Online age verification explained (Part 1/3): What is it, a timeline of age-based restrictions, and why it matters

If you have spent any time online, you have probably been asked at some point to enter your age into a website to access it. Whether you’re entering your birthdate on a dating website or affirming that you are over 13 to make a social media account, some online experiences have always depended on users stating that they were of an appropriate age to access certain services. This practice, called “age gating,” has recently become a bigger topic of conversation in internet policy circles: it’s becoming the go-to legislative response to online safety concerns, especially when it comes to harms against children using the internet.

We fully share the need to protect children, and are fully committed to it as part of our human rights obligations. After all, minors participate in the sum of all human knowledge, both as volunteer contributors and readers. Wikimedia projects are educational platforms that aim to offer everyone, everywhere, access to encyclopedia knowledge, freely and openly. However, “age verification”—when you prove your age online using a government-issued identification (ID) and a facial scan proving the ID is yours—has real costs for the best parts of the internet: impacts on privacy, freedom of expression, and access to information, which are the very pillars Wikipedia and the other projects depend on to exist. Given those costs, a question comes up: since protecting children and protecting open educational projects shouldn’t be at odds, is age verification the best policy response every time?

This blog series aims to shed light on an evolving and complex topic, because age verification has become more complicated and invasive than just selecting a birthdate from a drop-down menu. The series is based on the certainty that both the Wikimedia Foundation and Wikimedians are committed to promoting online environments where everyone can participate safely. Written in three parts, it aims to start this conversation the Wikipedia way: fact-based, informed and neutral, and with transparency. Here’s what to expect:

• This blog post, Part One, starts at the beginning and takes you through the history, critical decisions, and evolution of internet policy concerned with the harms that certain kinds of content can cause, the origins of age gating on the internet, and the escalating trend of online child safety.
  
• Part Two provides explanations of the terms used in the global online age verification debate, critical to better understanding the technological solutions proposed to solve social problems. That in turn allows us to explore the impact of online safety policies on the human rights of Wikimedia users, especially those who are minors, and the opportunities that encyclopedic knowledge offers them.
  
• Lastly, in Part Three, we end with current examples of laws and our concerns about how they impact the Wikimedia projects as such. You will get the latest on how and where the Foundation engages with lawmakers to remind them that one-size-fits-all approaches aren’t the best: our platforms’ risk profile is different from commercial ones, our mission is to benefit the public interest and protect open knowledge, and our decentralized community moderation has proven to be effective while maintaining privacy. We need governments to see these features as advantages before laws and regulations are set in stone. 

What is happening and why it matters

Over the last decade, worries about the impact of large online platforms have grown steadily, but lawmakers have struggled to decide on exactly how to hold “Big Tech” accountable for a long list of harms ascribed to those companies and their business models. Some online harms are accelerated by business models designed to keep users engaged at any cost, with real consequences for children, and which draw necessary scrutiny. Other harms are facilitated through online interactions, such as cyberbullying, sextortion, and cyberstalking.

Policymakers are right to try to address these harms. Emotional pleas are powerful catalysts for change, but they don’t always lead to balanced and effective policy responses. This may help to explain the emerging global trend of laws requiring that providers of digital services make sure that young people don’t access certain content, design features, and platforms online.

The United Kingdom’s (UK) Online Safety Act (OSA) was passed in 2023, establishing the legislative foundation for rules requiring some online platforms to block minors’ access to harmful content. Ever since, a wave of proposals to restrict access to the internet by age has swept the globe. At least 26 countries have enacted or are actively considering age restrictions for social media, adult content, or both. In the United States (US), at least half the states have enacted age restriction laws for harmful or adult content online, with more on the way. In sum, online age gating is spreading worldwide, with no signs of stopping or slowing down.

When laws require treating some internet users differently than others depending on how old they are, websites and app developers must determine, to some degree of accuracy, the ages of everyone wishing to access their website or app. To achieve this necessary accuracy, nearly every modern method involves sharing personal identifiable information (PII) about users, which raises privacy and data security concerns as well as questions about how such restrictions affect freedom of expression and the right to access lawful information.

The Wikimedia projects are public interest, free and open knowledge platforms. Their model is also human rights-first. The projects aren’t built to invade the privacy of knowledge seekers, to extract and monetize their data, or to maximize their attention for profit. Their purpose is to allow people to freely read and openly contribute to the projects. As you’ll read in this blog post series, a website’s purpose, model, and risk level should matter when regulating, and this varies dramatically across the internet. Because one of our key strengths is transparency, we recognize that no system is static, and so we invite you to help us strengthen and, if necessary, adapt our approaches to safety as the internet evolves.

Similarly to how lawmakers across countries are debating solutions, the Foundation and Wikimedian communities can contribute to that discussion: What is our role in online safety discussions as global, public interest, educational platforms? How can we protect volunteers’ and readers’ safety and human rights as new internet rules take shape?

To inform that discussion better, let’s start at the beginning and go over how the internet has regulated content, developed age gating, and more recently, started to frame child safety online.

