AI Could Make Age Verification More Accurate and Less Invasive
With progress on comprehensive federal privacy legislation temporarily stalled, Congress and several states have been considering more targeted privacy and safety legislation designed to protect children and teenagers online. Many of these bills include controversial provisions requiring social media and other online services to verify the ages of all their users so they can provide additional protections or even deny access to minors. To avoid infringing on privacy and free speech online with these provisions, lawmakers should hit pause on these proposals and instead make necessary investments into artificial intelligence (AI) tools for age estimation and electronic identification.
Many age verification requirements would force online services to collect personal data on their users, such as government-issued identification, that would not only violate users’ privacy but also make it impossible for users to remain anonymous online. Anonymity is crucial for certain vulnerable populations, such as victims of abuse and LGTBQ individuals in unsupportive environments. Requiring users to submit government-issued identification in order to access certain online services would also deny access to the millions of Americans who lack such identification.
There are, however, other methods of verifying—or at least estimating—individuals’ ages. For example, the UK-based tech company Yoti provides age estimation technology to various companies and governmental organizations, including Meta. The technology uses AI to estimate the age of an individual from an image of their face. In order to preserve privacy, Yoti immediately deletes the images after age estimation.
The technology is not perfect, but it is accurate, particularly at providing age ranges. For example, Yoti can accurately estimate 13- to 17-year-olds as under 25 with 99.93 percent accuracy and 6- to 11-year-olds as under 13 with 98.35 percent accuracy, with no discernible bias across gender or skin tone. Determining who is under 25 is important in many retail applications, but less so for online services that want to differentiate between its youngest users. However, here too, the technology is promising. Yoti reports a mean absolute error (i.e., the average error, ignoring whether it is too high or too low) of 1.3 years for children 6-12 years old and 1.3 years for teenagers 13-17 years old.
If online services could use AI to reliably estimate users’ ages without collecting and storing their personal information, they would avoid many of the issues associated with age verification requirements. But for this to happen, a few things would need to change.
First, policymakers would need to not hold social media companies strictly liable if underaged users sign up in violation of their terms of service. Social media services may make a valiant effort to identify and remove these users, but the technology is not perfect, and some children will break the rules, eventually slipping through the safeguards, especially for edge cases. For example, it is difficult to distinguish between a 12-year-old and a 13-year-old, or between a 17-year-old from an 18-year-old. Laws need to be realistic.
Second, policymakers should avoid (and repeal) stringent biometrics laws, such as Illinois’s Biometric Information Privacy Act (BIPA), which can prevent the use of age verification technology. While laws like BIPA are intended to protect user privacy, by limiting the use of age verification technology, they can limit companies from implementing enhanced privacy features for younger users.
Third, Congress should support more research and testing of age verification technology. The National Institute of Standards and Technology (NIST) last conducted an empirical evaluation of age estimation algorithms from five companies and one university in 2014 and found that, using the most accurate algorithm, a 17-year-old had a 29 percent chance of passing as 21 or older. Age estimation technology has improved in recent years, but independent testing is essential, especially to effectively compare different vendors. Congress should direct NIST to conduct an up-to-date evaluation of age estimation algorithms and their accuracy.
Finally, Congress should also make ID-based age verification easier by catching up with countries such as Estonia that offer electronic IDs, which allow people to more easily prove certain aspects of their identity—including their age—online without sharing other aspects of their identity that would remove their ability to remain anonymous.This is a relatively straightforward step. Just as Congress mandated states implement the REAL ID Act for state-issued drivers’ licenses and other forms of identification, it could do the same and require that all state-issued IDs come with a digital identity.
Until lawmakers can ensure age verification requirements would not infringe on user privacy or bar those without government-issued identification from using online services, they should not include such requirements in child privacy and online safety laws and should instead focus on pursuing technologies that will enable easy, secure age verification.
