You are being asked, more and more, to prove your age to a machine. A porn site wants to know you’re 18. A social platform wants to know you’re 16. Now even a general-purpose chatbot wants to form a view about whether you’re a minor. In almost none of these cases does the machine actually know how old you are. It guesses — and the quality of that guess, and the way its errors are shared out, is one of the more consequential and least examined pieces of AI now being wired into everyday life.
Answer first: AI age estimation turns your face or your behaviour into a statistical estimate of your age. In the fat middle of the age range it’s often decent. At the edges that legislation actually cares about — is this person 18? — it’s at its weakest, with independent testing finding error “buffer zones” two to three years wide around each threshold. And those errors don’t fall evenly: they cluster on some demographic groups more than others. That makes age estimation not just an accuracy story but a bias one, and the two are easy to confuse.
Two ways a machine guesses your age
“Age assurance” is the umbrella term, and underneath it sit two genuinely different things. Age verification checks you against something authoritative: a passport, a driving licence, a credit-card or bank record. It aims to know. Age estimation aims only to guess well, without demanding a document.
Estimation itself comes in two main flavours. The one people picture is facial age estimation: you look into a camera, and a model trained on huge numbers of face-and-age pairs outputs a predicted age or age range. The other, quieter flavour is behavioural or contextual inference — guessing age from how an account is used rather than from a face. That’s the approach behind ChatGPT’s new age prediction, which reads signals like the topics you raise and the times you log in. Different inputs, same underlying move: take some observable data, and infer a protected characteristic from it.
Estimation is not the same as knowing
The single most important thing to understand is that an age estimate is a probability, not a reading off a birth certificate. A facial model doesn’t retrieve your age; it maps the pixels of your face onto the patterns it learned and returns its best statistical bet. The standard way to score how good that bet is is mean absolute error — on average, how many years off is it?
By that measure the technology is more capable than its critics sometimes allow. Australia ran one of the largest independent evaluations to date — its 2025 Age Assurance Technology Trial tested more than 60 solutions from 48 providers — and found that the best facial systems could achieve a mean absolute error of around a year in controlled conditions. If all you need is to sort obvious adults from obvious children, that’s workable.
The trouble is that the law rarely cares about the obvious cases. It cares about the boundary — 13, 16, 18 — and the boundary is exactly where estimation is shakiest. The same Australian trial described “buffer zones” of roughly two to three years on either side of each age gate, within which false positives and negatives cluster. Put plainly: a system that’s a year off on average will, near 18, routinely read a 20-year-old as 17 or a 16-year-old as 19. The tool is least reliable at the one number it’s being deployed to enforce.
Age estimation is most accurate where nothing is at stake and least accurate at the exact threshold the law asks it to police. The uncertainty isn’t a rounding error; it’s concentrated precisely where the decision gets made.
The errors don’t land evenly — the bias problem
If the inaccuracy were spread uniformly across all faces and all behaviours, it would still be a problem, but a tidy one. It isn’t. The Australian trial found that while systems generally performed well across diverse users, some showed reduced accuracy near policy thresholds for non-Caucasian users, for female-presenting individuals, and for older adults. NIST, the US standards body whose ongoing Face Analysis Technology Evaluation is the closest thing the field has to a referee, keeps reporting the same shape: leading algorithms have narrowed the gaps, but demographic differentials in error rate persist.
This is the part that turns an engineering limitation into a fairness question, and it’s the same mechanism we’ve written about before — that algorithmic bias is not a glitch but a predictable product of skewed training data and uneven evaluation. Age-estimation models learn from whatever face-and-age data they were fed; where a group is under-represented or its ageing patterns are less well modelled, the error rate climbs. Researchers have traced this to at least two compounding sources: bias baked into the data the model learned from, and bias in how “age” itself was labelled and perceived across different populations in the first place.
The practical upshot is stark. If a system is systematically more likely to misjudge, say, darker-skinned or female-presenting faces at the 18 line, then the people wrongly blocked from an adult service — or wrongly forced to escalate to an ID check to prove themselves — are disproportionately drawn from those groups. A tool sold as a neutral gate becomes a gate that’s stiffer for some than for others.
And the stakes climb with the setting. Age estimation isn’t confined to keeping teenagers off adult sites; investigations such as Lighthouse Reports’ work on AI used to assess asylum seekers’ ages show what happens when the same fallible guess is pointed at people with the most to lose and the least recourse — where a mislabelled year can redirect the course of a life. When the error bars are demographic, deploying the technology on already-marginalised groups compounds the exact unfairness the trials keep measuring, rather than cancelling it out.
