The Electronic Frontier Foundation outlines the privacy risks associated with mandatory age verification systems now required for online platforms and services operating within the United Kingdom as of 2025.

Key Points

• UK law now mandates that platforms hosting content deemed harmful must verify that all users are at least 18 years old.
• Common verification methods include facial age estimation, photo-ID matching, open banking, email analysis, and mobile operator checks.
• Third-party providers like Yoti, Persona, and Incode often process sensitive user data, raising concerns regarding data retention and potential security breaches.
• Privacy risks include the exposure of personal identity, location data, or sensitive information that could lead to harassment or discrimination.
• The EFF advises users to investigate specific provider policies, such as whether data is processed on-device or stored on external servers.

Why it Matters

Mandatory age verification creates significant privacy vulnerabilities by requiring users to share sensitive personal information with third-party services. These requirements pose particular risks to marginalized groups, as data leaks or improper retention could expose private identities to bad actors or government surveillance.