Before You Prove Your Age: Who Actually Handles Your Data?

At 10:18 p.m., I was trying to open a Reddit thread about a cycling accident. The photographs were unpleasant, but they showed the exact kind of damage I had found on my helmet after a fall. Instead of the discussion, I got an age prompt.

I entered my birthdate, expecting the page to continue. It did not. The next screen offered an Apple-based check, a facial selfie or a photograph of government ID.

I reached for my passport, then stopped with it halfway out of the drawer. The screen kept saying Reddit would not see the document. It said much less about who would.

The prompt had not appeared by accident. Stronger age checks for UK users began taking effect across services carrying pornography and other material considered harmful to children in July 2025. What started as a gate around obviously adult content has since become part of a wider system involving social platforms, app stores and account providers. (Ofcom)

That explained why I had been stopped. It did not answer the more immediate question: how many companies would become involved if I continued?

Public discussion around the rollout often returned to the same concern. People were not necessarily objecting to proving that they were adults; they were uncomfortable connecting a passport, face or long-standing device account to pseudonymous browsing. (Reddit)

That was exactly what bothered me. I was not trying to conceal my age. I was trying to avoid turning one ordinary page view into a new identity record.

The company showing the prompt may not be the company checking you

An age-verification screen makes the process look like a conversation between two parties: you and the website.

In practice, there may be several.

The website decides when an age check is required. A specialist verification company may inspect the selfie or identity document. Apple, a bank, a card processor or a mobile provider may supply another signal. The result then travels back to the website, which may store it against the account.

These organisations do not necessarily receive the same information.

Reddit’s current process shows how that separation works. A user can share an age range through Apple or complete a Persona check using a selfie or government ID. (Reddit)

So “Reddit does not see your passport” can be true while another company still handles it.

With a selfie check, the verification provider needs the facial image used to estimate age. With a document check, it processes the identity document and extracts the information needed to confirm the user’s age. A matching selfie may also be requested to show that the document belongs to the person holding it.

Other methods simply move the sensitive step elsewhere. A card check brings in a payment processor. Open banking asks a bank to confirm an age-related fact. A mobile-network check relies on information held by a carrier. The website may receive only “over 18,” but another organisation must produce that answer first. (Ofcom)

This separation can be useful. A discussion forum does not need a passport number when all it wants is an adult-or-child result. Yoti, for example, says its facial-age-estimation service deletes the selfie after returning an estimate and does not send the image to the requesting website. (Yoti)

But that still leaves a choice before the user: whether the page is worth creating the verification event at all.

The easiest option still created a new link

I put the passport away and looked at the Apple option.

It appeared less intrusive. I would not need to photograph a document or send my face to a verification provider. Reddit would receive an age range rather than the full evidence behind it. (Reddit)

Then the screen asked me to continue through the Apple account already connected to my phone.

Apple already knew the device. That was not the issue. The issue was that I was being asked to connect a pseudonymous Reddit account to a long-standing platform identity in order to read one thread.

It was a smaller disclosure than uploading a passport, but it was still a new link.

I cancelled the process and reopened the page in a private browser window. The prompt remained.

Reddit says its age decisions may also use signals such as account age, activity, subscriptions, email domain, app-store information and previous verification status. (Reddit) I could not observe its internal age-classification or filtering rules. (Reddit)

By then, the original question had changed.

I was no longer asking which verification method collected the least data. I was asking whether I needed to enter the verification chain at all.

My familiar VPN replaced the age check with another test

I already subscribed to a major VPN. It had years of public history, a large support operation and more locations than I would ever need. Using it felt more proportionate than involving a passport, face or Apple account.

I opened the app, signed in and selected a nearby European location. Then I returned to the Reddit thread in a private window.

The age prompt disappeared.

A security challenge took its place.

I completed it. The page refreshed and presented another. When the thread finally opened, several images remained grey. I switched servers and received an unusual-traffic warning instead.

The provider had changed the location Reddit saw, but its heavily shared route had created a second negotiation. I was no longer proving my age. I was identifying traffic lights and shop fronts to prove that I was human.

That failure clarified what I actually needed.

I did not need the largest server map. I needed a clean route to one page without adding another identity account or triggering a sequence of security checks.

The smaller app asked for less before it connected

OnlydogVPN had an obvious disadvantage beside the established service: fewer locations, a shorter public history and a much smaller body of independent reviews.

Its advantage appeared before I chose a route.

Basic use did not require a conventional email-and-password account.

That fitted the problem unusually well. I had already refused to connect Reddit to my passport, selfie and Apple identity. Creating another durable login before solving the problem would have placed one more company and one more account into the same chain.

The app presented options based on situations rather than a long list of countries and protocols. I chose the option intended for a difficult or restrictive connection and reopened the original thread.

The page loaded.

The photographs appeared, followed by the discussion I had been trying to read. There was no age prompt, no second account registration and no CAPTCHA loop.

Only after the page was open did the transport design matter. The service uses HTTP/3-based connections with additional obfuscation, helping the route avoid some of the recognisable patterns associated with conventional VPN traffic. I did not need to choose a protocol or test locations one by one. The app turned that technical decision into a simple task choice.

More importantly, it completed the task without asking me to produce new identity evidence.

I had not sent a face to an estimation provider. I had not photographed my passport. I had not asked Apple, a bank, a card processor or a mobile carrier to confirm my age. I had also avoided creating another email-based VPN account.

That was the result I had been looking for.

After reading the thread, I opened the helmet-replacement guidance linked beneath it. A blocked-request counter in the app began to rise as advertising and tracking requests were filtered in the background.

It was a smaller discovery, but it followed naturally from the same concern. The age prompt had made one request for personal information impossible to ignore. The counter made the quieter requests surrounding an ordinary browsing session visible too.

A short data chain can matter more than a strong deletion promise

Age-verification systems can be designed responsibly. Separating the identity evidence from the requesting website is better than allowing every platform to collect and store passports or facial images. UK privacy guidance also requires age-assurance providers to limit collection, protect the information and explain how it is used. (Org)

But those protections begin after the user enters the chain.

The website may not receive the selfie, but the verification provider does. The provider may not receive card details, but a payment company processes them. Apple may share only an age range, but the result still connects two existing accounts.

The Apple route reduced document exposure but created a new identity link. The established VPN avoided verification but introduced repeated traffic checks. The smaller app opened the page without requiring another identity-based account first.

For this problem, the most important privacy advantage was not a promise that a company would delete my evidence safely.

It was completing the task without creating the evidence in the first place.