Meta's $18B settlement makes age verification your problem

Age verification just stopped being someone else's compliance problem. Meta agreed to an $18 billion settlement with 52 state attorneys general, and almost every remedy in it depends on knowing which accounts belong to minors. TechCrunch reported the uncomfortable part: the technology that does that knowing is, by expert account, not good.

That gap matters to you even if you will never build anything at Meta's scale. It sets the default pattern that everyone else copies.

---

🔍 What Meta actually agreed to build

The settlement is not a cheque. It is a product spec, running 10 years, applied across Instagram and Facebook. The changes only work if the platform can correctly separate minors from adults.

Remedy	Trigger condition
Two-hour default daily screen limit	Account identified as a minor
"Be intentional" prompt every 15 minutes	Account identified as a minor
App blocked overnight, midnight–6 a.m.	Account identified as a minor
Notifications muted 8 a.m.–3 p.m.	School hours, minor accounts
Like counts hidden by default	Teen accounts

Every row has the same dependency in the right-hand column. Age classification is the load-bearing wall of the whole deal, and it is the one component nobody has built well.

Jessica Nall of Withers told TechCrunch that spreading the figure over a decade makes it much softer than the headline suggests. Divide it yourself: roughly $1.8 billion a year. The engineering obligation is the real cost here, not the payment.

---

⚠️ Three ways to check age, three ways to fail

TechCrunch lays out the available methods, and Dr. Alexis Ingber of Syracuse University is quoted assessing the current state of the technology as not really effective. That is a researcher's polite phrasing for "this does not work."

Method	What you collect	Failure mode
Biometric selfie scan	A face	Estimates age from appearance; wrong at the boundaries, and a leaked face cannot be reissued
Government ID check	A full identity document	Maximum accuracy, maximum breach blast radius
Behavioural analysis	Usage patterns	Misclassifies real users; opaque; no way for a user to appeal

Key takeaway: A password breach costs a user one password reset. A biometric breach costs them a face they keep for life. These are not the same category of risk, and treating them as interchangeable "PII" in your threat model is the mistake.

The user reaction is already documented. Discord delayed a rollout in early 2026 after backlash. People do not want to hand a chat app their driving licence, and they are right not to want that.

---

🛠️ The rule that fixes most of this: derive, then discard

Here is the part small teams get wrong, and it is fixable in an afternoon.

Most age gates answer "who is this person?" when the requirement is only "is this person over 18?" Those are very different data footprints. The first creates a database worth stealing. The second creates a boolean.

Philip Yannella of Blank Rome makes roughly this point in the article: age assurance is implementable with substantially lower privacy exposure. The technique is old and boring:

1. Collect the evidence client-side only.
2. Compute the answer in the browser.
3. Transmit the answer, never the evidence.
4. Store the boolean with a timestamp. Store nothing else.

If your server never receives the ID number, your server cannot leak the ID number. There is no encryption strategy, access-control policy, or retention schedule that beats simply not having the data.

---

🇱🇰 Sri Lanka has an unusually clean version of this

This is where Sri Lankan builders have a structural advantage that not enough local teams use.

The Sri Lankan NIC number encodes date of birth in the number itself. No lookup, no API call, no government integration. The format is public:

• Old format (pre-2016): YY DDD SSS C plus a V or X suffix — 9 digits and a letter.
• New e-NIC (2016+): YYYY DDD SSSS C — 12 digits.
• In both, DDD is day-of-year. If DDD is above 500, subtract 500 and the holder is female.

So an age check is arithmetic, not infrastructure:

// Runs in the browser. The NIC string never leaves the device.
export function isOver(nic: string, minAge: number, today: Date): boolean {
  const digits = nic.replace(/[^0-9]/g, "");
  const isNew = digits.length === 12;
  const year = Number(digits.slice(0, isNew ? 4 : 2));
  // Old-format NICs stopped being issued in 2016 and required the holder to
  // be 16+, so a 2-digit year almost always means 1900s. Confirm this against
  // your own user base before trusting it at the boundary.
  const fullYear = isNew ? year : 1900 + year;

  let dayOfYear = Number(digits.slice(isNew ? 4 : 2, isNew ? 7 : 5));
  if (dayOfYear > 500) dayOfYear -= 500; // female offset

  const dob = new Date(fullYear, 0, dayOfYear);
  const age = (today.getTime() - dob.getTime()) / 31_557_600_000;
  return age >= minAge; // send this. Send nothing else.
}

Two warnings. The Department for Registration of Persons has never published the NIC check-digit algorithm, so you can validate structure but not authenticity — do not imply otherwise to users. And this proves a claimed age, not a verified one; a teenager can type a parent's number. It is a speed bump, which is fine as long as you call it one.

If you want to see the decode logic behave against real inputs before writing your own, our Sri Lanka NIC decoder does exactly this parse in-browser and shows you every extracted field.

Sri Lanka's Personal Data Protection Act is the local backdrop, and I would read the current text rather than any summary of it, including this one. The direction of travel is the same everywhere: collecting less is the only strategy that ages well.

---

💡 What this means for you

Treat this settlement as an early warning rather than US news.

• Audit what you already store. If you have a date_of_birth column and your product only ever asks "is this user an adult?", you are holding a liability that earns you nothing.
• Move the computation to the client. Send booleans, not documents.
• Never store a raw biometric to answer a yes/no question. The asymmetry between what you gain and what a user loses in a breach is enormous.
• Write down your error rate. Every age system misclassifies someone. Publish an appeal path before a regulator makes you.
• Assume this arrives as a platform requirement. App stores and payment processors push these rules downstream long before local law does.

Bottom line: Meta is paying $18 billion for outcomes that depend on a component the experts in the same article say doesn't work well. You do not have $18 billion. Your protection is to build systems where being wrong is cheap — and the cheapest way to be wrong is to never have held the data in the first place.

For a sense of how differently the big platforms already handle this, the AI chatbot age requirement checker lists the minimum ages the major assistants actually enforce, and the AI data privacy comparison covers what each one does with what you hand it.