Table of Contents
Online Age Verification: How Kids Bypass It and Why It Matters
Kids routinely lie about their age to access social media and gaming platforms. Here's what verification actually looks like—and what new laws are changing.
Every parent who has asked their child “how did you even get on that app?” already knows the answer. Kids type in a fake birthday. That’s it. The entire age verification infrastructure for the world’s largest social media and gaming platforms often amounts to a single date field — and children as young as 8 know exactly how to use it. The gap between what platforms claim and what they actually verify is substantial, and the consequences range from mild (ads for adult products) to severe (exposure to predators, self-harm content, and financial scams). Understanding how this system works — and where it’s finally being forced to change — is the first step toward protecting your child.
Key Takeaways
- Most major platforms verify age through a self-reported birth date with no additional check, which children bypass in seconds.
- A 2022 Thorn study found 55% of 9–12-year-olds are active on at least one platform with a 13+ age minimum.
- COPPA requires verifiable parental consent for under-13 users, but enforcement has been inconsistent for over two decades.
- The Kids Online Safety Act (KOSA) and the UK Age Appropriate Design Code are driving meaningful platform design changes.
- Parents can check account ages on most platforms and place additional controls through device-level parental settings.
Why Age Gates Are Almost Entirely Decorative
When a child signs up for Instagram, TikTok, Roblox, or Discord, the platform displays a birth date field. If the child enters a year that makes them 13 or older, the account is created. There is no SMS confirmation tied to a parent’s number. No credit card cross-check (a method with its own flaws). No ID upload. Nothing.
This design choice is not accidental. Platforms built their user bases on frictionless sign-up, and adding real verification barriers reduces registration rates. Until recently, the regulatory cost of doing nothing was low. COPPA (the Children’s Online Privacy Protection Act, enacted in 1998) applies only to children under 13 who the platform knowingly collects data from. If a child claims to be 14, the platform is legally insulated. Platforms have exploited this loophole systematically.
A 2021 report by the UK’s Information Commissioner’s Office found that major platforms routinely failed to implement their own stated age assurance measures. An internal Facebook document leaked during the 2021 Senate hearings showed the company was aware that millions of under-13 users were on the platform but chose not to remove them because doing so would harm growth metrics.
What Children Actually Do to Bypass Age Verification
The methods children use are embarrassingly simple:
The birthday lie. Enter any birth year that makes you 13 or older. This works on virtually every platform without exception.
The parent account route. A child uses a parent’s account directly, or creates a new account using a parent’s email address and birth year.
The “school account” workaround. Some platforms require a school email. Children simply use personal or family email addresses instead, or use school emails their parents set up.
The app store loophole. If a parent’s app store account is not configured with Family Sharing or parental controls, a child can download 17+ or adult-rated apps directly.
Browser-based access. Even if an app is blocked on a device, many platforms offer full browser versions accessible with no additional verification on any device with internet access.
The 2022 Thorn study on digital safety found that 55% of children ages 9–12 reported being active on at least one platform that requires users to be 13 or older. Among 11-year-olds specifically, the number was over 65%.
What Happens When Under-13s Access Adult Platforms
The risks are not hypothetical. When a 10-year-old enters a platform designed and algorithmically tuned for adults, several things happen quickly:
Algorithmic amplification. Recommendation systems push content that maximizes engagement. For a child who watches one video about dieting, the algorithm escalates to progressively more extreme content about body image. The same pattern applies to violence, political extremism, and self-harm content.
Data collection without parental consent. Platforms collect behavioral data — every scroll, pause, like, and share — and use it for ad targeting. Under COPPA, this requires verifiable parental consent for under-13 users. Without proper age verification, this collection happens in violation of federal law, but the child has no protector inside the system.
Predator exposure. Platforms with messaging features expose underage users to direct contact from strangers. The National Center for Missing and Exploited Children (NCMEC) received 32 million reports of child sexual exploitation material in 2022, the majority originating on social media platforms.
Financial targeting. In-game currencies, gambling mechanics, and subscription traps affect children more severely than adults due to underdeveloped impulse control. See our deeper coverage of gaming in-game currency scams targeting kids for specific platform tactics.
The Legal Landscape: COPPA, KOSA, and the UK Code
COPPA (1998, amended 2013)
The Federal Trade Commission enforces COPPA, which prohibits collecting personal information from under-13 users without verifiable parental consent. Penalties can reach $51,744 per violation. The FTC has levied significant fines — including a $170 million settlement against Google/YouTube in 2019 and a $5.8 million settlement against TikTok (then Musical.ly) in 2019. But the “knowing” standard gives platforms substantial cover when they ignore obvious signals of underage use.
Kids Online Safety Act (KOSA)
KOSA passed the Senate in 2024 and has gained momentum heading into 2026. It would require platforms to implement default safety settings for minors, restrict algorithmic amplification of harmful content to children, and enable independent audits. Critically, it shifts the burden: platforms would have a duty of care toward minors rather than simply a prohibition on knowing collection.
