As preparation for the UK’s planned social media ban, Ofcom has set out four ways social media platforms could check whether users are aged 16 or over. The government and Parliament will decide how the ban works in practice.

Ofcom is the regulator for the communications services in the UK. The BBC reports that Ofcom identified four ways to check someone’s age that it considers “highly effective.”

Here’s what those checks would involve:

• Photo ID matching: Comparing a live image of you with the photo on an identity document, such as your passport, and checking the age information on that document.
• Bank-based checks: Using age information your bank already holds about you, with your consent.
• Facial age estimation: Using technology to estimate your age from your face. Ofcom says this technology has improved recently.
• Digital ID services: Using a digital identity service to prove your age, rather than presenting a physical document.

Let’s think through what those checks could mean.

Challenges

The challenge isn’t simply checking someone’s age. It’s doing so without turning everyday internet use into an identity check.

Photo ID matching brings highly sensitive documents and facial images into the process, which raises questions about how that information is handled and protected. The risks aren’t hypothetical: as I reported last year, a breach at a third-party support provider for Discord exposed government ID images belonging to around 70,000 users.

Banking-based checks can be more privacy-preserving if they return only confirmation that someone meets the age threshold, rather than exposing financial information. But the important questions are what information each party receives, what gets retained, and whether the check can be linked to someone’s activity.

Facial age estimation can avoid uploading an identity document, but it still processes a sensitive image and makes an imperfect prediction. Ofcom acknowledges that some technologies can be wrong by a few years around age 16, so people near the threshold may face an additional verification check.

I would expect these checks to stop some underage access but not eliminate it.

Previous restrictions have been followed by workarounds, including increased VPN use, borrowed credentials, and migration to services outside the restrictions. The danger is treating a successful age gate as proof that children are now safe, when it might push them into less regulated spaces.

The effectiveness depends on how the checks are implemented. A VPN may help someone avoid a check triggered by their apparent location; it won’t, by itself, bypass an identity or facial check that is still required.

Similarly, Ofcom says matching a live image to an ID is intended to make it harder to borrow someone else’s document. We shouldn’t assume every workaround defeats every method. But Ofcom accepts that some motivated children will get through. The meaningful test is how much harm these measures prevent, weighed against the privacy risks and barriers they introduce— not whether every user has completed a check.

My personal preference is double-blind verification: a provider confirms that you meet the age requirement without learning which service you’re accessing, while the service receives proof of age without learning your identity. Proving you’re old enough shouldn’t mean revealing who you are.

---

Scammers don’t need to hack you. They just need you to click once. 

Malwarebytes Identity Theft Protection catches suspicious activity before it becomes a problem.

Android phone number verification now links your numbers to every Google account on the device. Here is how to turn it off.

Related Posts:

• Android 17 Bionic Bug Triggers String Parsing Flaw
• Android Scam Protection Gets Gemini AI Upgrades
• LineageOS 24.0 Released: Android 17 & Web Flashing Tool

The post Android Phone Number Verification Is On by Default appeared first on Daily CyberSecurity.

Discord is rolling out machine-learning age assurance that estimates whether users are teens or adults without requiring most accounts to submit ID.

The post Discord Wants to Estimate Your Age Without Asking for ID appeared first on TechRepublic.

The EU Kids Act would ban under-13s from social media and require age verification via a privacy-preserving open-source app across 27 countries.

Related Posts:

• OpenAI Data Scraping Sparks Labor Theft Concerns
• Microsoft Edge IE Mode Retirement in 2029
• Google Gemini Escapes Sandbox During Security Testing

The post EU Kids Act Would Ban Social Media for Under-13s appeared first on Daily CyberSecurity.

WhatsApp announced on August 25 that more than one billion people now use passkeys to log back into the app.

The announcement included two other security upgrades: a stronger two-step verification method and more context for incoming calls from unknown numbers. It marks one of the largest passwordless authentication rollouts to date. Passkeys are now firmly mainstream, with the FIDO Alliance estimating that 5 billion are in use worldwide and 75% of consumers have enabled one on at least one account.

Three things changed:

1. Passkey support originally launched on Android and later extended to iOS. WhatsApp now supports multiple passkeys per account, so people who switch between an Android phone and an iPhone (or use both) can register a passkey on each device.
2. Two-step verification is moving from a simple six-digit PIN to a longer alphanumeric password that can include special characters, making it much harder to guess or brute-force.
3. On Android, WhatsApp now shows extra context about calls from numbers not saved in your contacts, including whether the number is from another country and whether you share any groups. It’s a small but useful nudge against the urgency tactics scammers rely on.

