It’s no secret that many web services are barreling headfirst into using AI for age verification. They hope to scan a video of your face, run some AI checks, and determine how old you are. It has stirred quite a bit of controversy among a growing number of people around the world, especially among privacy advocates.
It makes sense. How often do we hear about websites leaking our data? They can’t even keep our email addresses safe, and we’re supposed to believe they’ll keep scans of our driver’s license secure.
Consider me a bit skeptical.
But why are they all doing this? Well, if you listen to the media or to governments already forcing the implementation of such checks, the claim is that age verification in this manner will protect children from online harms. And since the media and governments never lie, this must be the truth. I mean, when has any government ever deceived the public? Practically never, right?
Okay, before this turns into a blog post of me complaining about the forced use of these tools, let’s get into the actual point I’m writing about. These tools don’t work. They aren’t accurate and in some cases, not even close.
Before We Get Into This, A Point of Clarification on Age Verification Systems
It’s important to recognize the difference between the “general intelligence” models used in my testing and the “specialized biometric” systems used by major corporations like Uber and Discord. While they may seem like the same thing, they operate on differently.
General Use AI Models
When models like ChatGPT and Google Gemini are asked to determine an age from a photo, they do so using factors such as skin texture, facial structure, and hairstyle. However, they may also take into account things that are not part of the face, such as clothing, background, and other props. This makes it easy to sway the AI’s reasoning.
Specialized Biometric Systems
Companies like Yoti or FaceTec (often used by larger companies and age-restricted sites) use enterprise-level Facial Analysis Technology (FAT). Their systems are trained on millions of diverse, age-verified faces. Essentially, they know what a 16-year-old boy looks like because they have been trained on thousands of images or videos of the faces of actual 16-year-old boys. These systems look at things like skin elasticity, distance between specific facial markers, and bone structure to determine chronological age. Some higher-end systems also use “liveness detection,” requiring the user to move or blink. This is meant to ensure they aren’t looking at a high-resolution photo or a video deepfake.
My Testing and Why It Still Matters
I’m not testing with the specialized biometric systems that large companies use. Besides being expensive, I don’t have the time to go through a back-and-forth with their sales team to gain access, nor the size shovel I would need to unbury myself from the onslaught of sales emails to follow.
That said, I also don’t need to use their systems for this test, as all visual age verification suffers from the same problem. As Gemini once said, “Visual age estimation is a game of averages, and human beings are masters of being the exception.”
Additionally, not all services performing age verification use those expensive biometric systems either. Some rely on the APIs of OpenAI. In fact, that’s how a ton of different AI services of all kinds function. They’re essentially just wrappers for ChatGPT and Anthropic.
Now that we have that out of the way, let’s look at a couple of masters of exception.
Maria versus Grok, ChatGPT, and Google
The first person who came to mind when this test popped into my head was Maria in the film Look Away. As you can see in the image above, she’s very young. In fact, she’s a 17-year-old high school student.
Excluding those details, I gave the image to Gemini, ChatGPT, and Grok. I asked each of them to run an age ID check and instructed them to estimate her age based on the photo. I got back the following results:
- Grok: 17-18
- Gemini: 14-17
- ChatGPT: 16-19
All three AI heavy-hitters guessed around the same general age range, and they all based their reasoning on the same types of facial and appearance details. Since Maria is 17, each AI nailed it, right?
No, not really.
Maria is played by India Eisley. When she shot the movie Look Away, she was 24-25 years old.
You are looking at an adult woman in that photo, not a teenage girl.
India is not the only actress known for pulling off a teenage appearance as an adult. One of my all-time favorites, Alison Lohman, now retired from acting, portrayed a 14-year-old in the film Matchstick Men. According to the film’s director, Ridley Scott, he was unaware that she was actually a 23-year-old woman. He believed she was underage, even asking if her mom was picking her up after meeting her.
And that’s a man who was face-to-face with the person in question and still got it wrong.
How does this pose a problem in the real world?
Companies are charging headlong into advanced age detection, hoping AI can visually determine someone’s age with accuracy. From there, it becomes a key factor in what you can and cannot do on their websites or apps.
ChatGPT, Gemini, and Grok were fooled by India Eisley’s youthful appearance, while Alison Lohman tricked Ridley Scott right to his face with her…well…face.
And I’m not saying that ChatGPT and a commercial biometric system perform at the same level. I’m saying they share the same underlying weakness: both are still trying to estimate age from appearance, and appearance is not a dependable stand-in for age.
Some people just naturally look younger or older than they really are. Others use makeup to switch up their appearance. YouTube is full of video tutorials that teach audiences how to age themselves up or down, erasing or adding wrinkles, shadows, blemishes, or texture. All of these variants can and will trip up AI visual age detection.
