Mandatory age verification protects children but can endanger privacy. Discuss the trade-off and suggest a rights-respecting model of age assurance.

Greece has passed a law banning social media for children under 15. Platforms must verify every user's age and face penalties if they fail [1]. Such mandates do protect children. But they also force every user to prove their age, so the real choice is not between protection and privacy. It is about how to design age assurance well.

How age verification protects children

• Exposure is real: the average OECD 15-year-old spends almost 35 hours a week on social media, more than on homework and lessons [2].
• Self-declaration fails: only 2 of 50 services used by children checked age properly when an account was created [3].
• It works quickly: about 4.7 million accounts were reportedly removed in Australia's first fortnight under its under-16 law [2].
• Platforms are accountable: the duty moves from parents to companies [1].

How it can endanger privacy and rights

• Everyone is checked: to keep out a 14-year-old, the platform must check the age of every adult too, often through ID documents or face scans. This goes against data minimisation.
• Data concentration: large stores of identity data become targets for breaches and misuse.
• Free expression: the OECD warns that age limits can chill speech or become a form of censorship [2].
• Easy to get around: VPNs, false ages and adults' accounts weaken the protection, while the privacy cost remains [2].
• Exclusion: children without identity documents may be shut out of services they could otherwise use.

A rights-respecting model of age assurance

• Tokens, not documents: India's DPDP Rules allow age to be checked through virtual tokens from an authorised entity such as DigiLocker [4][5]. The platform learns only "adult: yes", not the person's identity.
• Purpose limitation: some US state laws allow age data to be used only for the age check [2].
• Audits and appeals: Australia's eSafety requires age checks that follow privacy law, regular audits, and a way for wrongly blocked users to seek review [2].
• Proportionality: stricter checks only for high-risk features, in line with the Puttaswamy (2017) test of legality, necessity and proportionality.
• Sunset review: Australia's law requires a statutory review within two years [2].
• Digital literacy: the OECD says social media literacy should be built from an early age, alongside any law [2].

Age assurance therefore works only when it is precise: it should confirm age and reveal nothing else. India's consent-based DPDP framework, combined with token-based checks, independent audits and digital literacy, can protect children without making all users give up their privacy. This would honour both Article 21 and the UNCRC's vision of children as rights-holders online.