{"690376":{"#nid":"690376","#data":{"type":"news","title":"Online Age Checks Create a Pointless Privacy Risk","body":[{"value":"\u003Cdiv\u003E\u003Cp\u003EWhen a bartender checks an ID, they quickly verify a customer\u2019s date of birth and identity before serving them.\u0026nbsp;\u003C\/p\u003E\u003C\/div\u003E\u003Cdiv\u003E\u003Cp\u003ECompanies that employ online age verification claim their products function the same way on the web. That bartender analogy has, in part, justified laws passed in twenty-five US states \u2014 comprising more than 40% of Americans \u2014 mandating the use of digital age verification to gate access across social media and adult content online. Further regulation, targeting social media sites, is currently in process in a number of states.\u0026nbsp;\u003C\/p\u003E\u003C\/div\u003E\u003Cdiv\u003E\u003Cp\u003EHowever, \u003Ca href=\u0022https:\/\/mikespecter.com\/assets\/pdf\/AgeVerification.pdf\u0022 rel=\u0022noreferrer noopener\u0022 target=\u0022_blank\u0022\u003Enew research\u003C\/a\u003E from Georgia Institute of Technology (Georgia Tech) and the University of California, Irvine (UC Irvine) reveals that the reality of online age verification is far from ideal.\u0026nbsp;\u0026nbsp;\u003C\/p\u003E\u003C\/div\u003E\u003Cdiv\u003E\u003Cp\u003EThe study found that the vast majority of sites covered by these laws do not appear to enforce age verification at all. When sites \u003Cem\u003Edo \u003C\/em\u003Ecomply, they often route users through third party age verification services.\u0026nbsp;\u003C\/p\u003E\u003C\/div\u003E\u003Cdiv\u003E\u003Cp\u003EThe researchers found that one such third party, Yoti, a London-based company used by Meta, OnlyFans, Sony PlayStation, and TikTok, provides services for an estimated 60% of websites deploying age verification services.\u0026nbsp;\u0026nbsp;\u003C\/p\u003E\u003C\/div\u003E\u003Cdiv\u003E\u003Cp\u003EDepending on the verification method, a verification attempt via Yoti may transmit a user\u2019s IP address and\/or OS and browser metadata sufficient to uniquely identify and track devices. Some of the IP, OS, and browser metadata may be sent to credit card companies and IP geolocation services, while ID information may be sent to a known \u003Ca href=\u0022https:\/\/oag.ca.gov\/data-broker\/registration\/186885\u0022 rel=\u0022noreferrer noopener\u0022 target=\u0022_blank\u0022\u003Edata broker\u003C\/a\u003E, or another verification service.\u0026nbsp;\u003C\/p\u003E\u003C\/div\u003E\u003Cdiv\u003E\u003Cp\u003E\u201cThere have been laws passed and court cases settled on the promise that these companies are incentivized to keep users\u2019 data private,\u201d said Assistant Professor \u003Ca href=\u0022https:\/\/mikespecter.com\/\u0022 rel=\u0022noreferrer noopener\u0022 target=\u0022_blank\u0022\u003E\u003Cstrong\u003EMichael A. Specter\u003C\/strong\u003E\u003C\/a\u003E at Georgia Tech\u2019s School of Cybersecurity and Privacy. \u201cWe found that reality is starkly different.\u201d\u0026nbsp; \u0026nbsp;\u003C\/p\u003E\u003C\/div\u003E\u003Cdiv\u003E\u003Cp\u003EAside from privacy concerns, researchers note that differing state policies could lead to what they call the \u201cBalkanization of the U.S. web.