SerpApi.Org
A comprehensive analysis of age assurance technologies co-authored by CISPA faculty member Dr. Wouter Lueks concludes that many currently proposed systems for protecting minors online come with significant trade-offs for privacy, security, accessibility and civil liberties. The study "Assessing Age Assurance Technologies: Effectiveness, Side-Effects, and Acceptance," conducted with colleagues from the University of Hamburg and the Leibniz Institute for Media Research, evaluates a broad range of approaches currently being debated by policymakers and platforms worldwide.
Subscribe to our newsletter for the latest sci-tech news updates.
Age assurance technologies (AATs) have recently attracted significant public attention in the debate around online child protection. "There is a belief in society that we need to protect children from online harms," Lueks explains. "While this debate used to focus mostly on age-restricted content such as gambling and pornography, it has expanded to include a broader range of services, including social media services and other forms of potentially harmful content."
Against this backdrop, Lueks and his colleagues analyzed different technological architectures and regulatory approaches emerging across Europe, the United Kingdom and other jurisdictions. While some of the analyzed approaches can provide a high level of security, the study finds that stronger forms of verification often come with greater societal costs.
Differentiating AAT approaches
In the paper, the authors distinguish four different approaches to age assurance: parental control and consent on devices, age estimation, age inference and age verification. In the first approach, parents configure a child's device to block or approve access to specific apps or websites.
Lueks explains that "age inference uses systems to analyze behavioral patterns, possibly over time, to infer a user's age." In contrast, "age estimation uses systems to analyze a selfie or other information to estimate someone's age." Age verification, meanwhile, relies on official documents or trusted sources to determine a user's age.
The researchers find that these approaches differ significantly not only in how reliably they can determine a user's age but also in their implications for privacy, security, accessibility and fundamental rights.
Unintended consequences and harmful side effects
The findings suggest that stronger age-assurance measures often come with broader societal burdens. Depending on the approach, these may include the collection and storage of sensitive personal or biometric data, increased tracking and profiling of users, the exclusion of people without suitable identity documents and biased or inaccurate assessments.
Age inference systems in particular, which analyze online behavior to determine a user's age, risk normalizing large-scale surveillance while providing only limited assurance. Moreover, with the exception of parental control and consent, none of these approaches effectively prevents circumvention through the use of VPNs.
As a result, no single solution emerges as universally preferable across all use cases. A broader concern is the potential for censorship. "Right now, the stated goal is to protect children from harmful content, such as social media," Lueks explains. "Tomorrow, the same systems could be used to restrict access to online games, LGBT content, political material or books."
Lighter-weight solutions to prevent harm for everyone
Based on their assessment, Lueks and his colleagues urge policymakers to carefully distinguish between age assurance systems rather than treating them as equally acceptable or equally effective. Instead, they propose a graduated assessment framework that weighs effectiveness against societal side effects and impacts on fundamental rights.
"Because these systems affect everyone and are relatively easy to circumvent, we argue for lighter-weight solutions," Lueks says. "Our first preference is parental control and consent on devices." This may not be perfect, but it has fewer negative externalities because it does not affect everyone universally.
"A second possibility is privacy-preserving on-device age verification as a second line of defense," he continues. "Our third preference is credential-based wallet solutions with strong privacy guarantees."
Lueks emphasizes that his goal is not to reject child protection measures in general: "Protecting minors online is essential. But measures must be proportionate, privacy-preserving and realistically deployable at scale without creating new harms to the whole population."
The authors stress that technical measures alone are unlikely to fully solve the underlying societal challenges surrounding minors' online experiences. According to the researchers, effective child protection will require a broader combination of technological safeguards, platform responsibility, parental support, education and public policy. The paper enriches the debate by providing a fundamental analysis of the advantages and disadvantages of current technological solutions.
More information: Wouter Lueks et al, Assessing Age Assurance Technologies: Effectiveness, Side-Effects, and Acceptance, arXiv (2026). DOI: 10.48550/arxiv.2603.25695
Provided by Helmholtz Association of German Research Centres
This story was originally published on Tech Xplore.
