AI年龄验证困境：儿童安全与隐私的权衡

Oliver Kemp for Transformer

When Megan Garcia told lawmakers about how her 14-year-old son died by suicide after months of conversations with a chatbot from Character.AI, one of her main requests might have been, on the face of it, the simplest — restrict access for those under a certain age.

“I don’t think that chatbot technology in its current form is safe for children,” she told a Senate Judiciary subcommittee in September. “So if they could stop children from going on their platforms, don’t make it 12+ in your app store: have proper age verification so that children under the age of 18 do not have access to chatbots. I think that would save a lot of lives and save families from devastation.”

Robbie Torney, senior director of AI programs at Common Sense Media, also told the hearing that AI companions shouldn’t be available at all to children below a certain age. Everyone on the panel at the very least agreed there needed to be strong safety measures in place if the tools are made available to children.

Cut through the noise.

Garcia’s story is becoming depressingly common. There’s no official count of how many children have been harmed, but OpenAI said in October 2025 that about 0.15% of users in a given week “have conversations that include explicit indicators of potential suicidal planning or intent,” and a Pew Research study indicated that about two-thirds of teens have used a chatbot. Taken together, that suggests a significant number of teens are discussing suicide with AI chatbots, not to mention engaging with sexual content, and there’s even more of a risk if those chatbots are manipulative. It’s little surprise then that Garcia’s prescription is gaining support from the public and increasing numbers of lawmakers.

Megan Garcia pictured with her son Sewell. Credit: Blessed Mother Family Foundation

The problem is, age gating AI might not be feasible, with both practical barriers and ethical concerns. Stopping children from accessing AI services effectively means assessing every user’s age, and doing that securely is a technological and logistical challenge. Not everyone has access to the information they need to provide their identity by all the age verification solutions available at all times, and managing all the data collected safely and securely isn’t easy. There are also important free speech issues, and privacy concerns about collecting sensitive data. Age verification creates a fragmented internet in the best cases, and risks infringing on constitutional rights in the worst, posing lawmakers with a challenging set of trade-offs.

“There’s no form of age verification that is not privacy invasive,” says Joe Mullin, a senior policy analyst at the Electronic Frontier Foundation. “There’s basically no perfect system. There’s no system that’s even close to perfect.”

Growing pains

Age gating is the theoretically simple practice of providing users with different experiences based on their age. What gets complicated is the implementation. The Children’s Online Privacy Protection Act, for example, restricts certain types of data from being collected on children under the age of 13 without parental consent, which is why most social media services require users to be 13 or older in the United States. But the “actual knowledge” standard set by the law has been interpreted to mean that ticking a box to confirm one’s age is sufficient for a company to treat the user as if they really are. Age gating is present in the law, but the law’s text and subsequent rulemaking has a massive loophole. When it comes to knowing someone’s age, services are effectively permitted to take their word for it.

In recent years, dozens of laws have been introduced at the state and federal levels to apply stricter age gating for social media, chatbots or both. The simplest of these calls for age “verification” — some process for confirming that a user really is over a certain age. How much responsibility a company has for blocking underage users based on data it may have collected on their behavior, or whether it must affirmatively check whether someone is above or below a certain age, varies and is often vague. The GUARD Act, for example, requires tech companies run users through a “reasonable age verification process,” while the Senate version of the Kids Online Safety Act (KOSA) requires technology companies block or limit the features available to minors if the company can estimate their age based on behavior.

The age verification industry uses specific, and slightly different, definitions for each tier. “Verification” typically means affirming a user’s age directly, often checking against a government ID. A looser standard is age “inference,” which involves linking some other account or service that proves a user is of age — for example, an active account for a credit card that requires being over the age of 18, or a pilot’s license.

Apple has also created a solution based on a birth date entered when setting up their device, with the expectation that a parent is involved, while Google pulls that information from data it already has. Both systems tell other apps and services that the user is above the age required without transmitting their precise birth date. This is technically a different type of age “assurance,” because the operating system is vouching that the user is of age rather than transmitting documentation that proves it. An array of third- party age verification providers do something similar, where they manage information about users and tell apps whether they fit the age requirements.

One of Apple’s age verification solutions. Credit: Apple

There is also a burgeoning field assessing age based on biometrics such as face scans or hand movements, and age “estimation,” where a tool assesses whether a user is above or below a certain age based on behavioral patterns, such as what they talk about or shop for.

Each of these methods come with pros and cons. Requiring government ID, for example, is fairly reliable for the users who can provide it, but excludes the 2.6m Americans who lack any government ID, and many of the 34.5m who don’t have an up to date one — disproportionately younger and people of color, according to a 2024 report from the University of Maryland’s Center for Democracy and Civic Engagement. Linking a credit card account is convenient, but only works if you have one that fits the criteria. Apple and Google’s systems have worked well so far, but Apple’s is flawed in that some children might be able to convince a parent or guardian to lie about their age when they set up their phone, while children can circumvent both with a burner phone. Estimation can also be tricky: as journalist Taylor Lorenz has said, “there’s no meaningful way to tell the difference between a 17 and a half year old and an 18 year old.”.

Without standardization, the user experience of the internet becomes fragmented. Some users will be able to fulfill some verification requirements, but not others. But a law that is too prescriptive can also make this worse, by not giving users enough options, or blocking out innovation as new ways of age verification are developed. The more often age needs to be verified, the more irritating the user experience can also become, raising barriers to entry for some products.

Different laws have different requirements for what kinds of technology is acceptable. The GUARD Act, for example, permits the use of any “commercially reasonable method” and the KOSA calls for a study into “technologically feasible methods” for age verification and their impacts on internet access, privacy and market competition. In New York, rules released by the New York Attorney General’s office require annual auditing of age verification tools, as well, assessing their accuracy and data management techniques.