Funding, September 2026: CypherpunkGuide uses no surveillance advertising, ad networks, tracking pixels or sponsored articles. Some articles contain disclosed affiliate links that may earn a commission. This article has none.
Correction, September 30, 2026: The earlier version treated facial age estimation as identity recognition, described a permanent identity-and-browsing database as inevitable, and promised that decentralized services avoid age gates. It also mischaracterized Discord’s 2025 customer-support incident as a routine age-verification vendor breach. Those claims are corrected below. The legal examples are limited to the cited rules; this is not a worldwide survey or a test of every deployed age-check system.
A page asks you to prove that you are old enough to continue. One option wants an identity document. Another estimates your age from a selfie. A third accepts a credential saying that you meet the required threshold. Those choices should not be treated as interchangeable simply because the screen calls all of them an age check.
Privacy depends on the actual data flow. A service may need an age result without needing your name. An issuer may know who you are without learning which sites receive your proof. Conversely, a small disclosure at the final step can coexist with intrusive collection earlier. The useful question is what each party learns and keeps.
Estimating age is different from identifying a person#
Facial age estimation can estimate an age without identifying a named person; matching a face to an identity document serves a different purpose. Both can involve sensitive images. Neither “selfie” nor “verification” tells you who processes the image or what remains afterward.
Ofcom, the UK’s online-safety regulator, lists facial age estimation and photo-ID matching separately. The former estimates age from an image; the latter checks whether a document belongs to the person presenting it. Its list also includes methods using a bank, mobile provider or digital identity service. An existing relationship with one of those providers is not the same as handing your identity document to every website.
The UK’s data-protection regulator, the Information Commissioner’s Office (ICO), examined a specific example in its 2022 Yoti sandbox report. Sections 3.15 and 4.4 describe age estimation that was not designed to identify a unique individual. That is evidence against “a face scan always establishes who you are,” not approval of every facial-estimation product or deployment.
Accuracy, access and privacy are separate questions. A method can collect little identifying information yet misclassify a user. An appeal may then request more data than the initial check. Read the alternative and appeal routes as well as the first screen.
The duty depends on the service and jurisdiction#
The cited UK, Australian and Texas rules do not create one universal requirement for every adult to upload an ID. Their scope and permitted methods differ. The examples below were checked for this September 2026 revision; they are not a complete statement of local law.
| Example | Relevant scope | What should not be inferred |
|---|---|---|
| UK | Ofcom explains strong age checks for access to pornography from July 25, 2025, and requirements concerning other harmful content | Every online service must obtain every user’s government ID |
| Australia | The social-media minimum-age obligation concerns under-16 accounts on covered platforms | Every Australian user must undergo an individual ID check |
| Texas | In June 2025, the US Supreme Court upheld the challenged age-verification requirement of HB 1181 for covered commercial adult-content sites | Every US age-check law is valid, or all constitutional challenges have ended |
Australia’s eSafety guidance says platforms need not age-verify every user. It requires reasonable alternatives to government ID or accredited digital ID services and does not expect platforms to retain personal information from individual age checks. These are regulatory requirements and expectations, not proof that every platform follows them.
The Supreme Court’s Free Speech Coalition v. Paxton judgment concerns the Texas requirement before the Court. It does not turn different statutes, services or implementation details into one settled rule. Check the service’s explanation and the relevant regulator before treating a method as compulsory or exempt.
Separate collection, issuance, presentation and retention#
An age credential can limit what a website learns without eliminating every privacy risk in the surrounding system. Assess collection, issuance, presentation, links between uses and retention separately. An identity check during issuance does not logically require the issuer to learn each later destination.
An issuer creates an age credential; a verifier, often the website, checks it. A zero-knowledge proof can establish a required fact without disclosing the underlying information used to prove it. That property does not, by itself, hide a logged-in account, the network connection or records kept outside the proof.
The European Commission’s blueprint describes age proofs intended to reveal no identity information to the receiving service and no later service use to the issuer. Its technical specification separates issuance from presentation and addresses linkability and retention. The documented issuance flows establish identity, but that does not make identity verification an unavoidable property of every possible age-proof scheme.
The privacy properties depend on the actual protocol and implementation, including any fallback used. “Unlinkable” means that separate presentations cannot be recognized as coming from the same user through the relevant protocol data. It is a property to check for the actual mode in use, not a synonym for total anonymity.
Brave’s analysis of zero-knowledge age verification raises questions about issuer power, metadata and surrounding mechanisms. It is a technical critique to examine, not proof that all privacy-preserving designs fail. We reviewed documents, not every national app, device fallback or provider’s logs.
Use five questions to turn these design claims into something you can assess:
- Collection: Does this option request an image, document, account signal or just an age result? Which organization receives the raw input?
- Issuance: What evidence is used to create the credential? Does the issuer retain it, and on what stated basis?
- Presentation: What fields does the website receive? Does a fallback disclose more than the preferred method?
- Linking: Can a repeated identifier, account or transaction record connect uses? Can the issuer observe where a proof is presented?
- Retention: What remains after the decision, including support tickets and appeals? Is there a stated deletion period and a contact for questions?
Missing answers are uncertainty, not evidence of either zero collection or permanent storage. Combining records can still reveal a person, as explained in our guide to AI-assisted identification.