UK Age Appropriate Design Code (Children’s Code)
The UK’s Information Commissioner’s Office issued this code in 2020, requiring that any service “likely to be accessed by children” must implement age assurance and apply default high-privacy, high-safety settings. Several major platforms have already redesigned their UK interfaces as a result, offering automatic content restrictions and limited messaging for accounts that appear to belong to minors.
| Law/Regulation | Jurisdiction | Key Requirement | Enforcement |
|---|---|---|---|
| COPPA (1998/2013) | United States | Verifiable parental consent for under-13 | FTC — civil penalties |
| KOSA (2024) | United States | Duty of care, default safety settings | FTC + state AGs |
| Children’s Code (2020) | United Kingdom | Age assurance + privacy by design | ICO — fines up to 4% global revenue |
| CCPA (2020) | California | Opt-out of data sale for under-16 | California AG |
| COPPA 2.0 (proposed) | United States | Extends to under-16, new data limits | FTC (pending passage) |
How Parents Can Check Account Ages
Most platforms do not expose account age in an obvious place, but they do store it.
Instagram/Facebook: Settings → Account → Personal Information → Birthday. If your child’s account shows an adult birthday, it was falsified. You can request account deletion or age correction through the platform’s help center.
TikTok: Profile → Settings → Manage Account → Birthday. TikTok introduced a “Family Pairing” feature that links a parent’s account to a child’s — this is worth setting up even for accounts with correct ages.
Roblox: Settings → Account Info shows the birth date. Roblox gates features by age: accounts registered as under-13 receive filtered chat and cannot access certain content categories. If your child’s Roblox account shows an adult age, switching it back requires contacting support with age verification documentation.
Minecraft/Xbox: Microsoft Family Safety allows parents to see and manage birth dates for family accounts and set activity limits and content filters.
Discord: Age is stored in user settings but is self-reported. Discord’s minimum age is 13. If your child is using Discord, family oversight is better handled through device-level monitoring than platform settings.
For any platform where you suspect an incorrect birth date and the platform won’t correct it, account deletion and recreation with the correct date (using Family Sharing or a supervised account type) is the most reliable fix.
What Better Age Verification Looks Like
Several approaches are in use or development:
Device-level verification. Apple and Google are exploring age verification at the operating system level, where a verified age on a parent account can pass to apps without apps collecting ID data directly. This preserves privacy while giving platforms a reliable signal.
Credit card proxies. Requiring a valid payment method at registration catches some younger children, but many have access to parents’ payment details or prepaid cards.
Document-based verification. Services like Yoti and AgeID verify government ID against a face scan and return only a binary pass/fail to the platform, without transmitting the ID itself. The UK Children’s Code is pushing adoption of this approach.
Mobile carrier age signals. Carriers hold verified customer ages and can provide a binary “is this account holder 18+” signal to third-party apps, similar to how 2FA works today.
None of these systems is perfect. Document-based verification raises privacy concerns about where ID data is stored and who controls it. Understanding these tradeoffs matters for parents engaged in the policy debate — and for families explaining to their teenagers why verification is a reasonable expectation, not surveillance.
What to Watch For Over the Next 3 Months
- KOSA implementation regulations are expected from the FTC in Q3 2026, which will clarify what “duty of care” means in practice for platforms.
- Apple’s Screen Time API update, rumored for iOS 20, may include parental age verification at the device level for app store downloads.
- TikTok’s restructured ownership situation in the US may trigger new COPPA compliance reviews by the FTC as part of any operating agreement.
- Watch for school district notifications about EdTech data collection: several state AGs are investigating student data shared with third-party advertisers through school-issued devices.
Frequently Asked Questions
Can I make my child’s account show the right age if they lied when signing up?
Most platforms allow age correction through account settings or customer support, but some require documentation. For platforms like Roblox and TikTok, contact support directly and explain the situation. If the platform won’t correct it, deleting the account and creating a new one with the correct age — ideally through a supervised or family account — is the cleanest solution.
Is it my child’s fault for lying about their age, or the platform’s fault for not checking?
Both. Children exercise agency in creating false accounts, and those conversations about honesty matter. But platforms bear institutional responsibility for designing systems that make lying trivially easy while reaping the advertising revenue from underage users. The legal and regulatory pressure is increasingly being directed at platforms, not children.
What does COPPA actually protect if kids can just lie?
COPPA’s protections kick in when a platform knows a user is under 13. If a child successfully lies about their age, the platform’s legal exposure is limited — which is precisely why advocates are pushing for laws like KOSA that require proactive age assurance rather than waiting for confirmation of known underage use.
My 11-year-old says all her friends are on Instagram. What do I actually do?
This is one of the hardest real-world parenting dilemmas. Options include: supervising an account used jointly with you, using a platform with better under-13 features (Messenger Kids, YouTube Kids), negotiating a delayed start date tied to a demonstrated behavior milestone, or acknowledging the social reality while adding device-level monitoring. There is no friction-free answer, but understanding the digital citizenship conversations around this helps frame it as a values discussion rather than just a rule.
About the author Ricky Flores is the founder of HiWave Makers and an electrical engineer with 15+ years of experience building consumer technology at Apple, Samsung, and Texas Instruments. He writes about how kids learn to build, think, and create in a tech-saturated world. Read more at hiwavemakers.com.
Sources
- Thorn. (2022). Safeguarding Children: 2022 Landscape Research. thorn.org
- Federal Trade Commission. (2023). Children’s Online Privacy Protection Act: A Six-Step Compliance Plan. ftc.gov
- UK Information Commissioner’s Office. (2020). Age Appropriate Design: A Code of Practice for Online Services. ico.org.uk
- National Center for Missing and Exploited Children. (2023). 2022 CyberTipline Report. missingkids.org
- Senate Commerce Committee. (2021). Protecting Kids Online: Facebook, Instagram, and Mental Health. commerce.senate.gov
- Steeves, V. (2023). Young Canadians in a Wired World: The Digital Lives of Schoolchildren. MediaSmarts Canada.
