Australia banned under-16s from social media in December; the U.K. is now investigating whether TikTok’s age checks even work; and France just finalized its own under-15 ban this week, racing to beat the August recess. Platforms are grappling with how to handle the “age verification trap,” how do you collect information about a user online without infringing on their privacy and being too intrusive. And while these bans are taking place abroad, some states in the country are toying with similar measures, or fully banning users from specific sites if the platforms can’t verify their age accurately.
David Inserra, a fellow for free expression and technology at the Cato Institute who also sits on TikTok’s US Content Advisory Council, told Fortune that each of these laws gets sold as a narrow fix for kids, and each one ends up asking something much bigger of everyone else.
“It’s not just about verifying the age of kids,” Inserra said. “To verify the age of kids, you have to verify the age of everyone, and that means everyone’s ID.” A platform can’t apply scrutiny only to the accounts that turn out to belong to minors: it has to ask every user to prove their age before it knows who’s who.
That mechanism is what turns a child-safety law into an identity mandate for the entire user base, adults included, Inserra said.
A failed “show your papers” measure in Australia
Six months into its ban, more than 60% of Australian 12- to 15-year-olds who had social media accounts beforehand still have access to at least one platform. “Any of these other mechanisms can be fooled,” Inserra said, describing kids in Australia and abroad who’ve beaten facial-recognition and age-inference checks with small changes, like a ponytail or wearing makeup. One mother even caught her son using an eyebrow pencil to draw on a mustache to look older for a camera scan. “Even the show-your-papers mechanisms can be subjected to fake IDs,” Inserra added, “or better yet, you just have a family account where your parents or some other person just makes an account for you.”
Notably, Australia’s regulator has explicitly barred platforms from demanding government ID even when a user’s age is in doubt. The ban hasn’t delivered the safety outcome it promised, but the country has already drawn a line on how much identifying information it’s willing to force out of everyone to try to get there.
Only a matter of time before the regulatory ‘crackdown’
Ofcom’s July 16 investigation into TikTok is the crackdown Inserra predicted would come. “When these laws, these policies fail to live up to the hype that they promise, because people can get around them… these regulators will crack down,” he said. “It’s what we’re seeing in the UK, and it’s only—it’s starting in Australia. I think it’s only a matter of time before this happened.” Ofcom says TikTok’s age-inference model—the lightest-touch method, guessing age from behavior rather than documents—may have missed a significant share of underage users. The regulator’s message to platforms is to switch to something “highly effective,” a phrase that in practice means something closer to ID or biometric verification.
That escalation is already spreading past the platforms. “That’s why they’re also going after VPNs, or considering going after VPNs, in the UK, because once again that’s a way around the system,” Inserra said. The UK’s House of Lords voted to require VPN providers to run their own age checks and to bar minors from using them at all, after VPN adoption spiked in response to the Online Safety Act. A tool built for privacy and security, used by journalists and remote workers as much as anyone trying to dodge an age gate, becomes another front in an enforcement fight that started with a much narrower target.
A growing tension in France
France finalized its under-15 ban this week after a scramble to reconcile its two legislative chambers before the summer recess, aiming for enforcement by the start of the school year in September. It’s the country’s second attempt: a 2023 law requiring parental consent for under-15 accounts never got European Commission approval and was barely enforced. This time, reporting on the bill has already surfaced the identical choice Inserra describes: an ID scan that’s reliable but easy to lend to a younger sibling and privacy-invasive for everyone required to submit one, or a facial-age estimate that protects privacy but is easy to fool. Coverage of the bill has also flagged the same workaround risk Australia already lived through — under-15s simply switching to newer platforms or using a VPN to get around the check entirely.
Fortune has tracked this same tension building on the industry and legislative side in the US, where social media companies are fighting the “age verification trap” as biometric collection becomes a compliance requirement, and where Congress advanced the Kids Online Safety Act and App Store Accountability Act through committee within 48 hours of each other, over the same privacy objections now surfacing in Paris.
Inserra doesn’t expect the US to land in the same place as the UK or France. Instead, he recalls the Supreme Court precedent protecting anonymous speech as a reason he thinks American courts will resist a law that functions as a national identification requirement to get online.
“To verify the age of kids, you have to verify the age of everyone, and that means everyone’s ID,” he said, which likely won’t fly stateside.
But across Australia, the UK, and France, it may be something regulators inch towards.
