idw – Informationsdienst Wissenschaft
Nachrichten, Termine, Experten
Nachrichten, Termine, Experten
A comprehensive analysis of age assurance technologies co-authored by CISPA-Faculty Dr. Wouter Lueks concludes that many currently proposed systems for protecting minors online come with significant trade-offs for privacy, security, accessibility, and civil liberties. The study “Assessing Age Assurance Technologies: Effectiveness, Side-Effects, and Acceptance” conducted together with colleagues from the University of Hamburg and the Leibniz Institute for Media Research, evaluates a broad range of approaches currently being debated by policymakers and platforms worldwide.
Age assurance technologies (AATs) recently attracted significant public attention in the debate around online child protection. “There is a belief in society that we need to protect children from online harms,” explains CISPA-Faculty Dr. Wouter Lueks. “While this debate used to focus mostly on age-restricted content such as gambling and pornography, it has expanded to include a broader range of services, including social media services and other forms of potentially harmful content.” Against this backdrop, Lueks and his colleagues analyzed different technological architectures and regulatory approaches emerging across Europe, the United Kingdom, and other jurisdictions. While some of the analyzed approaches can provide a high level of security, the study finds that stronger forms verification often come with greater societal costs.
Differentiating AAT Approaches
In the paper, the authors distinguish four different approaches to age assurance: parental control and consent on devices, age estimation, age inference, and age verification. In the first approach, parents configure a child’s device to block or approve access to specific apps or websites. Lueks explains that “age inference uses systems to analyze behavioral patterns, possibly over time, to infer a user’s age.” In contrast, “age estimation uses systems to analyze a selfie or other information to estimate someone’s age.” Age verification, meanwhile, relies on official documents or trusted sources to determine a user’s age. The researchers find that these approaches differ significantly not only in how reliably they can determine a user’s age, but also in their implications for privacy, security, accessibility, and fundamental rights.
Unintended Consequences and Harmful Side Effects
The findings of Lueks and his colleagues suggest that stronger age-assurance measures often come with broader societal burdens. Depending on the approach, these may include the collection and storage of sensitive personal or biometric data, increased tracking and profiling of users, the exclusion of people without suitable identity documents, and biased or inaccurate assessments. Age inference systems in particular, which analyze online behavior to determine a user's age, risk normalizing large-scale surveillance while providing only limited assurance. Moreover, with the exception of parental control and consent, none of these approaches effectively prevents circumvention through the use of VPNs. As a result, no single solution emerges as universally preferable across all use cases. A broader concern is the potential for censorship. “Right now, the stated goal is to protect children from harmful content, such as social media,” Lueks explains. “Tomorrow, the same systems could be used to restrict access to online games, LGBT content, political material, or books.”
Lighter-weight Solutions to Prevent Harm for Everyone
Based on their assessment, Lueks and his colleagues urge policymakers to carefully distinguish between age assurance systems, rather than treating them as equally acceptable or equally effective. Instead, they propose a graduated assessment framework that weighs effectiveness against societal side-effects and impacts on fundamental rights. “Because these systems affect everyone and are relatively easy to circumvent, we argue for lighter-weight solutions,” Lueks says. “Our first preference is Parental Control and Consent on Device.” This may not be perfect, but it has fewer negative externalities because it does not affect everyone universally. “A second possibility is privacy-preserving on-device age verification as a second line of defense,” he continues. “Our third preference is credential-based wallet solutions with strong privacy guarantees.”
Lueks emphasizes that his goal is not to reject child protection measures in general: “Protecting minors online is essential. But measures must be proportionate, privacy-preserving, and realistically deployable at scale without creating new harms to the whole population.” The authors stress that technical measures alone are unlikely to fully solve the underlying societal challenges surrounding minors’ online experiences. According to the researchers, effective child protection will require a broader combination of technological safeguards, platform responsibility, parental support, education, and public policy. The paper enriches the debate by providing a fundamental analysis of the advantages and disadvantages of current technological solutions.
Dr. Wouter Lueks
CISPA Helmholtz Center for Information Security
Stuhlsatzenhaus 5
66123 Saarbrücken, Germany
lueks@cispa.de
Lueks, Wouter, Dreyer, Stephan, Federrath, Hannes, and Simon, Judith, “Assessing Age Assurance Technologies: Effectiveness, Side-Effects, and Acceptance”, arXiv e-prints, Art. no. arXiv:2603.25695, 2026. doi:10.48550/arXiv.2603.25695.
https://cispa.de/en/interview-lueks
CISPA-Faculty Dr. Wouter Lueks in Conversation
Source: David Rohner
Copyright: CISPA
Criteria of this press release:
Journalists, all interested persons
Information technology, Media and communication sciences
transregional, national
Research results, Transfer of Science or Research
English
CISPA-Faculty Dr. Wouter Lueks in Conversation
Source: David Rohner
Copyright: CISPA
You can combine search terms with and, or and/or not, e.g. Philo not logy.
You can use brackets to separate combinations from each other, e.g. (Philo not logy) or (Psycho and logy).
Coherent groups of words will be located as complete phrases if you put them into quotation marks, e.g. “Federal Republic of Germany”.
You can also use the advanced search without entering search terms. It will then follow the criteria you have selected (e.g. country or subject area).
If you have not selected any criteria in a given category, the entire category will be searched (e.g. all subject areas or all countries).