Discord shows why the support route matters#
Discord reported a 2025 incident involving a third-party customer-support system and ID images used for age-related appeals. It does not show that every age check creates a central browsing-history database or that a particular age-verification law caused the intrusion.
In its October 9, 2025 update, Discord said approximately 70,000 users may have had government-ID photos exposed. The images were used to review age-related appeals. Discord also said the incident did not expose messages or activity beyond what users had discussed with support. These are the company’s reported findings, not our independent count of confirmed leaked images or a finding about which provider’s systems were compromised.
The practical lesson is to include exceptions and appeals in a privacy assessment. A service can offer a limited-disclosure initial check while a later dispute creates a document-bearing support ticket. Ask how that path is handled before assuming that the first screen describes the whole process.
Exposed identity information may remain sensitive long after an incident. Deleting an original record cannot guarantee deletion of copies already taken, a distinction covered in our article on persistent online records. That supports minimizing unnecessary retention. It does not establish that every record will leak or be held forever. If you receive an incident notice, consult the genuine service and the relevant document issuer’s guidance; our government-data-breach guide explains why the affected data matters.
Match the option to the data you want to limit#
Different options limit different disclosures; none deserves a universal safety ranking. A network tool, a facial estimate and an age credential solve different parts of the problem. Our age-check decision worksheet records the conditions, residual risks and sources behind this comparison. It is an editorial framework, not a performance benchmark or a certification of any provider.
| Option | Potential benefit | Remaining limit and question |
|---|---|---|
| Facial age estimation | Can avoid providing a named identity document | Images are still processed; check the recipient, storage and appeal route |
| Photo-ID matching | May be an accepted route where documents are requested | Reveals document information to its recipient; ask which party stores the image and for how long |
| Age credential or zero-knowledge presentation | Can disclose an age result without identity fields at the website | Check issuance, repeat identifiers, account links and the actual fallback mode |
| VPN or Tor | Can reduce particular network disclosures and change the IP seen by a site | Does not cancel an uploaded document, a login or a service’s age requirement; access is not guaranteed |
| Service with no account, or decentralized architecture | May reduce some account collection or central dependencies | The operator can still apply checks; inspect the actual service and jurisdiction |
| Declining an optional submission or choosing a less intrusive accepted route | Avoids that new submission | Access may be limited; it does not erase information already held |
A VPN sends traffic through a provider; Tor Browser sends it through relays. Neither changes the content you voluntarily submit to a website. Tor also does not replace end-to-end transport encryption: the Tor Project’s explanation distinguishes encrypted connections from plaintext that an exit relay can read. An account login can identify you even when your original IP is hidden from the destination. These are privacy limits, not promises that a tool bypasses a site’s controls.
Decentralization is equally easy to overstate. Bluesky’s July 2025 announcement introduced age assurance and restrictions for unverified UK users. A decentralized protocol does not remove the responsibilities or choices of the company running a service. No-account access likewise does not establish a legal exemption or guarantee that no record is made.
Choose a route you can evaluate safely#
Prefer the least intrusive accepted option that meets your needs, while checking the whole route, including appeals. If a check fails, look for the service’s documented review process before sending additional documents to a different channel. A promise of anonymity deserves evidence about both the proof and the surrounding records.
For someone whose device or account is monitored by a controlling partner or family member, the local record of using a service can matter even if the age proof itself reveals little. Consider who can see that device, account and notifications. If you face immediate danger, prioritize safety and support you can contact safely; completing a privacy assessment or collecting evidence must not delay help.
For builders and advocates, useful demands are specific: collect only what the decision needs, separate issuance from use where the design allows it, avoid reusable tracking identifiers, explain fallbacks, limit retention and offer accessible appeals with equivalent privacy safeguards. An open protocol or a short privacy notice cannot establish those properties alone. The cypherpunk principle is selective disclosure made real in the mechanism, with claims that can be checked.
Frequently Asked Questions#
Does an age check have to identify me?#
No. Facial age estimation can estimate age without identifying a named individual, while photo-ID matching checks a document against its holder. An age credential may reveal only that a threshold is met to the receiving site. The actual collection, processing and retention still need to be checked for the chosen service.
Can a VPN or Tor make an ID upload anonymous?#
They do not remove identifying information from a document you send or prevent the receiving service from linking it to your account. They change aspects of the network connection. Sites can apply additional checks or restrict access, and neither tool guarantees that a particular age requirement will disappear.
Does a zero-knowledge proof eliminate all tracking?#
No. It can limit the information disclosed by the proof, but a surrounding account, repeated identifier, network record or different fallback mode can affect privacy. Separate what the issuer learns during issuance from what the site learns during presentation. An issuance identity check does not by itself mean the issuer learns every destination.
Did Discord confirm that 70,000 routine age-check records leaked?#
That is not what the cited announcement says. Discord reported that approximately 70,000 users may have had government-ID photos exposed in a third-party customer-support incident. Those images were used for age-related appeals. The announcement does not establish that every routine age check was affected or that all of those photos were confirmed leaked.
Are decentralized or no-account services exempt from age checks?#
Not automatically. Requirements and implementation depend on the operator, service and jurisdiction. Bluesky’s UK age-assurance announcement is one counterexample to a blanket decentralized-service exemption. Check what the service you actually use requires, rather than relying on its architecture label.