A timeline of how we got here

It’s helpful to establish a rough timeline of the historical events, narratives, and trends that have led to current age-based restrictions online in order to discuss the most recent internet policy developments. While many of the early regulatory developments for the internet happened in the US, many other countries have more recently played decisive roles in the turning points of this global trend and the ways it is unfolding.

A Timeline of Age Verification on the Internet


Early Internet Regulation Shapes Internet Freedom

Landmark regulations and a US Supreme Court decision create the conditions for the modern internet as we know it to flourish

1996–1997: After years of internet growth, anti-obscenity advocates push for the enactment of the Communications Decency Act (CDA) in the US. However, the US Supreme Court strikes down most of the law’s requirements, including mandatory age-based restrictions, as unconstitutional under the First Amendment of the US Constitution. What remains is Section 230 of the CDA—sometimes known as “the 26 words that made the internet”—which offers protections for websites that host user-generated content and allows forums, search engines, blogs, and collaborative projects like Wikipedia to grow and thrive. 

1998: The US Congress passes the Children's Online Privacy Protection Act (COPPA), requiring companies to obtain parental consent before collecting or processing the personal information of children under 13. Although the law did not require websites to determine their users’ ages, many chose to implement a system for users to declare their age before interacting with the website. COPPA recognized the need to protect children’s privacy rights online, and balanced potential restrictions on adult access by limiting its application to websites “directed” at children or which collected information about users known to be under 13.

The Rise of Social Media Prompts Skepticism

A social media boom creates technology company giants and draws scrutiny of their practices and influence

2000s–2010s: The rise of social media and other sharing websites, alongside growing mistrust of large internet and technology companies, revitalize efforts to check the power of these corporations. The Facebook-Cambridge Analytica scandal draws attention to Facebook’s large-scale collection of user data without informed consent, and the sale and use of this data to influence voting patterns. 

2018: The European Union (EU) adopts the General Data Protection Regulation (GDPR), setting off a worldwide wave of data protection laws and establishing the EU as a global leader in technology regulation. The GDPR included a parental consent requirement similar to the one in COPPA. The GDPR introduced the concept of online privacy to many casual internet users. Unfortunately, the additional data collection necessary for age assurance likely undermines the goals of the GDPR.

Child Safety Laws Propose a One-Size-Fits-All Solution

Spurred by genuine concerns about child safety online, lawmakers propose solutions that involve restrictions on minors’ access to the internet

2022: The US sees a wave of age-based restrictions introduced at the state and federal level. Louisiana becomes the first of many states to enact age verification requirements to access adult content online. Other, more expansive, forms of age-based restrictions emerge soon after, such as California’s Age Appropriate Design Code and Utah’s Social Media Regulation Act. At the federal level, lawmakers in the US propose the Kids Online Safety Act (KOSA/KOSPA). The creeping scope of these laws threatens to increase the technological burden and legal risks for websites outside of the adult content space, and lay a groundwork for even more restrictive regulations in the following years.

2023: The UK passes the Online Safety Act (OSA), establishing a multi-tiered framework for age-based content restrictions. Critics of the law raise concerns about how mandatory identity verification can impact privacy and free expression on all users, including the Wikimedia Foundation and Wikimedia UK.

2024: Australia adopts the Online Safety Amendment (Social Media Minimum Age) Act, restricting access of minors under the age of 16 to certain social media apps and websites. This type of total ban is unprecedented and is followed by many similar proposals around the world, although the effectiveness is still being evaluated and an estimated 4 in 5 children continue to use some form of social media.

2025: The US Supreme Court upholds Texas’s H.B. 1181, establishing a new precedent: Age-based restrictions for content deemed harmful to minors are constitutionally valid, which allows states to require online age verification. The broad scope of this law incentivizes many general-purpose platforms to adopt age verification as a caution and undermines the fundamental free speech rights that were recognized in early internet regulation.

2025: Brazil adopts the Digital Statute of the Child and Adolescent (ECA Digital), perhaps the most comprehensive digital child safety regulation to date, covering everything from fundamental right to data protection to age-based restrictions. The Wikimedia Foundation engages with regulators to urge proportionality in the law’s enforcement, reserving more restrictive measures for higher risk platforms.

Where do we go from here?

You may have seen news coverage of the privacy risks associated with age gating as well as the many ways through which minors are bypassing it. Several age assurance providers with stores of sensitive personal data have experienced data breaches, demonstrating that privacy concerns are not just hypothetical. There is also research showing that social media age gating does not reduce the amount of time young people spend on those platforms.

To understand the complexities and details of age verification and the technologies that surround it, please continue reading Part Two of our blog post series. There, as mentioned, we’ll sort through definitions of various terms, explore how these systems work, and discuss the risks and trade-offs involved—particularly those that might negatively impact the benefits that access and participation in open knowledge can offer Wikimedia users.

_______

Subscribe to our newsletter to stay informed on digital policy, Wikipedia, and the future of the internet.

For media inquiries, please contact or direct members of the press to press@wikimedia.org.