It has become increasingly common for governments around the world to tighten online age verification requirements, as well as to incorporate a new approach to digital identity verification, which keeps facial data on the user's device rather than sending it to an external server. 

In addition to the United Kingdom, Australia, Brazil, and several US states introducing stricter rules to protect minors online, more than 30 age assurance laws are now in effect worldwide. There has been a growing concern about the gathering and storage of biometric information as platforms race to comply with regulations. 

Major technology companies have also explored alternative means of verifying the age of users in order to protect privacy. As opposed to requiring users to upload government-issued identification or selfies, newer systems are increasingly designed to collect only the essential information such as confirming that a user is part of a particular age group helping platforms comply with legal requirements while limiting the amount of personal information they collect. 

A facial age estimation system traditionally captures a user's face, uploads the image to a cloud server, and is then processed remotely. This model has been effective, however it raises significant privacy and cybersecurity concerns, particularly as biometrics become increasingly valuable targets for cybercriminals. 

As reported by the Identity Theft Resource Center's 2025 Annual Data Breach Report, 3,322 data breaches were reported in the United States in 2025, an increase of 79% compared to the previous five years. There was also a significant concern among consumers regarding how their biometric data is collected and utilized by 63% of respondents.

Identity verification company Incode has launched an on-device age estimation system to address these concerns. Under this approach, facial images are not sent to remote servers or stored after verification, but are only processed on smartphone, tablet, or laptop devices. Only the verification result-that is, whether the user complies with the required age threshold-is shared with the requesting platform. These approaches follow the principle of data minimization, where systems only collect the information necessary to carry out a specific task. 

A developer can offer age-appropriate services while limiting the exposure of sensitive personal data by confirming the eligibility of users instead of storing facial images or identity documents. Additionally, the system incorporates passive liveness detection in order to verify the presence of a real person, which prevents fraud associated with photographs, replayed videos, or artificial intelligence-generated deepfakes. 

If the age check cannot be completed successfully, users are automatically offered an alternative verification method. While facial data remains on the user's device, limited session metadata, such as device and connection characteristics, is analyzed on the server to detect tampering, injected camera feeds, and other sophisticated fraud attempts.

The company states that this information does not include biometric data and is used solely to maintain session integrity. It is nonetheless important to note that, despite these improvements, there is no foolproof age verification system. Determined users may attempt to overcome restrictions, but developers must adhere to applicable privacy regulations and implement verification technologies correctly. Generally speaking, it remains difficult to strike a balance between safeguarding children online, maintaining user privacy, and preventing unauthorized access. 

AI-powered identity fraud has become a growing concern, resulting in the shift. Incode reports that in 2024, AI-aided fraud represented only 3% of fraud attempts, but by 2026, it had increased to 40%. The company believes that figure will exceed 90% in the next 18 months. 

Besides launching its on-device authentication technology, Incode recently announced an investment of $100 million in privacy-protecting identity infrastructure and the acquisition of Identiq, a company focused on privacy.  As a result of this initiative, fraud prevention is enhanced while sensitive user information is reduced through the elimination of the need for central collection or storage. 

There is continued debate among policymakers worldwide about the operation of age assurance systems, with privacy advocates arguing that online platforms should collect as little personal information as possible. It is a reflection of an industry-wide initiative to comply with evolving regulations while reducing the risks associated with storing biometric information by switching to on-device processing and limited data sharing. 

The adoption of digital age verification has become a legal requirement across a growing number of jurisdictions. Privacy-first technologies that minimize the exposure of biometric data may increasingly influence compliance standards in the future.

Governments are increasing age verification requirements, and privacy-preserving technologies are transforming the verification of digital identity. A pivotal role in the future of online safety will be played by solutions that minimize the collection of biometric information while maintaining security and regulatory compliance.