What an age verification check actually sees

The button says “confirm you’re 18.” The system behind it is doing a lot more

Most people’s experience of age verification checks is a single tap: “I am over 18,” or a slider, or maybe a quick selfie held up to a webcam. What’s happening on the other side of that button is rarely one check. It’s usually two or three independent systems voting on a single question, each one built to catch a different kind of lie.

That matters because the way people try to get around age verification checks has shifted a lot in the last few years, from typing a fake birthdate into a form to holding a photo of someone else’s ID up to a camera to running a synthetic video feed through a virtual camera driver. Verification vendors built their pipelines around each of those failure modes as they showed up. Understanding what the check actually looks at explains both why it’s gotten harder to fool and where it still bends.

Three different questions, bundled into one prompt

“Are you over 18” is really three separate questions stacked together, and most serious verification products answer more than one of them before letting a session through.

The first is a document question: does this person hold a government-issued ID that says they’re old enough, and is that ID real. The second is a biometric question: does the face in front of the camera right now match the face on that ID, and is it a live human being rather than a photo or a recording. The third is a data question: does everything else the platform knows about this account, like billing details, phone carrier, or prior account history, line up with the claimed age. A lot of consumer-facing checks only ever ask the first or the weakest version of the third. The ones protecting against real regulatory or liability exposure, like alcohol delivery, gambling, or adult content, tend to run all three.

What the document scan is actually reading

When a system asks for a driver’s license or passport photo, it’s not just storing an image. Optical character recognition pulls the printed fields, but the more useful data usually comes from the machine-readable zone on passports and newer ID cards, a line of encoded text that carries a checksum. That checksum is what catches a document where someone edited the printed birthdate in an image but didn’t (or couldn’t, without the underlying key) update the encoded data to match.

Beyond the text, document verification tools look at the physical layout: hologram placement, microprint, UV-reactive ink patterns, and font kerning that varies by issuing authority and even by print batch. Some of that can be checked from a single photo. Better systems ask for multiple angles or a short video pan across the card, because holograms and certain security films only show their pattern when light hits them at specific angles, something a flat printed copy or a screen photo of an ID can’t reproduce convincingly. This is also why a photo of a photo, or a photo of a phone screen showing an ID, tends to fail: screens have a pixel grid and a refresh rate that shows up as moire interference or banding under a phone camera’s own sensor, and a flat print doesn’t have the angle-dependent glint a laminate or hologram has.

Liveness detection: proving there’s a person, not a picture

The second layer, the selfie step, exists because a document photo alone proves someone has an ID, not that they’re the person on it. Liveness detection is built to answer a narrower question: is there a live human face in front of this camera right now.

There are two broad approaches. Active liveness asks the user to do something, turn their head, blink, smile, or read a number out loud, and checks that the response matches the prompt with plausible timing and motion. Passive liveness skips the prompt and instead analyzes a single frame or short clip for texture, depth cues from stereo or structured-light cameras where available, and subtle signs of screen replay like consistent pixel patterns or a lack of the micro-movements a real face makes even when trying to hold still. Passive systems also look at reflections in the eyes and on skin, since a printed photo or a screen has a flatter, more uniform reflectance than actual skin under real ambient light.

This is the layer most under pressure from what’s called an injection attack, where instead of showing a camera a fake image, someone feeds a synthetic video stream directly into the software as if it came from a camera, using a virtual camera driver or a modified app that bypasses the physical lens entirely. Verification vendors counter this by checking for camera and device attestation signals, confirming the video is actually coming from a real, unmodified camera driver on a real device rather than an injected source, and by watching for the kind of frame-timing artifacts that synthetic or AI-generated video still tends to leave behind, even when it looks convincing to a human eye. This is an active arms race; deepfake and reenactment quality keeps improving, and liveness vendors keep retraining detection models against the newest generation of fakes, which means neither side stays ahead permanently.

Facial age estimation: a guess with a margin of error

Some platforms skip document checks entirely and just estimate age from a face, using a neural network trained on large labeled datasets of faces with known ages. This is common where full ID verification would be too much friction for a low-risk product, like restricting a filter or a purchase category rather than gating adult content.

These models don’t return a certain answer, they return a distribution, something like “87% confidence this face belongs to someone 21 or older.” Platforms set a threshold and a buffer zone around the legal cutoff, often flagging anyone estimated within a few years of the boundary for a stronger check like a document scan, precisely because facial age estimation is least reliable right around the ages that matter most, late teens into early twenties, where a training set genuinely struggles to tell 17 from 19 from a photo alone.

The quiet layer: data that never touches the camera

Underneath the document and the face, there’s often a third check that the user never sees happen. Verification services can cross-reference the name and details from an ID against consumer data held by credit bureaus and other data brokers, checking whether a person of that name and birthdate has an established credit history, phone contract, or address history consistent with being an adult. Mobile carriers also expose age-related signals in some markets, since a phone number tied to a long-standing postpaid account behaves differently, from a data standpoint, than one on a prepaid SIM activated an hour ago. None of these signals prove age on their own, but they’re cheap to check and good at catching accounts built with synthetic or freshly fabricated identities, which tend to have no data footprint anywhere else.

Why this infrastructure is expanding, not shrinking

Age verification checks have gotten more common and more invasive largely because the regulatory floor has moved. Laws like the UK’s Online Safety Act and various US state statutes now require “reasonable” or “highly effective” age assurance for certain categories of content, with real penalties attached, which pushes platforms away from a simple checkbox and toward document or biometric verification even when it costs them signups. The EU’s Digital Services Act pushes in a similar direction for platforms serving minors. That regulatory pressure is also why these checks now retain data they didn’t used to: proof of verification, sometimes a hashed version of the ID or face template, has to be kept in case a platform needs to show a regulator it actually did the check.

None of these systems are airtight, and none of the vendors building them claim otherwise; every layer described here has a documented failure mode, and the ones catching the most sophisticated spoofing attempts today are the same ones that were beaten by yesterday’s techniques. What’s changed is the number of independent signals a person now has to fool at once, and how much harder that gets as document checks, liveness detection, and background data checks get layered together instead of running alone.

If you want more of this kind of look under the hood of the systems that decide who’s real online, The Hidden Internet covers the infrastructure of bot detection, fingerprinting, and the cat-and-mouse behind it.

Get new guides and videos first — join the Telegram channel.