Passkeys are resistant to phishing because there is no password or SMS code to type into a fake website or hand over to a scammer. Instead, a passkey is stored on your device or in its credential manager and unlocked using your fingerprint, face, or screen-lock code. They’re also useful in regions where SMS one-time-passcode delivery is unreliable, which might explain why adoption reached a billion users so quickly.

The upgraded two-step verification password closes a real gap. PINs such as “123456” were common, weak, and reused, and a longer alphanumeric password with special characters raises the bar against account-takeover attempts, even if an attacker somehow obtains your one-time code.

The caller-context feature gives people more information to assess legitimacy before answering an unfamiliar number.

---

---

What WhatsApp users need to do

Users need to set up a passkey and upgrade their two-step verification password, while the caller-context feature will appear automatically on supported Android devices:

• Set up a passkey via Settings > Account > Passkeys, and follow the instructions on your device. Don’t forget to add a second one if you use both an Android and an iOS device.
• If you still use a six-digit PIN for two-step verification, upgrade to the new password format when it becomes available, especially if your PIN is predictable. You can find instructions to set up two-step verification for WhatsApp in this blog. If it’s already enabled, select Two-step verification to find the option to change your PIN.
• Add a recovery email to two-step verification if you haven’t already. It’s the only way to reset the password if you forget it.
• Android users should pay attention to the new caller-context details before answering calls from unknown numbers, treating urgency as a red flag rather than a reason to rush.

Passkeys and stronger two-step verification aren’t retroactive or forced, so accounts still relying on an old PIN or no passkey at all will remain unchanged until users upgrade them.

---

Scammers know more about you than you think. 

Malwarebytes Mobile Security protects you from phishing, scam texts, malicious sites, and more. With real-time AI-powered Scam Guard built right in. 

Download for iOS → Download for Android → 

New Zealand is moving ahead with a social media ban for under-16s, with the Government introducing the Online Safety (Minimum Age and Child Safety Risk Assessment) Bill to Parliament. The proposed law would require high-risk social media platforms to take reasonable steps to prevent children under 16 from accessing their services and would place greater responsibility on technology companies to address risks to children online. Prime Minister Christopher Luxon said the Government was responding to concerns about the amount of time young people spend on social media and their exposure to harmful content, addictive technology and online pressures. “We simply cannot accept the harm being done to a generation of New Zealand children,” says Prime Minister Christopher Luxon. According to the Government, one in three children aged 13 to 17 spends at least five hours a day on social media.

New Zealand Social Media Ban Introduces Age Verification

Under the proposed social media ban, high-risk platforms including Instagram, TikTok, Snapchat and Facebook would be required to take reasonable steps to establish whether users are over 16. The Bill allows for multiple age-checking methods, including existing account information, facial age estimation, digital ID services and formal identification. The proposed framework would also require platforms used by children to regularly assess the risks they pose and report on how those risks are being identified and reduced. The Government said the framework is designed to evolve alongside technology and would also cover emerging services, including AI companion platforms.

Companies Could Face Significant Penalties

The proposed online safety law would introduce significant penalties for platforms that fail to meet their obligations. Companies could face fines of up to 10 percent of their global revenue. An online safety regulator within the Department of Internal Affairs would independently monitor compliance, investigate platforms and enforce the law. Education Minister Erica Stanford said the Bill would place legal obligations on technology platforms rather than children, parents or caregivers. No penalties are proposed for children, their parents or caregivers under the proposed framework. “The Bill places legal obligations on platforms. No penalties are proposed for children, their parents or caregivers,” Ms Stanford says. “It doesn’t just introduce a minimum age requirement. It creates an enduring framework that can evolve alongside technology and holds platforms responsible for understanding and reducing the risks they create for children,” she says. The Government also plans to strengthen education and public awareness so parents, schools and communities have information and tools to help children navigate online services safely.

New Zealand Joins Growing Push for Child Online Safety

The proposed New Zealand social media ban follows similar moves in other countries seeking to place greater responsibility on technology companies. Earlier this year, Spain announced plans to prohibit social media access for children under 16. Prime Minister Pedro Sanchez described the internet as a “digital Wild West” and said stronger protections were needed to shield young people from online harm. France has also moved toward age-based restrictions. In February, French lawmakers approved legislation banning children under 15 from accessing social media platforms, with the measure expected to take effect at the start of the next school year. French President Emmanuel Macron backed the proposal, arguing that children’s development should not be dictated by algorithms designed to maximize engagement.

