Kids Are Beating UK's Age Verification With Fake Mustaches

The UK rolled out its Online Safety Act with the swagger of a country that had finally figured out how to protect kids online. Weeks later, teenagers are getting past facial age-verification systems by holding up fake mustaches, parent selfies, and screenshots of video game characters. It’s the kind of failure that would be funny if it weren’t also the future of digital ID.

What’s actually happening

Since late July, every adult-content platform serving UK users has been required to verify a visitor’s age. Three methods dominate: ID upload, credit card check, and the most contentious of all — facial age estimation. Vendors like Yoti and Persona scan a user’s face through a webcam and spit out an estimated age. No account, no document, just your face on camera.

The catch: it’s almost embarrassingly easy to fool. The workarounds circulating on TikTok and Reddit read like a comedy sketch:

• Hold up a selfie of an older sibling or parent
• Apply stage makeup, glasses, or a stick-on mustache
• Point the camera at Norman Reedus from Death Stranding, or any other photorealistic game character
• Use AI age-progression filters to add fake decades

The game-character trick got mentioned on the floor of Parliament. We have officially reached the point where video game graphics are good enough to launder identity — a milestone nobody asked for.

Why face-based age estimation was always going to break

Facial age estimation isn’t new. The accuracy is the problem. Vendors love quoting average error rates of 1.5 to 2 years, but averages hide everything that matters. A 16-year-old and a 19-year-old are visually indistinguishable in most lighting. Throw in makeup, beard stubble, or a bad webcam, and the spread can stretch to a decade.

There’s a deeper issue underneath the accuracy debate: the system has no reliable way to verify that the face on camera belongs to the person sitting in front of it. Liveness detection helps catch held-up photos, but it can’t tell the difference between a 14-year-old in costume and an actual adult. The face is real. The age is the lie.

The adults are the ones running for VPNs

Here’s the twist nobody saw coming, except everyone who’s ever watched a tech policy roll out: the biggest behavioral shift hasn’t been from kids. It’s been from adults. UK VPN downloads jumped roughly 1,400% in the days after the law took effect. Proton reported single-day signup volume eighteen times its baseline.

The reason is obvious once you say it out loud. Very few adults want to hand a porn site a scan of their driver’s license or a high-resolution capture of their face — especially after a year that included multiple breaches at exactly these kinds of verification vendors. So the law has accomplished something quite specific: it has degraded privacy for the population that wasn’t the problem, while leaving the original target audience to swap mustache tutorials in group chats.

When you try to solve a social problem with a face scanner

The pattern here is familiar to anyone who watched the US fight over COPPA, Australia’s social media ban, or the EU’s chat-control debates. The intention is defensible. Kids shouldn’t stumble into adult content. But facial recognition is the wrong tool for a problem that is fundamentally about parenting, education, and platform design. Policymakers wrote the law on the assumption that AI would quietly handle enforcement. The market answered with stick-on facial hair.

The worrying part isn’t the failure itself — it’s the likely response. Laws like this rarely get repealed when they don’t work. They get escalated. Expect the next round to push mandatory ID upload, then digital identity wallets, then integration with the EU’s eIDAS-based identity stack. The endgame is an internet where anonymity is the exception rather than the default, justified by a problem the original system couldn’t actually solve.

The lingering question

Every country that has tried to gate the internet by age has watched the gate get walked around. South Korea’s gaming shutdown law, Australia’s encryption bills, COPPA in the States — all of them produced workarounds within weeks. The UK is just the latest data point in a long series.

If your child-protection regime collapses against a costume-shop mustache, the problem isn’t enforcement. It’s the premise. Maybe the answer was never going to come from a webcam and an AI model — maybe it was always going to come from the slower, less photogenic work of media literacy and conversations at the kitchen table. Less satisfying as a press release. Probably more effective in practice.