Age Verification in the UK: What Data Do Companies Collect?

Tue, 30 Ju

Digital lock over neon cityscape with diverse silhouettes holding ID cards

Primary source: https://disruptarian.com/blog/tojp

On 30 June 2026 the Electronic Frontier Foundation (EFF) released a detailed Q&A for the LGBTQ+ community: “What Data Are Companies in the UK Collecting When Verifying My Age?” The article breaks down the legal landscape, the technology stack, and the real‑world privacy implications for everyone—especially those whose identities are already under surveillance by employers, governments, and bad actors.

Why Age‑Gating Is Legal in the UK

Since July 2025 the UK government, along with the telecommunications regulator Ofcom, has mandated that any platform hosting content deemed “harmful” (pornography, gambling, certain drugs, etc.) must block users under 18. Failure to comply is a criminal offence. The law is broad: it covers websites, mobile apps, and even iPhones when they host third‑party content. The result? A tidal wave of age‑verification services, each with its own data practices.

What Data Does a Verification Service Need?

Every method boils down to a simple question: Is the user over 18? The answer may require a handful of data points, but the patterns of what companies are willing to collect are telling. Below is a taxonomy of the most common methods, the data they request, who sees it, and how long it stays.

Facial Age Estimation

Facial recognition firms like Yoti or Persona ask you to upload a selfie or a short video. The image is sent to their servers, where a machine‑learning model estimates your age. The EFF notes that Yoti claims to "as soon as an age has been estimated, the facial image is immediately and permanently deleted." This claim is a red flag. Even a single snapshot can contain metadata—GPS coordinates, device model, timestamp—that can be used to triangulate your whereabouts. For LGBTQ+ users who may already be flagged in other data sets, a leaked selfie can confirm an identity and facilitate targeted harassment.

Some services, such as k‑ID and Private ID, process the image locally on your device, so only the numerical age‑score leaves the phone. This is the only method that truly limits exposure to a third‑party server.

Photo‑ID Matching

Many platforms now use photo‑ID (passport, driver’s licence, national ID card) to confirm age. The process typically involves uploading a photo of the ID and a selfie. A third‑party provider—often Yoti or Incode—runs a similarity check. The EFF warns that Incode doesn’t automatically purge data after verification. If you are verified through TikTok, TikTok claims it "starts the process to delete the information you submitted, which should include telling Incode to delete your data once the process is done." The chain of custody is complex, and you must rely on a provider you have no control over. Past incidents—like Discord’s old age‑verification system that stored ID photos in a public forum—highlight the risk of data lingering in the wrong hands.

Open Banking

The Open Banking API is a privacy‑first approach. You grant a verification service access to your bank account, and the bank confirms whether you are over 18. Importantly, the service receives only a token that says "over 18"; no date of birth is shared. If the verification is done through a payment processor, the bank’s data is encrypted in transit and never stored by the verification service.

Credit Card Age Checks

Some adult content sites require a credit card. In the UK, you cannot legally obtain a credit card before 18. Thus, a credit‑card‑check is a de facto age check. The card issuer verifies your age before issuing the card; the merchant just sees a successful transaction. No personal data leaks beyond the payment record, but the card number itself becomes a piece of data that could be aggregated with other services.

Email Verification

Email‑based age estimation is a newer, more opaque method. You provide an email address; a third‑party tool scans public and private accounts the email has been used on to infer age. The tool aggregates data from banks, utilities, and other services. The only new piece of information the tool learns is that you want to verify your age, but it may retain a history of your email usage that could be combined with other data sets.

Mobile Operator Checks

Mobile carriers can confirm whether your number has an age filter applied. If the filter is off, the service can deduce you are over 18. The data shared is minimal: the carrier confirms the filter status to the verification provider. However, the provider still learns the phone number and, by extension, can link it to other accounts you may hold.

Retention, Audits, and Visibility

The EFF lists three critical questions for every service you use:

Retention: Who keeps the data and for how long? Some services delete immediately; others keep a record indefinitely.
Audits: Are there third‑party security audits that verify the provider follows its own policy? Audits by firms like NCC Group or Trail of Bits are more reliable than internal ISO certifications.
Visibility: Who can see that you’re attempting to verify your age? A third‑party provider knows which platform you’re trying to access and can build a profile over time.

Why LGBTQ+ People Are at Higher Risk

Data that reveal sexual orientation, gender identity, or HIV status can be used by employers, law‑enforcement, or acquaintances to discriminate or harass. The EFF notes that the collection of seemingly innocuous data (like a selfie or a photo‑ID) can be combined with other datasets to expose the very traits that the LGBTQ+ community works to keep private. For example, a leaked ID photo may confirm a name that appears on a government database, which then could be cross‑referenced with health records or court filings.

Moreover, age‑gating tends to be more aggressively enforced in communities that already face surveillance. Pub‑sub services, streaming platforms, and even gaming communities may reject LGBTQ+ users under the guise of age restrictions, thereby limiting their access to vital support networks.

Is There a Privacy‑Protecting Verification Option?

Unfortunately, no single method strikes a perfect balance between legal compliance and privacy. Facial recognition that deletes images is still risky; photo‑ID matching can leave data in a third‑party cloud; open banking is good but limited to banking users. The EFF’s conclusion is stark: There is still no widely available way to verify age online without compromising privacy. And even if such a method existed, the government’s blanket age‑gating mandate would likely still block lawful speech and constrain online communities.

Why the EFF Opposes Age‑Gating Mandates

The EFF argues that age‑gating is a slippery slope. Once a government can mandate age checks for “harmful” content, it can expand the definition of harmful content to suppress dissent, art, or queer culture. The cost to civil liberties is disproportionate to the benefits, especially when less restrictive alternatives (e.g., self‑regulation, better parental controls, or better content moderation) exist.

In the UK, the EFF is actively lobbying to overturn these mandates and to push for privacy‑first verification standards that respect both age compliance and individual data rights.

Bottom Line: What Should You Do?

Ask questions. When prompted for age verification, request a clear privacy policy showing exactly what data is captured, how it is stored, and who can access it.
Prefer local processing. If you can choose a service that processes data on your device (k‑ID, Private ID), it’s the safest option.
Use open banking if possible. It gives the platform proof of age without revealing a date of birth.
Delete data proactively. If the service offers a delete request (e.g., Incode), use it immediately after verification.
Stay informed. Follow civil‑liberties groups like the EFF to learn about new verification methods and their privacy implications.

Age verification is a legal requirement, but it doesn’t have to be a privacy nightmare. By demanding transparency, choosing the least invasive methods, and pushing back against blanket mandates, you can keep your data—and your identity—under control.

Read the full EFF Q&A for an exhaustive breakdown: EFF – Age Verification Data Collection.