New research presented at the IEEE Symposium on Security and Privacy in San Francisco shows that widely used online age-verification systems can disclose highly sensitive personal data to numerous third and even fourth parties. The team examined Yoti, a London-based age-verification company used by an estimated large share of sites that require age checks; its client list includes Meta, OnlyFans, Sony PlayStation and TikTok.
According to the researchers, sites that outsource verification frequently transmit a range of identifying information in one attempt — for example a user’s facial image, IP address and device fingerprint. The paper names recipients such as credit card companies, IP geolocation services and data brokers, which can build detailed user profiles.
Researchers also reviewed law and practice in the United States. Laws in 25 US states, affecting more than 40% of Americans, require digital age checks to restrict access to social media and adult content, yet most covered sites do not appear to enforce verification. Assistant Professor Michael A. Specter warned that promised privacy protections are not matching reality, and other experts said the policies could fragment access to the web and affect users beyond state borders.
Difficult words
- age-verification system — online method to check a user's ageage-verification systems
- disclose — reveal information to other people or groups
- outsource — hire another organization to do work
- device fingerprint — unique device data used to identify hardware
- data broker — company that collects and sells personal datadata brokers
- enforce — make sure a rule or law is followed
- fragment — break into smaller parts or limit access
Tip: hover, focus or tap highlighted words in the article to see quick definitions while you read or listen.
Discussion questions
- How might sharing facial images and device fingerprints with many third parties affect user privacy and trust?
- What are possible consequences if states require digital age checks but most sites do not enforce them?
- Should major platforms stop outsourcing age verification to outside companies? Why or why not?
Related articles
Financial worries disrupt sleep in National Guard members
A study of full-time Army and Air National Guard members found that financial stress leads to tense bedtime habits and poorer sleep. Researchers measured stress, bedtime behaviours, and sleep using surveys and wrist actigraphs.
Researchers find 'vibe coding' linked to insecure AI-written code
A research team found that a programming style called "vibe coding" is producing insecure code with help from generative AI tools. A new radar scans public vulnerability data and flags cases that show AI signatures or risky patterns.
Instagram bot campaigns target activists and media in Western Balkans
In November 2025 coordinated bot operations hit activist and media Instagram accounts in the Western Balkans. Reports on November 16 and 23, 2025 describe fake followers, mass reports, bot comments and mass liking that reduced visibility.
Study finds flaws in cloud password managers
Researchers at ETH Zurich tested three cloud-based password managers and found multiple attacks that could expose or change users' passwords. They followed responsible disclosure, gave companies time to fix the issues, and recommended stronger encryption and audits.