Government Says Rules Aim to Change Online Behaviour

Luxon acknowledged that the Government does not expect every child to stop using social media but said early evidence from Australia showed minimum age requirements were already changing behaviour. The Government said the child online safety framework is intended to make a meaningful difference while creating longer-term obligations for technology companies. The Online Safety (Minimum Age and Child Safety Risk Assessment) Bill will now be introduced to Parliament, beginning the legislative process for the proposed under-16 social media restrictions.

ChatGPT for Teens adds stronger protections for users ages 13 to 17, but parents still face limits around monitoring, age prediction, and AI safety.

The post ChatGPT for Teens Adds New Safeguards — but Safety Gaps Remain appeared first on TechRepublic.

Google’s new Android verification flow adds a 24-hour wait for apps from unverified developers as broader identity checks approach.

The post Google Tightens Android Sideloading: Unverified Apps Now Face a 24-Hour Wait appeared first on TechRepublic.

France’s Constitutional Council blocked an under-15 social media ban, raising questions over free expression, age verification and online privacy.

The post France’s Top Court Blocks Under-15 Social Media Ban appeared first on TechRepublic.

Meta is introducing a free Facebook badge that uses video selfies to verify human-run accounts, but questions remain about privacy and trust.

The post Meta Launches Free Facebook Verification Badge for Personal Accounts appeared first on TechRepublic.

France will ban social media for children under 15, requiring nationwide age checks and raising privacy and platform compliance concerns.

The post France Bans Social Media for Under-15s, Requires Age Checks appeared first on TechRepublic.

Australia’s under-16 social media ban faces scrutiny after testers found major platforms did not ask for age proof.

The post Australia’s Teen Social Media Ban Exposes Age Verification Gap appeared first on TechRepublic.

How modern age-verification laws, like the California Digital Age Assurance Act, dismantle the principle of data minimization by mandating the collection of sensitive personal data, effectively turning "don't know" into "must know" and knowledge into liability.

The post When Privacy Laws Force You to Know Too Much: The Perverse Incentives of Age Verification Regimes appeared first on Security Boulevard.

A landmark jury verdict has found Meta and YouTube negligent in a social media addiction case, raising major questions about platform accountability and legal protections under Section 230. This episode covers the details of the case, why the ruling is significant, and what it could mean for the future of social media, privacy, and cybersecurity. […]

The post Meta & YouTube Found Negligent: A Turning Point for Big Tech? appeared first on Shared Security Podcast.

The post Meta & YouTube Found Negligent: A Turning Point for Big Tech? appeared first on Security Boulevard.

💾

HIPAA is often used as a shorthand for "no," but the law is a nuanced permissions framework, not a blanket prohibition. Explore why "HIPAA-compliant" software often enforces a caricature of the actual 45 C.F.R. pt. 164.

The post HIPAA – I Do Not Think That Word Means What You Say It Means appeared first on Security Boulevard.

Passkeys secure authentication but do not prove users are human. Learn how bots operate after login and why modern apps need bot detection, behavioral analysis, and runtime identity.

The post Passkeys vs Bots: Do They Really Solve the Human Verification Problem? appeared first on Security Boulevard.

Use OTP authentication to secure HVAC appointments, payments, and service confirmations while improving customer trust and service efficiency.

The post How OTP Authentication Streamlines Service Delivery for HVAC Companies appeared first on Security Boulevard.

Protect e-commerce transactions with OTP, passkeys, and fraud detection. Reduce shipping fraud and secure high-value purchases easily.

The post Securing E-commerce Transactions with Modern Authentication appeared first on Security Boulevard.

AI tools may better protect children online by detecting harmful content without the privacy risks of strict age verification laws.

The post Making the Internet Safer for Children: The Case for Automated, Privacy-Preserving Solutions appeared first on Security Boulevard.

It's been nearly 20 years since Google revealed Android, which the company described as the first "truly open" mobile operating system, setting Google-powered phones apart from the iPhone's aggressively managed experience. Over time, though, Android has become more aligned with Apple's approach. For the moment, users still have the final say in what software runs on their increasingly locked-down smartphones. Later this year, though, Google plans to seriously curtail that freedom in the name of security.

In the coming weeks, Google will officially debut Android developer verification, which will require app makers outside the Play Store to register with their real names and pay a fee to Google. Failure to do so will block their apps from installation (sometimes called sideloading) on virtually all Android devices. Google says this is a necessary evolution of the platform's security model, but upending the status quo could push developers away from Android and risk the privacy of those that remain.

This might make your phone a little safer, sure, but it won't stop people from getting scammed. At the same time, it could rob the Android ecosystem of what made it special in the first place.

Read full article

Comments

© Aurich Lawson | Getty Images