Papers, Please: A First Look at Age Verification on the Web

I would like to share the findings of our research paper, Papers, Please: A First Look at Age Verification on the Web [1]. We measured the prevalence of third-party age verification providers on the web as visible from different US states, and performed a security and privacy analysis of age verification methods offered by the top provider, Yoti.

Fierce debates on age verification, such as for social media access, and its impact on Internet freedom and digital privacy are active in India and abroad. Although our work focuses on the US, we lay a foundation for broader analyses of the privacy impact and effectiveness of age verification (AV) technology. My goal with a talk at IndiaFOSS would be to engage Indian technologists in this important discussion.

Background: State AV laws were challenged on free speech grounds; ultimately the US Supreme Court set a precedent for their constitutionality.

Age Verification Provider Prevalence

• We crawled the top 1 million websites from three US states—two with AV laws and one without.

• We estimated that less than 20% of self-tagged adult websites use AV providers in states that require age verification.

• We found that the laws created unprecedented state-wise differences in access (and, ultimately, privacy).

• We estimated that Yoti was the most commonly-used third-party AV provider.

Yoti Privacy

• We analysed three age verification methods (as observed in the browser) and found

  • collection of high-entropy browser metadata, and

  • the sharing of some sensitive data (e.g., IP address, the original website) with third parties.

• After reverse-engineering the selfie-based age estimation method, we demonstrated that it could be bypassed on the browser-side.

[1] S. Minocha, I. Sheridan, H. Oppenheimer, P. Pearce, and M. A. Specter, “Papers, Please: A First Look at Age Verification on the Web,” in 2026 IEEE Symposium on Security and Privacy (SP), May 2026. [Online]. Available: https://shreyasminocha.me/papers/papers-please.pdf

• Age verification laws in the US have created new state-level access differences contingent on third-party age verification providers.

• Age verification technology deployed in the wild causes privacy issues due to overcollection of data and sharing with other upstream parties.

• Age verification laws may be ineffective due to incomplete compliance from websites and circumvention of age verification technology.