Let’s consider a company that wants to allow access to certain content based on age. If that content is only for 18+ and they scan your face to determine your age, you’ll need to appear to be at least 18.
That won’t be hard for many. There are 15-year-olds who look older than 18. Hell, my daughter went to high school with a girl who was in the 10th grade, but looked like somebody’s mother.
When my wife was in high school, a teacher thought she was a parent.
“But AI tools use micro-distances between points on the face. It’s much more advanced than human detection,” says person.
It’s also prone to the same failures because, again, people don’t always look like you would expect for their age. That’s why it doesn’t matter whether you’re using a photo scan or a video to detect liveness. You’re still looking at the face of a person who does not appear to be their age.
And that’s the whole point.
The plasticity of human faces varies from person to person. Look at high school guys from old yearbooks in the 70s and 80s. Those dudes look like they’re nearing their 12th year at the steel mill and supporting a wife and 4 kids.
When you are someone else
While Gemini completely missed the mark on India’s age, it did do something I didn’t ask: it identified who she is. The AI was aware that the photo I gave it was of India Eisley and even told me which film it came from.
On another test, I tried checking Alexa Nisenson. Not only did Gemini assume she was older than she really was on Fear the Walking Dead, but it also thought she was someone else.
This poses a different problem: mistaken identity.
Let’s say an AI scans your face and assumes you’re someone else. If the AI can recognize people, it’s likely going to take that into account. Why does that matter?
In the case of Alexa Nisenson, Gemini kept insisting she was Alexa Mansour. Besides being a totally different woman, Alexa Mansour is a decade older than Alexa Nisenson. So, if the 13-year-old version of Alexa Nisenson used an AI age verification check, and it assumed she was Alexa Mansour, the AI would also think she was in her early 20s.
If the system were meant to age-gate content for adults only, it would have failed and allowed a 13-year-old to access it.
On another occasion, I tried to have Google Flow edit a stock photo, and it refused, insisting that the man in the photo was a famous person. He isn’t. He’s just a random stock model in a free image from Pexels.
And that reveals another part of the problem.
Let’s say Tom has been banned from a site, and to keep Tom out, the site uses an AI that is trained to know what Tom looks like. You try to use the site, and because you look just enough like Tom, the AI refuses and even bans your account or prevents you from making one.
What is the alternative to AI-based visual verification?
If visual verification isn’t accurate, what’s the best method of verifying someone’s age, or that they are who they say they are?
Government officials reading this are screaming, “Digital ID” with glee on their face.
Hold your horses.
Digital ID is not perfect either. People can share each other’s IDs to gain access to things, completely negating the feature. Additionally, if it uses face scanning, it can fail for the same reasons I mentioned above, especially if you look enough like your parents or other siblings (especially twins). You can just be them.
And that doesn’t even get into the other problems with Digital ID, like a company tracking everything you do online. Yeah, nothing could ever go wrong there.
So what is the answer?
It really depends on what you’re ultimately trying to do and what level of failure you’re willing to accept. Using a biometric system will be much stronger than using an off-the-shelf general-purpose AI API like OpenAI or Anthropic. Those simply aren’t built for that, and while they can sometimes be in the ballpark, it’s often like throwing a dart at a board from 50 feet away. You might hit the center, or be off a bit.
Or a lot.
And don’t expect every website or app to use a biometric system. As I said at the start, they’re expensive, and if an app or site isn’t willing to spend the money for a system that may provide marginal to mediocre improvement, they may just go for what’s cheapest.
Digital ID is the worst option. Not only does it fail to fix the problem, but it also creates a new one. Data tracking and harvesting help no one but those doing the tracking and harvesting.
Those, and the people who eventually steal the information.
Let’s be real, here. How often have you received an email from some service telling you that your information was leaked?
And there’s a reason most people don’t believe digital ID has anything to do with protecting children. Rather than get into a 6-mile-long blog post of mostly obscenities, I’ll save that for a later date.
So what’s the real fix? There probably isn’t a 100% risk-free, foolproof solution. Humans are going to find ways around things, whether intentionally or unintentionally. Some people just look younger or older than they really are, and some people look like other people. And expecting digital ID not to be abused is like hoping to win the lottery without buying a ticket.
Sure, it might happen, but it’s not very likely.
In the end, it really just depends on how much risk you’re willing to take, how much risk you’re willing to put on your users, and how you’re planning to handle failures when they happen.
Because they will happen at some point.
The best thing you can do is have backup plans in place to handle those failures. For instance, if you’re going to use AI, don’t use a general-purpose AI. Use a biometric tool specifically built for this purpose.
However, you should closely monitor it and manually check a lot of users who go through it regularly to ensure it’s working as expected and catch the failures it misses. Don’t just put it in place and expect to never look at it again.
And expect people to complain. That’s definitely going to happen also.
Leave a Reply