Guessing age without a face is even harder to check
Facial estimation at least has a testing ecosystem around it — NIST, national trials, published error rates you can argue about. Behavioural inference, the approach that guesses your age from how you use a service rather than what your face looks like, has almost none of that scaffolding, and it is the approach spreading fastest inside consumer apps. When a chatbot infers you’re a minor from “the general topics you talk about” and your login times, there is no NIST benchmark for that particular model, no independent error rate you can look up, and often no clear signal to you that a judgement was made at all.
That opacity cuts two ways. The signals are proxies — correlations between behaviour and age that hold on average and break for individuals — so the night-owl adult and the articulate fifteen-year-old are both misread by design. And because the inference runs continuously on your activity rather than as a discrete check, it is a standing judgement that can silently re-evaluate you at any time, not a one-off gate you passed and forgot. A facial check is at least a moment you can see and consent to. A behavioural age-score is a weather system sitting over your account, and you are rarely told when it changes.
Why the law is suddenly demanding it
None of this has slowed deployment, because the pressure isn’t coming from whether the technology is ready. It’s coming from legislation. In the UK, the Online Safety Act requires services with adult content to use “highly effective age assurance,” and Ofcom’s guidance — with a compliance deadline of 25 July 2025 — explicitly names facial age estimation as one of the methods that can qualify, alongside open banking, mobile-network checks and photo-ID matching. Notably, Ofcom says self-declaration (“tick here to confirm you’re 18”) is not good enough. Australia’s move to keep under-16s off social media prompted the very trial whose numbers we’ve been quoting. Similar requirements are landing across the EU and a growing list of US states.
To its credit, Ofcom’s test for “highly effective” is not just accuracy: it asks whether a method is technically accurate, robust, reliable and fair. Fairness is written into the standard. The gap is between that standard on paper and the demographic error patterns the trials keep finding — which is precisely why “we use facial age estimation” is a claim to interrogate, not a box to tick. This is the same tension running through the wider effort to regulate AI: the rule can be sound while the implementation quietly fails the people it’s meant to treat evenly.
The privacy trade nobody quite voted for
Age estimation is often sold as the privacy-friendly option, and relative to uploading your passport to every website, it can be. Facial age estimation done well processes the image on the fly and doesn’t store it; behavioural inference avoids the camera entirely. That’s a real advantage over a world where every age gate demands government ID.
But two catches sit underneath the pitch. First, “non-intrusive” still means a machine is scanning your face or profiling your activity to derive a fact about you — a quieter form of the same data hunger behind why every AI wants your data. Second, and more subtly: because estimation is unreliable in the buffer zone, the standard recommended fix is to fall back to full verification when the model isn’t confident. That sounds sensible until you notice who ends up in the buffer zone — young adults, and disproportionately the demographic groups the model is worst at. The people the system is least sure about are exactly the ones it pushes hardest toward handing over an ID. The “privacy-preserving” method routes its own failures straight back to the intrusive one.
What responsible age assurance would look like
This isn’t an argument that age checks are illegitimate or that the technology should be junked. It’s an argument for reading the specifics. A defensible deployment tends to share a few features:
- Honest buffer zones. It treats the two-to-three-year band around a threshold as uncertain by design, rather than pretending a single guess is a verdict.
- Published error rates, broken down by demographic. If a provider won’t tell you how differently the system performs across groups, that silence is the finding.
- Data minimisation. Estimate on-device or on-the-fly, don’t retain the face image, and don’t quietly repurpose age signals for advertising or profiling.
- A real appeal path. A wrong guess should be cheap and quick to correct, and the cost of the error should sit with the operator, not the misclassified user.
- Verification as a genuine fallback, not a trap. If the system is unsure, the escalation to ID should be rare and proportionate — not the predictable fate of everyone near the line.
Guessing a stranger’s age from a photograph or a usage pattern was always going to be hard, and doing it at the scale the law now demands makes the hard parts systemic. The technology can be part of a reasonable answer to a real problem — keeping the sharpest content away from children. But the honest version publishes its error bars, owns its demographic gaps, and treats a wrong guess as its own bug to fix. The version to worry about is the one that presents a probability as a fact, hides who it’s wrong about, and hands the bill for its mistakes to whoever the model happened to misread.
Originally published at theaidownside.com — evidence-first reporting on the costs and trade-offs behind AI products.
