Age Verification Laws Leave a Trail of Biometric Data – Is It Necessary?
The world is witnessing a wave of laws requiring online platforms to verify users’ ages, with over 30 countries enforcing some form of age assurance. While this may seem like a step towards protecting minors from online exploitation, it raises significant concerns about data privacy and security. One of the most popular methods for age verification is facial age estimation, but its implementation has been shrouded in controversy.
Incode Technologies, a leading provider of AI-powered identity verification solutions, has shed light on the limitations of server-based age estimation methods. These systems capture users’ faces, send them to servers for analysis, and then transmit the results back to the user’s device. However, this approach leaves sensitive biometric data vulnerable to interception, storage, and potential breaches. The Identity Theft Resource Center’s 2025 Annual Data Breach Report highlights the alarming rise of data compromises in the US, with a record high of 3,322 incidents last year.
Moreover, consumers are increasingly wary of biometric data collection, with 63% expressing serious concerns. As facial age estimation becomes more prevalent, agentic fraud – a type of cyberattack carried out with AI agents’ assistance – is on the rise. Incode estimates that by next year, over 90% of all agentic fraud attempts will be made using these sophisticated tools.
In an effort to address these issues, Incode has developed On-Device Age Estimation, a solution that runs facial age estimation models directly on users’ devices without sending their faces to servers. This innovation ensures that sensitive biometric data remains on the user’s device, protected from interception and storage. By adopting this approach, platforms can meet age assurance requirements while prioritizing users’ privacy.
The industry’s traditional reliance on written policies, promising to handle biometric data with care, is no longer sufficient. These policies are essentially legal documents that assign responsibility in case of a breach but do not prevent one from occurring. In contrast, Incode’s On-Device Age Estimation model is built with architecture-driven privacy in mind, ensuring that sensitive data never becomes accessible.
In a significant development, Incode Technologies has announced a $100 million commitment to advancing privacy-preserving identity infrastructure. This investment will be directed towards on-device processing capabilities, continued R&D in privacy-enhancing technologies, and expanded engineering resources and global footprint. The company’s acquisition of Identiq, a specialist in peer-to-peer anti-fraud collaboration using cryptographic solutions, further underscores its dedication to prioritizing users’ data security.
As the world grapples with the complexities of age verification laws, it is crucial for online platforms to adopt more secure and privacy-centric approaches. Incode’s On-Device Age Estimation model serves as a beacon of hope in this regard, demonstrating that sensitive biometric data does not need to be transmitted or stored to ensure accurate age estimation. As users become increasingly aware of the risks associated with biometric data collection, it is imperative for companies like Incode to lead by example and prioritize architecture-driven privacy over promises of handling data with care.
For online platforms seeking to comply with age assurance laws while protecting their users’ sensitive information, On-Device Age Estimation offers a compelling solution. By adopting this approach, they can ensure that biometric data remains on the user’s device, protected from interception and storage. As we navigate the complexities of online security and data privacy, Incode’s innovation serves as a reminder that architecture-driven solutions are often more effective than relying solely on promises of handling sensitive data with care.
Source: Bleeping Computer — 2026-07-18