Governments Push Age Gates Online. Can They Actually Build Them?

When the European Commission unveiled its planned age-verification app on 16 April 2026, the announcement arrived with the polished confidence of a solved problem. Download a piece of software, confirm you are over 13 or 16 depending on the jurisdiction, and the digital world opens safely. The reality, even as the press releases landed, was considerably messier.

The same week, Australian authorities indicated they were preparing to use existing powers under the Online Safety Act to compel platforms to take steps toward genuine age assurance — not just self-declaration — for users under 16. Meanwhile, world leaders participating in a video summit on the sidelines of a multilateral forum debated coordinated approaches to the same problem. The gap between the political will to act and the technical means to do so has rarely been wider.

A patchwork of legal obligations

Governments racing to regulate children's access to digital platforms have spent the past several years legislating intent. The results vary enormously in specificity. Australia's Online Safety Act, amended in 2024 and currently under active enforcement review, gives the eSafety Commissioner authority to issue industry standards that platforms must follow. Those standards are expected to require something more rigorous than a checkbox confirming a user's date of birth — what the regulator calls "age assurance" rather than simple "age verification."

The distinction matters. Age verification asks a user to self-certify; age assurance requires some form of external corroboration — a government document, a biometric signal, a device-level confirmation. The stricter standard closes obvious loopholes but introduces a different set of problems. Age assurance systems must collect, store, and verify personal data. That collection itself is a privacy risk that scales with the sensitivity of the data involved.

Europe's approach under the Digital Services Act framework has proceeded differently. Rather than mandating a single technical solution, the Commission's proposed app would offer a voluntary tool — a piece of software that platforms could integrate, and that users could choose to employ as an alternative to handing over documents directly to a private company. Whether that voluntary model survives contact with platforms that have strong commercial incentives to avoid friction — or with privacy advocates who see any centralized identity repository as a honeypot — remains an open question.

The technology nobody trusts

The technical literature on age verification is, to put it charitably, contested. The most mature solutions fall into a few categories. Document-based verification — presenting a passport or driver's licence to a system — is the gold standard for identity confirmation but requires uploading sensitive identity documents to platforms or their contractors. Biometric estimation — inferring age from facial geometry — is improving but carries documented accuracy gaps that tend to disadvantage women, people of colour, and younger users. Device-level assurance, where a phone or tablet confirms the user's age cohort to the app, shifts the problem to the parent who sets up the device and offers no safeguard against a teenager simply picking up an adult's phone.

None of these approaches solves the problem of coercion. A 15-year-old who wants to access a platform and lacks a compliant age assurance credential has every incentive to find a workaround. Older siblings, parents willing to help, and a thriving informal market for identity documents make enforcement at scale extraordinarily difficult. The platforms know this. Their lobbyists have been saying so quietly for years; the legislative record in multiple jurisdictions contains the acknowledgment buried in recitals and impact assessments even where the final text suggests otherwise.

The privacy cost of protection

The deeper tension is philosophical as much as technical. Children's rights advocates have spent decades arguing that minors deserve the same privacy protections as adults — and that any system requiring the mass collection of biometric or identity data from young users creates a surveillance infrastructure that, once built, will be difficult to contain. Privacy regulators in Ireland, France, and Germany have all flagged concerns that mandatory age assurance systems could exceed what proportionality analysis under GDPR would permit.

The Online Safety Act regime in Australia has navigated this differently, largely by keeping the standards technology-neutral. Rather than specifying a particular method, the eSafety Commissioner can require platforms to demonstrate that their chosen approach achieves the intended outcome — age assurance — without mandating how. That flexibility is genuinely useful. It is also a mechanism that pushes the hardest questions — which data, stored where, accessible to whom — down the line and into negotiations between regulators and regulated entities that are not subject to the same public scrutiny as primary legislation.

What happens next

The countries that have moved most aggressively on this problem — Australia, the United Kingdom, a handful of EU member states — share a common dilemma. They have concluded that self-regulation by platforms has failed and that legislative intervention is justified. But the intervention they are now building runs directly into two objections that have not been resolved anywhere in the world: that the technical means to achieve the stated goal do not exist at scale without creating privacy risks that may outweigh the benefit, and that the underlying platforms have structural incentives to avoid enforcement regardless of what the law says.

There is a plausible world in which these initiatives collectively shift the burden enough to matter. Platforms that cannot convincingly claim they have made reasonable efforts at age assurance become legally exposed in ways they are not today. That shift in liability — not any single technical solution — may be what finally changes behaviour. It is not the age-verification app or the industry standard that changes the internet for teenagers. It is the prospect of facing a regulator who can demonstrate in court that the platform knew children were on its service and did nothing proportionate about it.

Whether that incremental shift constitutes adequate protection, or whether it amounts to policy theatre that inconveniences law-abiding users while leaving determined bypassers unaffected, is a question the current crop of legislative responses has not answered. The debate is live precisely because both answers are defensible.

This publication covered the same story from the legislative obligation side — what the law requires — rather than the parental rights framing that dominated some wire coverage.