Behind Mexico’s headline proposal — platforms must shield minors from violent and sexual content, as Reuters reported — sits a technology most users have never thought about: age assurance. It is the machinery that would let a service treat a thirteen-year-old differently from a thirty-year-old, and experts are sharply divided over whether that machinery can be both effective and respectful of privacy.
This explainer looks at how the technology works, where it fails, and why reasonable specialists reach opposite conclusions. For more technology analysis, visit our homepage.
The Main Methods, Explained
There are four broad approaches. Self-declaration asks users for a birth date — simple, private and easy to fake. Estimation infers an age range, most commonly from a facial image processed by machine learning; good systems output only “over 18: yes” and discard the image. Verification checks a credential — a passport, driving licence or bank record — through a specialist provider. Finally, digital identity wallets, now rolling out in the European Union, let users prove an attribute such as age without revealing their identity at all.
Platforms typically layer these methods: light signals for low-risk features, stronger checks for adult content or purchases. The art is proportionality — the same principle regulators such as the Information Commissioner’s Office apply when they demand data minimisation from the checkers themselves.
Where the Technology Struggles
Estimation accuracy varies by age band and, studies have found, can vary across demographic groups — a serious fairness concern if some users are wrongly blocked. Verification excludes people without documents and worries security experts, who note that every stored ID database is a breach target. Determined teenagers, meanwhile, borrow credentials, use VPNs or migrate to unregulated services, blunting any system’s real-world effect.
These are not reasons the technology is useless; seatbelts are imperfect too. But they explain why experts resist describing any method as “solved”, and why Mexico’s rules will need standards, audits and appeal routes for wrongly blocked adults rather than a simple mandate to “check ages”.
Why Experts Disagree
The disagreement is partly technical and partly philosophical. Engineers tend to ask whether a system meets an accuracy and privacy specification. Civil-liberties specialists ask who controls the specification, and what stops tomorrow’s government from widening it. Child-safety researchers ask a third question: compared with what? The baseline is not a private, safe internet — it is today’s internet, where children routinely encounter adult content with no check at all.
All three questions are legitimate, which is why the debate resists slogans. Mexico’s plan will be strongest if it answers each: certified methods with published accuracy, strict limits on data use and scope, and honest measurement of whether children are actually safer.
What to Watch
Watch the implementation details: which services are in scope, which assurance methods are approved, how long data may be kept, and whether an independent regulator can audit the checkers. Those clauses, more than the headline duty, will determine whether Mexico’s law becomes a privacy-preserving model or a cautionary tale.
Age assurance is unglamorous technology with glamorous stakes: the future balance between safety and anonymity online. Mexico has just become one of its most important test cases. Explore more in our technology section.
The research frontier is moving, too. Cryptographic techniques such as zero-knowledge proofs promise something once thought impossible: proving you are over eighteen while revealing literally nothing else — not your name, not your birth date, not even which service asked. If those methods mature into cheap, certified products, much of the current controversy evaporates, because the trade-off it rests on disappears. Mexico’s framework will be written before that maturity arrives, so its wisest feature would be flexibility: approving methods by the privacy and accuracy they achieve, rather than naming today’s technologies and freezing them into law.
Vendors, for their part, are racing to make checks invisible: signals gathered from devices and accounts, shared between services so a user verifies once rather than at every door. That ‘verify once’ vision is attractive and dangerous in equal measure — convenient when it works, exclusionary when a single error follows a person everywhere. Mexico’s framework would be wise to guarantee alternatives: no citizen should be locked out of the lawful internet by one company’s algorithm. Redress, in the end, may matter as much to public trust as accuracy.
