Before You Upload a Selfie: What an Age-Verification Company Can Actually See

The photograph I needed was hidden behind a grey screen. I was trying to open a graphic first-aid discussion to decide whether a cut required urgent treatment, but Reddit wanted my date of birth and then offered two ways forward: photograph an identity document or scan my face. I assumed the app had lost my session, closed it, reopened the same page in a browser and met the same demand. I am an adult. That was not the question bothering me. The question was what would happen to the photograph after I pressed continue.

The screen was not malfunctioning. Since July 25, 2025, services accessible in the UK that host pornography or certain other material considered harmful to children have had to introduce stronger age checks. Ofcom has since examined their use across pornography, social media and dating services. (Ofcom)

That explained why the prompt had appeared. It did not explain what I would be giving away.

In public discussions about Reddit’s UK rollout, the recurring concern was not whether adults could prove their age. It was whether one passport or face scan might connect a real identity to several accounts, interests and communities that had previously remained separate. (Reddit)

That was exactly the distinction I was trying to protect: not secrecy about my age, but distance between my legal identity and an ordinary browsing session.

The website and the verifier do not necessarily see the same thing

The simplest useful answer is this:

An age-verification company sees the information needed to perform the method you choose. The website may receive only the result.

In Reddit’s Persona-based process, a user may submit an identity document or a facial image. Reddit says it does not receive those photographs. (Reddit)

So the website might learn only that you are over 18, while the verification provider temporarily processes much more.

With a face-based check, that can include the image or short video used to estimate age, signals showing that a live person is present, and basic device or network information. With an ID check, it can include the document image, portrait, birthdate, document details and sometimes a fresh selfie used to confirm that the document belongs to the person holding it.

The method changes the data trail.

An open-banking check asks a bank to confirm age. A card check involves a payment processor. A mobile-network check may use a phone number and the age status held by a carrier. An email-based method may estimate age from signals associated with the address. Ofcom accepts several of these approaches; it does not require every service to use a passport or selfie. (Ofcom)

Some providers are designed to reveal very little to the requesting website. Yoti, for example, says its facial-age-estimation service deletes the image after producing an estimate and sends the site only an age or threshold result. (Yoti)

That is better than every website storing a copy of an identity document. But it does not mean that sensitive information never enters the process. It means another company processes it to produce a smaller answer.

The UK Information Commissioner’s Office expects age-assurance systems to collect only what is necessary, explain how the information is used and avoid turning verification data into advertising data. (Org) Those rules create important limits. They do not remove the initial decision facing the person at the screen: whether opening one page is worth creating a new identity-verification event.

The selfie looked easier until I considered the whole exchange

A face scan initially felt like the less intrusive option. It was not a passport. It would probably take less than a minute.

That impression is one reason the design works. The button asks for a quick action, not a long privacy judgment.

But Reddit’s age system is broader than the photograph on the screen. Its help documentation says an account’s estimated age may also draw on signals such as account age, activity, subscriptions, email domain, supplied birthdate, app-store information and previous verification status. (Reddit)

The selfie, in other words, was not necessarily an isolated check. It could become one more signal inside an existing account relationship.

I could not observe Reddit’s internal filtering or age-classification rules. I could only judge the information requested from me, the documentation available to users and what changed when I altered the connection.

That was enough to change the decision.

I was no longer asking, “Will this company delete my photograph quickly?”

I was asking, “Do I need to create the photograph at all?”

I backed out.

My first alternative solved the prompt and created a new obstacle

I already paid for a large, established VPN. It had years of public history, a substantial support operation and more server locations than I would ever use. Opening it felt like the obvious response.

I signed in, chose a nearby route outside the UK and reopened the link in a private browser window.

The age prompt disappeared.

Then the page replaced it with another problem: repeated security challenges. One completed, another appeared. On the next attempt, the discussion loaded but several images stalled. I changed servers, tried again and reached the same kind of friction.

The service had technically changed my visible location. It had not completed the task cleanly.

That shifted the comparison. A vast list of countries was not especially useful when I needed one ordinary page to open without an identity check, a login detour or a sequence of CAPTCHAs.

For a moment, a free browser extension seemed more sensible. It could be installed in seconds and would not require another subscription. But the permissions screen introduced a different question: who operated it, what traffic it covered and how the service was funded.

There are reputable free VPN tiers. This was not an argument against all of them. It was simply impossible to answer those questions about this particular extension quickly enough to trust it with the session.

The original problem had now become clearer. I did not need the product with the most servers. I needed the route that asked me to create the least additional identity data while still opening the page.

The smaller app required less before it did anything

OnlydogVPN was the less established option in the test. It offered fewer locations, had a shorter public history and had not accumulated the same volume of independent reviews as the larger provider.

Normally, those differences would weigh heavily.

In this situation, the first thing I noticed was more practical: basic use did not begin with a conventional email-and-password account.

That mattered because I had arrived here by refusing to connect a sensitive browsing choice to another durable identity record. Creating a new account to avoid an identity-verification prompt would have reproduced part of the problem in a different place.

The app also organised the choice around situations rather than making me work through a long geography-and-protocol menu. I selected the option that matched the task and returned to the original link.

The page loaded.

There was no age-verification card. There was no repeated CAPTCHA loop. The images appeared, followed by the discussion I had been trying to read.

Only after the task was complete did the technical difference become relevant. The service uses HTTP/3-based transport with additional obfuscation, an approach intended to make the connection less dependent on the familiar patterns used by conventional VPN traffic. I did not need to choose the protocol manually or understand its packet structure. Its value was visible in the result: the route remained usable long enough for the page to finish.

A VPN does not change someone’s age or erase what a logged-in account has already revealed. It changes the network address and location signal presented to the service. A platform can still rely on account history or require verification regardless of location.

But no additional identity evidence was required during this session. I did not submit a facial image, passport, card number or birthdate to an age-verification contractor.

That was the result I had been looking for.

After reading the first-aid thread, I opened the medical guidance linked beneath it. A blocked-request counter in the app began to rise as advertising and tracking requests were filtered in the background.

It was a secondary benefit, but it followed naturally from the same concern. The face scan had made me think about one highly visible piece of personal data. The counter made the quieter collection around an ordinary page easier to notice.

The important question comes before the deletion promise

A well-designed age-verification system can separate identity evidence from the website requesting the check. The site may receive only an age result, while the specialist provider processes and then deletes the photograph or document.

That is a meaningful privacy improvement.

It is also reasonable for an adult to decide that the page is not worth producing the evidence in the first place.

The established VPN brought maturity and scale, but the route I tested introduced too much friction. The free extension was fast to find but too opaque to evaluate. The smaller app asked for less identity information and completed the task without turning the next few minutes into a server-selection exercise.

For this decision, the most important privacy feature was not a promise to delete my face safely.

It was reaching the page without creating the face scan at all.