June 04, 2026

From Policy to Practice: What the New Era of Online Age Assurance Demands

The conversation around online age assurance has shifted. For years, the debate centered on whether platforms should be responsible for keeping children out of spaces designed for adults. That question has been answered. Lawmakers, regulators, and parents are moving in the same direction at the same time, driven by mounting evidence of real harm to kids online. The question is no longer whether age assurance will be required. It is how it will be done in a way that actually protects children, preserves privacy, holds up in court, and works at scale.

That is a meaningfully harder problem than it sounds.

Age assurance sits at the intersection of three forces that do not naturally pull in the same direction.

1. Parents want their children protected, but they do not want to share more data to make that happen.
2. Regulators are pushing for verified ages while simultaneously enforcing data minimization.
3. Platforms have historically relied on self-attestation, but that is no longer sufficient or defensible. Now, they are trying to comply with a fast-growing patchwork of laws that define key terms differently, set different thresholds, and demand different technical approaches.

Legislative landscape: Aligning age assurance principles and governance

While the intent across this landscape is largely shared, the execution is still catching up.

In the United States alone, more than 150 active bills are working through state legislatures, layered on top of laws already on the books and a federal framework, the Children’s Online Privacy Protection Act (COPPA), that was written for the internet of 1998. Each bill brings its own definitions of which platforms are covered, which age bands matter, what counts as a reasonable check, and how enforcement works. For a company operating across jurisdictions, the result is a jumbled fragmented maze. But this fragmentation is forcing a more important conversation about what good policy actually looks like.

Three principles have emerged consistently from the legislators, regulators, and providers across the country who are closest to this issue.

• First, the law should be technology neutral. Statutes that hard-code a specific verification method become obsolete almost immediately, because innovation in technology far outpaces legislation. The better approach is to define the outcome (e.g. reasonable age assurance) and let the technology evolve to meet it.

• The second principle is proportionality. The obligations placed on a platform should scale to the risk of the experience. A site that exposes minors to harmful content carries a different responsibility than a general-purpose marketplace, and the laws that treat them identically generally do not survive contact with the courts.

• And the third is privacy by design. Age assurance that requires collecting and storing sensitive personal information may solve one problem while creating another. The strongest legal frameworks treat data minimization not as a downstream consideration but as a foundational requirement.

Recent federal activity reflects this thinking.

In February, the Federal Trade Commission issued an enforcement policy statement that effectively created room for age assurance to coexist with COPPA. Operators may now deploy age verification techniques without first obtaining verifiable parental consent, provided the data collected is used only to determine age, shared only with third parties bound by confidentiality and prompt deletion requirements, and discarded as soon as it is no longer needed. It is a tightly conditioned exercise of enforcement discretion, not a formal COPPA safe harbor, but it reflects growing recognition that protecting children online and protecting their data are not competing goals. They must be designed together.

For platforms, particularly marketplaces and consumer services, the practical implications are immediate. Claims that liability sits elsewhere, with vendors, with parents, with users themselves, are increasingly unlikely to hold. Regulators are asking how platforms know that age checks are happening, who is conducting them, and whether they remain accurate over time. A check at sign-up is not the same as a check at the point of a transaction. A platform that assumes it has no minors among its users without ever verifying that assumption is taking on more risk than it realizes.

The subtle change: Shifting age assurance from a checkpoint to continuous

There is also a quieter shift in how age assurance itself is being understood. The work is not only about confirming that an adult is an adult, but also confirming that a child is a child, so that minors can interact with peers in spaces designed for them without becoming targets for predators posing as someone they are not. That reframing changes what a good solution looks like. It calls for layered methods, document verification, biometric comparison, behavioral and device signals, probabilistic inference, and applied proportionately to the risk involved – with privacy preserved throughout.

The vision for an interoperable future (among parents, children, and businesses alike) is straightforward: a trusted age check, conducted once, that can be reused across services and jurisdictions through a privacy-preserving credential. Standards bodies are converging on shared baselines. Token-based and passkey-based approaches are beginning to make reusable age assurance practical. The work is not finished, and it will not be finished in a single legislative cycle.

What this moment makes clear is that age assurance is not a checkbox. Instead, age assurance should be treated as a foundation that will continually evolve with new laws and regulations. As new technologies continue to improve, the patchwork will, over time, settle into something more coherent. The platforms that treat this as a compliance burden will find themselves perpetually behind. The ones that treat it as a design principle, building reasonable, proportionate, privacy-preserving age assurance into the experience itself, will be the ones that earn durable trust with users, regulators, and the families they serve.

The harm is real, but so is the opportunity to build systems that actually meet the needs of the moment.

Jennifer Kerber

Jennifer Kerber is Head of Government Affairs at Socure, where she leads engagement with federal and state policymakers on issues at the intersection of digital identity, fraud prevention, data privacy, and financial services innovation. She works to help align regulatory frameworks with emerging technologies, with a focus on strengthening consumer protection while enabling responsible innovation. Based in Texas, Jennifer brings a government affairs perspective to the evolving policy landscape shaping digital trust.