The Mask Cut
Mandatory biometric age verification in effect Collected by private companies with no regulation
The Online Safety Act was sold as child protection. That word — protection — does a lot of heavy lifting.
In July 2025, millions of British internet users faced a new requirement: verify your age to access content deemed adult or harmful. The government mandates platforms use age assurance methods — facial scans, photo ID, credit checks. This is not optional. This is not hypothetical. This is now the law.^[1]
But here is what the press releases do not say: the age assurance industry is entirely unregulated. No minimum standards. No independent audit mechanism. No statutory protection for what happens to biometric data once it is handed over. The Open Rights Group wrote to the Secretary of State calling for regulation of age assurance providers, co-signed by over 600 members of the public. The letter warned that the rapid expansion of age assurance risks creating a new layer of digital infrastructure that concentrates power over identity, biometrics, and access to public life in the hands of private companies, with limited democratic oversight.^[1]
Users do not choose which age verification provider a platform uses. Many may be unaware of the investors and financial networks behind the identity infrastructure now embedded in everyday internet use. Reddit, Roblox and Discord users must submit facial scans to Persona, a company heavily backed by Peter Thiel, co-founder of surveillance and data analytics firm Palantir.^[1]
Now layer this on top of what the government has not done. The same administration pushing mandatory biometrics for millions has, in the words of the Open Rights Group, “abandoned comprehensive AI regulation under pressure from Big Tech, allowing private actors to shape the rules of digital life without democratic oversight.”^[1]
The AI Opportunities Action Plan is rolling out AI tools across the civil service — meeting transcription in 22 local authorities, planning document processing, and an AI-powered assistant for GOV.UK built by Anthropic to guide job seekers through government services. The expansion of AI into public services and the expansion of biometric collection from citizens are happening simultaneously, driven by the same policy programme, with the same absence of democratic scrutiny.^[2]
But it gets tighter. The enforcement mechanism for a social media ban on under-16s is not being passed through primary legislation. It is being introduced through Henry VIII powers — an amendment to the Children’s Wellbeing and Schools Bill that would allow ministers to bring in the ban through a Statutory Instrument rather than full parliamentary debate. As the Open Rights Group noted, no Statutory Instrument has been rejected by the House of Commons since 1979.^[1]
The government has not spoken to civil liberties groups about these proposals.^[1]
Who was consulted? Not the organisations that exist to scrutinise exactly this. What are the contracts worth? Undisclosed. What happens to the biometric templates after the transaction? No statutory requirement governs this. What industry bodies shaped these requirements? The fact that we have to ask tells you everything about how transparent this process has been.
The rhetorical frame is protection. Children must be shielded from harm. But the practical effect is a significant expansion of biometric data collection — collected by private companies, for profit, with no compulsory privacy or security standards, no parliamentary scrutiny of the mechanism being used to impose it, and no meaningful recourse when things go wrong.
The children argument is the door. The question is what walks through it.
Question: When the government uses child protection to justify mandatory biometric collection from millions of adults, and uses Henry VIII powers to bypass parliament while simultaneously refusing to regulate the AI systems processing that data — who is being protected, and from what?
Footnotes
^[1] Open Rights Group, “Online harms: Millions could be forced to use unregulated age verification,” 16 February 2026. https://www.openrightsgroup.org/press-releases/online-harms-millions-could-be-forced-to-use-unregulated-age-verification/
^[2] AI Opportunities Action Plan: One Year On, GOV.UK, January 2026. https://www.gov.uk/government/publications/ai-opportunities-action-plan-one-year-on/ai-opportunities-action-plan-one-year-on
^[3] GOV.UK, “PM: No platform gets a free pass — Government takes action to keep children safe online.” https://www.gov.uk/government/news/pm-no-platform-gets-a-free-pass-government-takes-action-to-keep-children-safe-online
Morgan Hale is independent verification without the editorial filter. Every cut is evidenced. Every question is open. Because it matters