Online age verification is technically achievable, already in use, and will need to form part of any serious Canadian legislative response to online harms affecting children, whether that is a ban on social media or the enforcement of age-appropriate design. This research note examines the current state of age verification technology and practice, drawing on the experience of adult content platforms operating under the United Kingdom's Online Safety Act 2023. The note further outlines a number of policy implications for Canadian policy makers.

Seven distinct methods of age assurance have been recognized as compliant under the UK framework: facial age estimation, photo ID matching, digital identity services, credit card and open banking checks, mobile network operator verification, and email-based estimation. No method is perfect, and policy makers should not expect one to be. Methods that rely on an existing financial or contractual relationship are generally more straightforward to implement but are unsuitable where the relevant threshold falls below contracting age, as it would under proposed under-16 social media restrictions. Facial age estimation is currently the most inclusive option for all age groups, but its accuracy is best evaluated through independent testing rather than vendor claims, and it depends on a robust data-protection regime to address the privacy implications of biometric processing.

The paper identifies a number of genuine trade-offs on the journey to policy adoption. Privacy and anonymity concerns are real, particularly for photo ID and biometric methods, and can only be partially addressed through data minimization and accredited third-party providers. With respect to age verification driving users to less safe services, the evidence is mixed: adult VPN uptake and use has been significant in some jurisdictions, but there is no corresponding evidence of increased VPN use among children. Freedom of expression and children's rights, including the risk of exclusion and the chilling of lawful, sensitive uses, must be addressed explicitly in framework design.

The UK's enforcement record, and Australia's early experience with its social media age ban, together suggest that compliance is achievable but depends heavily on platform cooperation and regulatory capacity. For Canada, age verification requires a broader legislative architecture than is currently in operation — including a privacy regime, an independent regulator, and a Child Rights Impact Assessment — not a standalone technical fix. Age verification is one instrument among several, and how it is designed and governed will matter as much as whether it is adopted.