On 9 November 2026, Meta announced that it is expanding its AI age-estimation technology globally on Instagram, to place "millions more teens" into Teen Account protections. According to MediaNama's report, the system looks for people Meta suspects are teens "even if they use an adult birthday," and Facebook is getting it too, with Threads planned for later this year. Meta also renewed its call for laws that put age verification and parental consent at the app-store level, with its own AI serving as a backstop to catch the store's mistakes.
The announcement is a useful moment to ask who should carry the burden of knowing a user's age, and what we give up for each answer.
The strongest case for what Meta is doing
The argument for mandatory, hard age checks is not frivolous. Self-declared birthdays are trivially false, and a child who enters an adult birthday gets adult-grade defaults. Australia's under-16 social media minimum age took effect on 10 December 2025, and eSafety reported that platforms had removed or restricted roughly 4.7 million accounts, a figure supplied by the platforms themselves. Even so, eSafety's March 2026 compliance update found that a substantial proportion of under-16s keep or create accounts, or pass platforms' age checks. A regulator that wants a rule to work has a real point when it says weak checks leave the law hollow.
In the United States, the legal ground has also shifted toward states. In Free Speech Coalition v. Paxton, decided 27 June 2025, the Supreme Court held that Texas's age-verification requirement for sexually explicit sites triggers only intermediate scrutiny because it incidentally burdens adults' speech. Texas's app-store law, SB 2420, was blocked by a district court on First Amendment grounds on 23 December 2025. The Fifth Circuit then stayed that injunction, and the Supreme Court declined to vacate the stay in July 2026. That was a procedural order, not a ruling on constitutionality. The Computer & Communications Industry Association is still litigating the merits.
Why the app-store handoff is the wrong fix
Meta's proposal is attractive to Meta for an obvious reason: it moves a compliance cost, and the liability that comes with it, upstream to Apple and Google. That is a legitimate lobbying position, but the policy case is weaker than the pitch suggests.
- It concentrates sensitive data in two firms. A mandate makes two operating-system vendors the identity checkpoint for a child's entire app life, including apps that have nothing to do with social media. Proportionate regulation should ask for the minimum signal needed, which is usually an age range and not an identity.
- It sweeps in everything. A weather app, a language tutor and a school tool all become subject to parental-consent flows designed for one category of risk. Small developers bear compliance costs that Meta, with its own AI stack, can absorb.
- It is constitutionally contested. The Texas litigation is exactly about whether conditioning access to lawful speech on verified consent survives First Amendment review. Building a global product strategy on an unresolved ruling is a bet, not a settled standard.
The 'backstop' admits the problem
The most revealing part of Meta's announcement is its description of its own AI as a backstop for mistakes in the store's signal. If app-store verification were reliable, a backstop would be unnecessary. If Meta's inference is reliable enough to correct the store, the store layer is redundant. Either way, Meta is describing a layered system where each layer is probabilistic.
Probabilistic age estimation has real costs that deserve plain statement. An adult misclassified as a teen loses features and may have to prove their age through an ID or a facial scan, which is a privacy trade the user never asked for. A teen misclassified as an adult keeps unsafe defaults. Meta's May 2026 rollout said flagged accounts can be deactivated until the holder supplies proof of age through its verification process, with Yoti integrated. The error rates, the appeal process and the retention of the underlying signals are not public in any auditable form.
Meta's own framing also carries a commercial logic. It cites an agreement with 52 bipartisan attorneys general, and it says it uses Apple's age-range signal in Australia. A company that has just made a regulatory settlement has an incentive to define the compliant architecture before regulators do.
What proportionate policy would look like
The better design principle is that age assurance should be risk-tiered, privacy-preserving and shared, not assigned to a single gatekeeper by statute.
- Match the check to the risk. Features like private messaging with strangers or algorithmic feeds for minors justify stronger assurance than reading a public page.
- Allow multiple compliant methods. Platform-level estimation, device-level age-range signals and third-party credentials should all qualify, with data-minimisation duties on each.
- Require transparency on error. Regulators should be able to audit misclassification rates and appeal outcomes, rather than relying on a company's description of a backstop.
- Avoid mandatory identity at the OS layer. Voluntary signals, such as Apple's range signal that Meta already uses, achieve most of the benefit without a legal mandate that locks in two intermediaries.
The open internet is best served when child-safety duties are tied to demonstrable harm and verifiable outcomes. Meta's announcement improves protection for some teens, and that is worth saying. But a global rollout of inference, combined with a lobbying push to make a rival's app store legally responsible, is not a neutral technical update. Policymakers should treat it as one proposal among several, and test it against the data it collects and the errors it makes.