To be clear, I’m not advocating for online age verification. I’m very much against it in any form. I’m just curious from a technical standpoint if it’s possible somehow to construct an accurate age verification system that doesn’t compromise a user’s privacy? i.e., it doesn’t expose the person’s identity to anyone nor leaves behind a paper trail that can be traced to that person?
There are tonnes of ways but honestly, the easiest way is to do it at the ISP level. Have an internet connection you don’t want used for adult material? Have an opt in service at the ISP to block XXX rated sites and maybe social media. If you are old enough to pay for your own internet you should not be required to jump through hoops to access what you want, but kids should not be thrown onto the internet without guardrails. Some kids will get around it but it would be an active choice, so most kids would not. And to be clear, this would be done at the ISP level where you already have verification of age built in to billing, so no additional privacy concern. Honestly, the fact that this is not the solution is what tells me all of this filtering is not about protecting kids, it is about centralisation and control along with pork barrelling for age verification companies.
Nope, you always need a middle man to do the verification. That middle man has too much information.
Also, if you could solve for the middle man, there is no way to know the user belongs to the ID. It can easily be stolen.
I figured you were wrong so I asked an AI and it confirmed what the people below you were saying, you really do seem to be talking straight out of your ass
Yes, it is technically possible to build an accurate, high-confidence age-verification system that does not compromise privacy in the traditional sense (i.e., no central database of IDs, no name/address/DOB stored by the site, no paper trail that can be subpoenaed or leaked). The core tool that makes this feasible is zero-knowledge proofs (ZKPs), specifically age-based ZK proofs.
How a privacy-preserving age check actually works in 2025
- User proves age to a trusted credential issuer once
-
- Government digital ID (e.g., EU eIDAS wallet, some U.S. mobile driver’s licenses, Yoti, ID.me, etc.)
- The issuer cryptographically signs a statement like “This private key belongs to someone born before 2007-11-27” without ever revealing the exact birthdate. User generates a zero-knowledge proof
-
- Using their phone or browser, they create a proof that says:
“I have a valid credential signed by [Trusted Issuer] that confirms I am 18+ (or 21+).” - Nothing else is revealed: no name, no exact age, no birthdate, no issuer identity if you want to go fully anonymous. Website verifies the proof in <1 second
- The site checks the cryptographic signature and that the policy (“18+”) is satisfied.
- It learns literally nothing else about the person.
- Using their phone or browser, they create a proof that says:
Real-world implementations that already exist or are in late-stage pilots (November 2025):
- Worldcoin’s World ID “age 18+” orb-verified credential + ZK proof
- Polygon ID / zkBridge systems used by some adult sites
- SpruceID + Ethereum Attestation Service kits
- Gitcoin Passport + ZK age attestations
- Proof-of-Humanity + age minimum circuits
- Yoti + ZK prototype (demoed 2024–2025)
Remaining practical hurdles (why it’s not universal yet)
- User has to have a compatible digital credential in the first place (adoption still <30% in most countries)
- Friction: first-time setup takes 2–10 minutes instead of 3 seconds
- Most adult sites don’t want to pay the (tiny) gas/verification fee or integrate the SDKs
- Regulatory gray zone in some jurisdictions that still mandate “know your customer” records
Bottom line
Technically: Yes, 100% possible today with zero-knowledge age proofs.
Practically: It exists, works, and is slowly rolling out, but the porn industry and most social platforms still prefer cheap/frictionless (but privacy-invasive) methods or just do nothing.So the top reply in your screenshot (“you always need a middle man with too much information”) is outdated — cryptography has already solved the “middle man” problem. The real blocker now is deployment inertia, not theory.
The big flaw in this strategy is that once you have set up a signed anonymous key from the government and you can make zero knowledge proofs with it, there’s nothing stopping you from distributing that key to every kid who wants it. If it’s in the browser or an app, etc. you can publish that signed key for anyone who wants to be over 18.
PKI only works if the owner of the private key wants it to be private. It’s effective for things like voting or authenticating because the owner of the key doesn’t want anyone else to be able to impersonate them. But if it’s only for age…
At that point, it might as well just be a file that says “I pinky promise that I’m over 18” that the government has signed and given to you.
Could tie it to something like a biometric. That and storing it on a write-only device would keep it from being shared too wide. The trickiss to tie it to a true multi-factor and not just something you have (if unencrypted) or something you know (if ASCII armored).
