Let's be clear about why this is even a conversation. The old way of doing age verification, where you upload your ID or a selfie to a server, is a privacy disaster waiting to happen. Or, more accurately, a disaster that's already happening. This is precisely the problem that on-device age verification aims to solve. The Identity Theft Resource Center reported 3,322 data breaches in the US last year (2025 data), a 79% jump in five years. Supply-chain breaches doubled in that same period. When 63% of people are seriously worried about biometric data collection, you know we have a problem.
And then there's the fraud. AI-driven attacks, what we call agentic fraud, are exploding. In 2024, they were 3% of fraud attempts. By early 2026, they hit 40%. We're looking at over 90% within the next 18 months. Attackers are getting smarter, faster, and more automated. Sending your face to a central server just gives them another target.
The Problem We're Trying to Fix
This is where companies like Incode come in. They've put $100 million into building out "on-device" processing, and their first product, "On-Device Age Estimation," just launched this month, July 2026. The core idea is simple: the facial age estimation and passive liveness detection models run directly on your phone, tablet, or laptop. This is the essence of on-device age verification, ensuring your data stays local.
How On-Device Age Verification Works (Supposedly)
Here's the chain:
- You take a selfie on your device.
- Incode's models, optimized to be small enough to run efficiently (they use something called knowledge distillation to shrink them down), analyze your face *locally*.
- The liveness detection confirms you're a real, live person, not a photo or a deepfake.
- The system determines if you meet the required age threshold (e.g., over 18).
- Key, your actual facial data – the image, the biometric template – *never* leaves your device. It's not transmitted, it's not stored externally. This is the fundamental privacy promise of on-device age verification.
- Only the *outcome* (a simple "yes, age threshold met" or "no") gets sent to the service you're trying to access.
Incode calls this "privacy by architecture," and on paper, it sounds solid. They also have a server-side layer that analyzes session metadata – things like timing, device characteristics, connection details – to catch tampering, like someone injecting a fake camera feed.
They claim 99% spoof detection accuracy against deepfakes and other attacks, and they've flagged over a million face-related attacks on their platform this year. They've even integrated with Identiq to share fraud signals across organizations without exposing customer data. And yes, they've got the compliance badges: SOC 2 Type 2, ISO 27001, HIPAA, FedRAMS, ACCS.
The Unspoken Concerns: Why Skepticism Lingers
Despite all those technical assurances and certifications, the skepticism I hear from the community regarding on-device age verification is real. And it's not just paranoia.
First, while your *facial data* might not leave the device, the *outcome* does. And so does a bunch of *session metadata*. What exactly is in that metadata? How is it used? How long is it kept? The definition of "privacy-preserving" here is very narrow, focusing almost exclusively on the biometric image itself. But privacy is bigger than just your face. It's about digital autonomy, about not being tracked, about not having every interaction logged and analyzed, even with on-device age verification.
Second, the "on-device" claim relies on the integrity of the device itself and the software running on it. Can those local models be tampered with? Can a sophisticated attacker bypass the local processing and inject a pre-verified outcome? Incode's server-side session integrity checks are good, but they're a secondary control. The primary control is client-side, and client-side controls are always vulnerable to a determined attacker who controls the endpoint. We've seen this play out countless times in other security contexts.
Third, there's the "Trojan horse" argument. Even if Incode isn't collecting your face, this technology normalizes the idea of biometric age verification. It sets a precedent. What happens when the next iteration, or a less scrupulous vendor, decides that just the "outcome" isn't enough? Or when governments demand access to the underlying models or the metadata for "national security" reasons?
The infrastructure for on-device age verification is being built, and once it's there, it's hard to roll back. This normalization is a key concern with widespread on-device age verification.
Finally, there are practical questions. Will this on-device age verification work reliably on every device, across every browser and app? What about older phones, or devices with limited processing power? This could create a new form of digital exclusion or contribute to e-waste if people are forced to upgrade just to access online services. And let's be honest, minors are incredibly resourceful. If there's a will, there's usually a way to bypass these systems, no matter how sophisticated.
What We Need to See Next
While on-device age verification is a technical step forward, I'll give it that. It addresses a critical vulnerability in the traditional server-based model. But it's not a magic bullet for privacy.
What we need is more than just assurances that data isn't leaving the device. We need:
- Verifiable transparency: Independent, auditable proof that the models are doing what they say they're doing, and nothing more. This includes open-source components where feasible, or at minimum, third-party security audits that delve into the model's behavior and data handling, not just its deployment environment. Without this, the "black box" problem persists, eroding trust.
- Clear policies on metadata: What's collected, how it's used, how long it's kept, and how users can control it. This extends to the session metadata that *does* leave the device. Users must have granular control over this data, with clear opt-out mechanisms and data deletion rights. The current focus on biometric image privacy, while crucial, often overshadows the equally important privacy implications of aggregated metadata.
- A broader definition of privacy: One that considers digital autonomy and the potential for mission creep, not just the immediate handling of biometric data. This means acknowledging the societal impact of normalizing biometric checks and establishing robust legal frameworks that prevent the expansion of these systems beyond their stated purpose. We must guard against the slippery slope where "on-device" becomes a stepping stone to more intrusive, centralized systems.
Furthermore, the industry needs to move towards open standards and interoperability. Proprietary solutions, while innovative, can create vendor lock-in and hinder independent scrutiny. A collaborative approach, perhaps through a non-profit consortium, could establish best practices and common protocols for secure, privacy-preserving age verification that truly empowers users.
The problem isn't just *where* the data is processed; it's *who controls the processing* and *what the long-term implications are for digital freedom*. Until those deeper questions are answered, the skepticism will, and should, remain. The promise of on-device age verification is significant, but its true value will only be realized if it's built on a foundation of genuine transparency, user control, and a holistic understanding of privacy in the digital age.
