Social media companies are trying harder to know which users are kids

Of the child safety measures agreed to in Meta’s landmark legal settlement, no category contains more detailed requirements than its commitments on age assurance — and for good reason. No matter how well the protections work, they are of little use if Meta can’t tell which users are kids.

Determining which accounts belong to children is also the linchpin of child safety measures that other companies, including Google, TikTok, and Roblox, are ramping up as public and regulatory sentiment turns against them in the U.S. and other countries.

Read more:

• Meta’s new rules for kids should extend to Canada, B.C. attorney general says
• Ottawa wants to block kids from social media. How would age verification work?
• Canada’s social media ban for under-16s likely to face Charter challenge, experts say

The Meta settlement — with protections the company says could become industry standards — will give the social media giant a year to refine its approach. But the options are limited, and improving age verification technology presents steep challenges, including navigating privacy implications not just for children but for adults who could have to prove they are over 18.

The $18 billion settlement resolves claims from state attorneys general that it hurt children’s mental health by deliberately designing its Instagram and Facebook platforms in ways that hooked young people’s attention. The agreement announced last week with the Menlo Park, California, company involves 48 states plus the District of Columbia and U.S. territories.

Tech companies lean on AI for estimating ages

In the offline world, people use government-issued IDs to prove they are over 18 or 21, whether they want to get into a club or buy cigarettes. While this technically works online too, many people are not comfortable giving a Big Tech company like Meta or Google access to their driver’s license or passport.

Meta accepts IDs to check ages, and promises to delete them within 30 days. Beyond IDs, though, a growing number of tech companies are using artificial intelligence to try to determine users’ ages. This is not true age verification. While AI can estimate a person’s age, often accurately, it can’t verify a person’s birth date.

Last year, Google began using an age-assurance system for YouTube that relies on AI to differentiate between adults and minors based on their watch histories. Meta does the same.

AI age checks use clues to determine how old someone is. On Instagram, this includes “contextual clues” such as posts about birthday celebrations or school, and things like which posts people like, comment or linger on, who their friends are, as well as the times of day they log in. For instance, someone who is offline during school hours would likely be school-aged.

In a blog post last year, Meta said its AI also looks at photos people post for visual cues, including “height or bone structure, to estimate someone’s general age; it does not identify the specific person in the image.”

“By combining these visual insights with our analysis of text and interactions, we can significantly increase the number of underage accounts we identify and remove,” the company added.

Under the settlement, Meta agreed to strengthen its age-checking technology using its own tools, as well as third-party ones, with regular outside audits on how well it is working. The agreement also includes specific goals around false positive rates — that is, minors who are identified as over 18. And if a user is identified as under 13 and kicked off one of its platforms, Meta will check the ages of their friends, too.

Face scans count as age assurance on some sites

Identity verification companies like Yoti and Persona, which work with tech companies like Meta and Roblox, use video selfies people upload to estimate their ages.

The gaming site Roblox, which, unlike social media platforms, allows kids under 13 to sign up, requires players to take a video selfie to estimate their age. Roblox says the videos are deleted after the age check is processed. Users are not required to submit a face scan to use the platform, only if they want to chat with other users.

Some users have reported inaccuracies, and some experts have expressed caution about the reliability of facial age estimation tools, especially for women or certain racial or ethnic groups. But Matt Kaufman, chief safety officer at Roblox, said last year that for people between about 5 and 25, the system can accurately estimate their age within one or two years.

Some websites and social media companies such as Meta have argued that age verification should be done by app store owners, such as Apple and Google, and not individual platforms. This would mean that app stores would have to verify their users’ ages before they allow them to download apps. Unsurprisingly, Apple and Google disagree.

“Billed as ‘simple’ by its backers, including Meta, this proposal fails to cover desktop computers or other devices that are commonly shared within families. It also could be ineffective against pre-installed apps,” Google said in a blog post last year.

Privacy concerns remain an obstacle

Age checks are meant to keep kids out of online spaces that are not safe or appropriate for them, whether that’s social media or adult websites. But critics of online age verification see a worrisome trend toward a less secure, less private and less free internet, where people can be denied access not just to pornography but news, health information and the ability to speak openly and anonymously.

What’s considered harmful to minors can be subjective, and this is where experts believe laws requiring age verification can run afoul of the First Amendment. The question could lead to people being required to verify their ages to access anything, from Netflix to a neighborhood blog.

The digital rights group Electronic Frontier Foundation has been warning for years about “age-gating the internet.”

“(No) matter the method, every system demands users hand over sensitive and immutable personal information that links their offline identity to their online activity,” EFF writes in a blog post. “Once that valuable data is collected, it can easily be leaked, hacked, or misused.”