (ZKPs) and user control.

But the bloc is facing awkward questions about the implications of hardware-bound attestation, which is a project requirement, and some observers say will push EU citizens to use Android devices, rather than other operating systems like GrapheneOS that can provide the attestation, but cannot be validated by systems like Google Play Integrity. Scytales, which is developing the white-label app, has responded to the concerns with reassurance that other methods of ensuring integrity will be available.

Neowin reports a dedicated security review addressing the topic is coming soon.

Further, cybersecurity researcher Paul Moore tells TechRadar that because the system relies on client-side trust, the data presented cannot be verified or trusted.

The concerns could yet threaten the EU’s plans for a unified approach to age assurance.

Litigation, lobbying and patchwork rules

Across the U.S., courthouses are scheduling hearings about whether age assurance rules violate the Constitution’s free speech protection.

A letter (via Politico) from Pornhub to hundreds of state lawmakers takes a different approach, arguing for device-based age verification. The argument, already familiar from Pornhub parent Aylo, is that imposing consequences on regulated platforms drives traffic to other, non-compliant platforms, rendering the regulations ineffective.

In keeping with that approach, a bipartisan proposal at the federal level would place age assurance at the operating system level, requiring operating systems to provide reusable age signals to apps and covered websites. Rather than relying on individual platforms to verify users independently, the bill would create a standardized age signal shared across online services.

Previous attempts by Pornhub to convince legislators not to impose platform-level age checks included completely blocking access on a country-by-country or state-by-state basis and filing lawsuits.

The latest example of the trend towards divergence in America is Illinois’ social media restrictions, which is based on age-appropriate design considerations. Under the Children’s Social Media Safety Act (HB5511), signed into law by Governor JB Pritzker on Friday, parents set their child’s age during device set-up, triggering restrictions on nighttime notifications and who can interact with their accounts.

The myriad approaches governments and regulators are taking raises the question of whether they are diverging because of different national priorities or a lack of consensus about what works.

The divergence reflects more than different political preferences. Governments are attempting to solve the same problem with fundamentally different assumptions about trust. Some rely on governments to establish identity, others on private age assurance providers, digital wallets or operating systems. Which approach proves most effective may ultimately depend less on technology than on implementation, privacy protections and public acceptance.

Article Topics

age verification  |  Asia age assurance  |  Australia age verification  |  biometric age estimation  |  EU age verification  |  India age verification  |  Texas age verification  |  United States