\u201d In other words, users may have access to different parts of the internet depending on the state they are in\u2014potentially limiting the free exchange of ideas and information.\u0026nbsp;\u0026nbsp;\u003C\/p\u003E\u003C\/div\u003E\u003Cdiv\u003E\u003Cp\u003EAccording to Assistant Professor \u003Ca href=\u0022https:\/\/sites.gatech.edu\/hoppenheimer\/\u0022 rel=\u0022noreferrer noopener\u0022 target=\u0022_blank\u0022\u003E\u003Cstrong\u003EHarry Oppenheimer\u003C\/strong\u003E\u003C\/a\u003E of the \u003Ca href=\u0022https:\/\/spp.gatech.edu\/\u0022 rel=\u0022noreferrer noopener\u0022 target=\u0022_blank\u0022\u003EJimmy and Rosalynn Carter School of Public Policy\u003C\/a\u003E, users are already accustomed to experiencing the internet differently across countries. However, this may signal the beginning of similar fragmentation within the United States.\u0026nbsp;\u003C\/p\u003E\u003C\/div\u003E\u003Cdiv\u003E\u003Cp\u003E\u201cWe are going to start seeing comparable differences between U.S. states,\u201d said Oppenheimer. \u201cUsers in some states will now have to go through additional steps to access information. Close your laptop in New York before a flight to Dallas and try to load the same web page\u2014now you see two different results.\u201d\u0026nbsp;\u0026nbsp;\u003C\/p\u003E\u003C\/div\u003E\u003Cdiv\u003E\u003Cp\u003E\u201cWe also observed age verification deployed on websites accessed from New York, which has no law requiring verification,\u201d said Associate Professor \u003Ca href=\u0022https:\/\/pearce.prof\/\u0022 rel=\u0022noreferrer noopener\u0022 target=\u0022_blank\u0022\u003E\u003Cstrong\u003EPaul Pearce\u003C\/strong\u003E\u003C\/a\u003E\u003Cstrong\u003E \u003C\/strong\u003Eof UC Irvine\u2019s \u003Ca href=\u0022https:\/\/cs.ics.uci.edu\/\u0022 rel=\u0022noreferrer noopener\u0022 target=\u0022_blank\u0022\u003EDepartment of Computer Science\u003C\/a\u003E. \u201cWe don\u2019t know why these sites are deploying such verification\u2014it could be a move to limit liability or simplify operations. Regardless, it points to an emerging threat for the open Internet where restrictive laws from some states could impact the entire country and beyond.\u201d\u0026nbsp;\u0026nbsp;\u003C\/p\u003E\u003C\/div\u003E\u003Cdiv\u003E\u003Cp\u003EThe study, \u003Cem\u003EPapers Please: A First Look at Age Verification on the Web,\u003C\/em\u003E was led by Georgia Tech Ph.D. student Shreyas Minocha, undergraduate Isaac Sheridan, and professors Oppenheimer, Pearce, and Specter. It is part of the proceedings of the 47th \u003Ca href=\u0022https:\/\/sp2026.ieee-security.org\/\u0022 rel=\u0022noreferrer noopener\u0022 target=\u0022_blank\u0022\u003EIEEE Symposium on Security and Privacy\u003C\/a\u003E and was presented in San Francisco on May 20th, and featured in \u003Ca href=\u0022https:\/\/nam12.safelinks.protection.outlook.com\/?url=https%3A%2F%2Farstechnica.com%2Ftech-policy%2F2026%2F03%2Fafter-discord-fiasco-age-check-tech-promises-privacy-by-running-locally-does-it-work%2F\u0026amp;data=05%7C02%7Cjohn.popham%40cc.gatech.edu%7C9618dbf4c61140338f5508deb7673edd%7C482198bbae7b4b258b7a6d7f32faa083%7C1%7C0%7C639149851249813372%7CUnknown%7CTWFpbGZsb3d8eyJFbXB0eU1hcGkiOnRydWUsIlYiOiIwLjAuMDAwMCIsIlAiOiJXaW4zMiIsIkFOIjoiTWFpbCIsIldUIjoyfQ%3D%3D%7C0%7C%7C%7C\u0026amp;sdata=WDS9aMmP8UCwjQdFIuZh73PMNG%2Be4Ks949IjaeUZv%2FI%3D\u0026amp;reserved=0\u0022 rel=\u0022noreferrer noopener\u0022 target=\u0022_blank\u0022\u003EArs Technica\u003C\/a\u003E.