Kids Bypass Age Checks: Drawing Mustaches Tricks AI

Children Easily Bypass Online Age Verification, New Report Reveals

A comprehensive new report from the UK-based non-profit Internet Matters reveals that children are effortlessly bypassing online age verification systems—sometimes by simply drawing a mustache on their face before taking a verification selfie. The study, which surveyed 1,000 children and their parents, found that nearly half of children (46%) consider age checks 'easy to bypass,' and one-third (32%) have successfully done so. The findings raise serious questions about the effectiveness of age verification technologies being rolled out worldwide under laws like the UK's Online Safety Act and similar legislation in the EU and US states.

How Children Outsmart Age Verification AI

The report documents a range of creative methods children use to circumvent age gates. One mother reported that her 12-year-old son passed a facial age estimation check by drawing a mustache on his upper lip with a makeup pencil before taking the required selfie. Other techniques include using a fake date of birth, pointing the webcam at an older sibling or a video game character with adult features, and using VPNs to mask location. In focus groups, children openly shared tips with peers on how to trick the systems.

Facial Recognition Weaknesses Exposed

Facial age estimation, which uses machine learning to guess a user's age from a selfie, is increasingly deployed by platforms such as Roblox and social media sites. However, the Internet Matters report shows these systems are vulnerable to simple physical modifications. The online safety for children measures that rely on such technology are proving inadequate. As one 12-year-old girl told researchers: 'If the AI detects that I'm not 18, I get banned for 10 minutes, and then I can try again.'

Parental Complicity and Awareness

Strikingly, the report found that 26% of parents admitted to helping their children bypass age verification checks, and 9% knowingly looked the other way. A quarter of surveyed parents said they consider it acceptable for their children to circumvent these controls. This suggests that parental digital literacy plays a significant role in the effectiveness—or lack thereof—of age verification regimes.

The EU Age Verification App: Hacked in Two Minutes

The problems are not limited to commercial platforms. In April 2026, the European Commission unveiled a new age verification app designed to let users prove their age anonymously. Security researcher Paul Moore bypassed the app's protections in under two minutes by editing a local configuration file. The app stored rate-limiting controls and biometric authentication settings as editable boolean flags—turning off biometrics was as simple as changing a 'true' to 'false.' The Commission initially dismissed the findings, calling it a demo, but the incident highlights a fundamental tension: age verification inherently links real identity to online actions, creating a target for hackers and surveillance.

Privacy advocacy group Proton commented: 'A watertight online age verification and guaranteed privacy are by definition incompatible. Because it requires a real identity to be linked to an online action.' The group warned that the EU's approach, modeled on COVID contact-tracing apps, is doomed to fail.

Privacy vs. Protection: The Core Dilemma

Hundreds of scientists signed an open letter earlier in 2026 warning that legislation is being rushed through while the technology is immature and the implications unclear. One father interviewed for the Internet Matters report raised the specter of phishing: if children are trained to scan their faces on every website, they will do the same on phishing sites, enabling identity theft. 'Then their faces and all their documents can be used for all kinds of illegal activities,' he said.

The EU Digital Services Act age verification requirements are pushing platforms to implement these systems faster, but the trade-offs between privacy and protection remain unresolved. Experts from the Center for Democracy & Technology have warned that poorly designed age verification could become a tool for surveillance and censorship.

Does Age Verification Work at All?

Despite the flaws, the Internet Matters report found that age verification does have some deterrent effect. A third of children said that when faced with an age check, they decided not to visit the site—either because it was too much hassle or because the check made them realize the content was intended for an older audience. Ofcom, the UK's online safety regulator, has launched nearly 100 investigations since the Online Safety Act came into force, and continues to push platforms for better compliance.

Comparison of Age Verification Methods

FAQ: Children and Online Age Verification

What is the Internet Matters report?

The Internet Matters report, published in May 2026, is a survey of 1,000 children aged 9–16 and their parents in the UK, assessing the effectiveness of age verification under the Online Safety Act.

How do children bypass age checks?

Common methods include entering a fake birth date, using a VPN, showing an older sibling's face to the camera, drawing on facial hair, or using video game avatars with adult features.

Is the EU age verification app secure?

No. Security researchers bypassed the EU's prototype app in under two minutes by editing local configuration files. The European Commission has since updated the code but experts remain skeptical.

What are the privacy risks of age verification?

Age verification systems collect sensitive biometric or identity document data. If compromised, this data can be used for identity theft, phishing, or surveillance. Privacy groups argue that true anonymity and effective age verification are mutually exclusive.

Does the UK Online Safety Act work?

Partly. While 68% of children report more safety features online, 49% still experienced harm in the past month. Age verification deters some children but is easily bypassed by determined minors.

Sources

Internet Matters: Online Safety Act Report 2026
USA Today: Kids draw mustaches to bypass age checks
TechCrunch: Kids bypass age verification with fake mustache
Proton: EU age verification app hacked
European Commission: Age verification app announcement