A technology think tank has raised “deep concerns” with government proposals to mandate strong age verification to access online services, as ministers consider imminent restrictions on children’s access to social media in the UK.
The Foundation for Information Policy Research (FIPR) warned that many of the proposed solutions for age verification will exacerbate the harms they are trying to prevent, and could expose children to risks of blackmail and abuse.
The warning follows comments from technology secretary Liz Kendall that “drastic” action was needed to protect young people from social media, with nine out of 10 parents saying they are in favour of a ban in response to a government consultation.
FIPR said in evidence to the Department of Science, Innovation and Technology that mandatory age verification does not address harmful content on social media and could lead to many adults in the UK being excluded from digital services.
“While it is tempting to rely on ‘magic’ technological fixes for online harm, these will not work, will concentrate even more power in the hands of large tech platforms, and will risk letting them off the hook for the wider social harms to which they contribute,” said Ben Collier, FIPR chair and senior lecturer at the University of Edinburgh.
Sweeping powers
The Children’s Wellbeing and Schools Act 2026, which received Royal Assent on 29 April, grants “sweeping powers” to the Secretary of State to regulate high-risk technology without the need for parliamentary scrutiny, and little protection for privacy, freedom of expression or security breaches, according to FIPR’s submission to the government.
The think tank said it is particularly concerned that proposed age-based restrictions referenced in the government’s consultation paper, Growing up in the online world, would not meaningfully reduce harm to children, and could in fact cause children additional harms.
“Many of the proposed implementations of age restriction have limited positive effects in reducing harm to children, while causing significant additional harms, especially to the most vulnerable adults,” FIPR stated.
The think tank points out that many of the more technically focused approaches to age verification do not effectively mitigate children’s exposure to harmful content, “addictive” app design, and risks to children’s privacy and security of their data, and could increase children’s exposure to them.
For age verification to be effective, both children and adults may be required to prove their age to use online services, for example, by providing biometric information, credit cards or government-issued identification to verification services or online sites.
Risk of misuse of verification data
This poses security and privacy risks for both adults and children, and requires users to trust the verification service will store their data securely and will not misuse or profit from the data provided, as Facebook did in 2018 when it came under fire for reusing phone numbers provided for account verification for advertising purposes.
Technology that detects the age of people from their face is trained on data from an average population, and tends to perform poorly with minority, ethnic, disabled, LGBT and other “structurally disadvantaged groups” at risk of being excluded from social media and other internet sites, and could be further marginalised.
Such systems risk normalising repeated age checking across the internet, making it easier for hostile actors or criminals to use age verification to steal biometric data or credit card information.
There is also a danger that sites wishing to comply with the law will implement strong age verification, which will lead to motivated under-age users moving to openly accessible sites that feature more harmful content than “compliant sites”, or use riskier strategies such as borrowing accredited devices to access age-gated sites.
Another approach at the early stages of development continuously monitors online behaviour, typing patterns, location and other data, to assess the age or vulnerability of the users. However, as they infer age, rather than verify it, they would not be considered sufficient under the current UK policies.
Tagging and blocking
FIPR proposes an approach known as tagging and blocking, where providers of internet sites tag their pages with the kind of content they host and the audience considered appropriate. Parents or children would be able to adjust the settings of their child’s device to block content they consider unsuitable, in a system akin to film classification age ratings.
The think tank warns that no age verification system, however technically secure, can prevent a motivated user from bypassing age restrictions.
The Tor Network, which is widely used by journalists, whistleblowers, NGOs, security researchers and dissidents in repressive countries to protect their privacy and security, makes blocking or age-gating virtual private networks (VPNs) a pointless and harmful exercise, FIPR argued.
Children have also found ways to trick age detection software, including the use of filters to change their appearance or tools from online games to create realistic moving facial images that can fool age verification systems.
Children may also buy credentials to access age-gated services, which are sold on online platforms listed by Google, or buy verified social media accounts which are available for as little as $0.80 for Facebook or Instagram accounts.
Research on cyber crime forums shows a “lively trade” in fake and stolen ID documents, credit cards, credentials and verified accounts. Credentials for adult websites are also sold on publicly accessible forums.
Online verification is not like showing ID in shops
FIPR argues that the Children’s Wellbeing and Schools Act wrongly assumes online age verification will replicate offline age restrictions, such as presenting ID for buying alcohol. However, the comparison is flawed because showing ID in a shop does not create a data trail of every communication and location visited.
“We are concerned that age restrictions create a barrier with which every user will have to comply before they can participate in online life or communicate with others,” FIPR said. “In other words, individuals are being asked to give up their data merely in order to speak.”
The restrictions raise questions about the compliance of the Online Safety Act, used to regulate big tech companies, with rights to freedom of expression.
Most critically, age-checking technologies do not tackle parents’ underlying concerns about the viral dissemination of toxic and harmful content. That problem will remain unless it is tackled by the government and the regulator, Ofcom.
“Our concern is that these measures will entail AI [artificial intelligence]-driven content moderation, which pose additional risks to freedom of expression and privacy rights,” the think tank said.
UK bans could follow ‘in months’
Prime minister Keir Starmer announced plans, in a post on Substack, in February to implement a minimum age for social media “in a matter of months”, restrict addictive features such as endless scrolling and autoplay, and limit children’s access to VPNs.
The move followed announcements by a growing list of countries of their intention to introduce social media bans in the wake of Australia’s ban in December 2025. Germany, Spain and France are among those introducing such restrictions.
FIPR’s submission contained contributions from Alice Hutchings; professor at the University of Cambridge, Steven Murdoch; professor of security engineering at UCL; public policy analyst Monica Horten; science writer Wendy Grossman; and other academics and security experts.