\u0026nbsp; \u0026nbsp;\u003C\/p\u003E\u003C\/div\u003E\u003Cdiv\u003E\u003Cp\u003E\u003Cem\u003ECORRECTION: A previous version of this article, posted in error, included statements that were not part of the researchers\u2019 findings or intent. This version has been updated for clarity, and to reflect the research as published in IEEE S\u0026amp;P.\u003C\/em\u003E\u0026nbsp;\u003C\/p\u003E\u003C\/div\u003E","summary":"","format":"limited_html"}],"field_subtitle":"","field_summary":[{"value":"\u003Cp\u003ENew cybersecurity research indicates that one of the world\u2019s leading age verification providers collects and shares highly sensitive personal data with third parties.\u003C\/p\u003E\u003Cp\u003EThe research also reveals that most websites that require age verification don\u2019t enforce the policy.\u003C\/p\u003E","format":"limited_html"}],"field_summary_sentence":[{"value":"New cybersecurity research indicates that one of the world\u2019s leading age verification providers collects and shares highly sensitive personal data with third parties and in some cases don\u0027t even enforce the policy.."}],"uid":"36253","created_gmt":"2026-05-19 15:01:23","changed_gmt":"2026-07-16 18:35:39","author":"John Popham","boilerplate_text":"","field_publication":"","field_article_url":"","location":"Atlanta, GA","dateline":{"date":"2026-05-19T00:00:00-04:00","iso_date":"2026-05-19T00:00:00-04:00","tz":"America\/New_York"},"extras":[],"hg_media":{"680309":{"id":"680309","type":"image","title":"Digital-ID.jpg","body":null,"created":"1779203176","gmt_created":"2026-05-19 15:06:16","changed":"1779203176","gmt_changed":"2026-05-19 15:06:16","alt":"A hand holds up a digital identification card. The card has the silhouette of a man wearing a suit and tie. ","file":{"fid":"264556","name":"Digital-ID.jpg","image_path":"\/sites\/default\/files\/2026\/05\/19\/Digital-ID.jpg","image_full_path":"http:\/\/hg.gatech.edu\/\/sites\/default\/files\/2026\/05\/19\/Digital-ID.jpg","mime":"image\/jpeg","size":1508599,"path_740":"http:\/\/hg.gatech.edu\/sites\/default\/files\/styles\/740xx_scale\/public\/2026\/05\/19\/Digital-ID.jpg?itok=M-WXTSUO"}}},"media_ids":["680309"],"groups":[{"id":"47223","name":"College of Computing"},{"id":"1188","name":"Research Horizons"},{"id":"660367","name":"School of Cybersecurity and Privacy"}],"categories":[{"id":"153","name":"Computer Science\/Information Technology and Security"},{"id":"135","name":"Research"}],"keywords":[{"id":"365","name":"Research"},{"id":"187915","name":"go-researchnews"},{"id":"182941","name":"cc-research; ic-cybersecurity; ic-hcc"},{"id":"1404","name":"Cybersecurity"}],"core_research_areas":[{"id":"145171","name":"Cybersecurity"}],"news_room_topics":[{"id":"71881","name":"Science and Technology"}],"event_categories":[],"invited_audience":[],"affiliations":[],"classification":[],"areas_of_expertise":[],"news_and_recent_appearances":[],"phone":[],"contact":[{"value":"\u003Cp\u003E\u003Ca href=\u0022mailto:jpopham3@gatech.edu\u0022\u003EJohn Popham\u003C\/a\u003E\u003Cbr\u003ECommunications Officer\u003Cbr\u003ESchool of Cybersecurity and Privacy\u003Cbr\u003EGeorgia Tech\u003C\/p\u003E","format":"limited_html"}],"email":[],"slides":[],"orientation":[],"userdata":""}}}