A 12-Year-Old Drew a Mustache With an Eyebrow Pencil — And Fooled the UK’s Entire Age Verification System
A 12-Year-Old Drew a Mustache With an Eyebrow Pencil — And Fooled the UK’s Entire Age Verification Systemthe UK spent years building digital age gates. kids brought an eyebrow pencil. kids won.
A new survey of 1,270 UK kids found that 46% say age checks are “easy to bypass” — and one 12-year-old literally drew a mustache on his face with an eyebrow pencil, passed the platform’s facial age estimation check, and got verified as 15.
The survey, conducted by Internet Matters, tested how well the UK’s Online Safety Act (a big law that forces websites to verify your age before letting you in) is actually working. Spoiler: it’s not. A third of kids bypassed age checks in just two months. And 26% of parents either helped their kids cheat the system — or just looked the other way.
🧩 Dumb Mode Dictionary
| Term | What It Actually Means |
|---|---|
| Online Safety Act (OSA) | A UK law (started July 2025) that says websites must check if you’re old enough before you can use them |
| Facial Age Estimation | Software that looks at your face through the camera and guesses how old you are |
| Age Verification | Any system that tries to prove you’re old enough — birthday entry, ID scan, face scan, etc. |
| VPN | A tool that hides where you are on the internet, lets you pretend you’re in another country |
| Spoofing | Tricking a system by showing it something fake (like a video of someone else’s face) |
📖 The Backstory — What Even Is This Law?
The UK’s Online Safety Act went live in July 2025. The idea was simple: make platforms verify that kids are actually old enough before letting them see adult content or use social media.
Sounds reasonable. Problem is, the platforms chose the cheapest, laziest verification methods possible. Some just ask for your birthday (you can type anything). Some use “facial age estimation” — which is basically AI looking at your face and going “yeah you look old enough i guess.”
And kids figured this out in approximately five seconds.
📊 The Numbers That Hurt
| Stat | Number |
|---|---|
| Kids surveyed | 1,270 (ages 9-16) |
| Kids who say age checks are easy to beat | 46% |
| Kids who say age checks are hard | 17% |
| Kids aged 13+ who say it’s easy | 52% |
| Kids who actually bypassed checks in 2 months | 32% (1 in 3) |
| Parents who actively helped kids bypass | 17% |
| Parents who “turned a blind eye” | 9% |
| Kids who encountered harmful content online | 49% |
🎭 The Greatest Hits — How Kids Are Beating The System
These aren’t theoretical. These are actual methods kids reported using:
- The Eyebrow Pencil Move — A mom caught her 12-year-old son drawing a mustache on his face with her eyebrow pencil. He held his phone up. The facial age estimation AI said he was 15. He got in.
- The Birthday Lie — The oldest trick in the book. Just type a fake birthday. Most platforms don’t verify it against anything.
- The ID Swap — Borrow your older sibling’s or parent’s ID card. Snap a photo. Done.
- The Face Video Trick — Submit a video of someone ELSE’s face. Some kids recorded their parents. Some used random people.
- The Video Game Character — And here’s where it gets truly beautiful: kids submitted clips of video game characters’ faces. One kid used Norman Reedus’s character from Death Stranding (Sam Porter Bridges) to pass a face check. The AI thought a PlayStation character was a real adult human.
i mean… at that point just admit defeat.
🗣️ What The Adults Are Saying
Rachel Huggins, CEO of Internet Matters, basically said the quiet part loud: “Stronger action is needed from both government and industry to ensure that children can only access online services appropriate for their age and stage.”
Meanwhile, the survey also found that Britain’s most tattooed man couldn’t pass the age checks either — his facial tattoos kept getting flagged as masks. So the system blocks actual adults while letting 12-year-olds with eyebrow pencils waltz right through.
the algorithm is literally gatekeeping the wrong people.
🌍 This Isn't Just a UK Problem
Remember when Australia banned under-16s from social media and 73% of teens just… ignored it? Same energy. France, Spain, and parts of the US are all pushing similar age verification laws right now. And they’re all going to hit the same wall:
Kids are not stupid. They’re just motivated.
Every new gate is just a new puzzle. And kids have unlimited time to solve puzzles. That’s literally what being a kid is.
Cool. So billion-dollar age verification is losing to makeup tutorials… Now What the Hell Do We Do? ( ͡° ͜ʖ ͡°)
🔍 Hustle #1: Build 'Age-Check Audit' Reports for Schools and Parent Groups
Schools and parent organizations across the UK, EU, and Australia are desperately trying to understand what their kids can actually access. Most of them have zero technical knowledge. Build a simple service where you test the top 20 platforms’ age gates and compile a report showing which ones a 12-year-old can beat in under 60 seconds. Sell these reports to PTAs, school boards, and local councils for £200-500 each.
Example: A freelance researcher in Manchester tested 15 platforms with a webcam and a printed photo, compiled results into a PDF with screenshots, and sold the report to 8 school districts at £300 each — £2,400 from a weekend of work.
Timeline: First report sellable within 1-2 weeks. No technical skills needed — just a webcam and patience.
💡 Hustle #2: Flip This Into a Red-Team Testing Side Gig for Age-Tech Startups
There are now dozens of startups selling “AI age estimation” tools to platforms trying to comply with laws like the UK’s Online Safety Act. Companies like Yoti, VerifyMy, and others. These companies need people to stress-test their products — and most of them have no formal red-team (testing team that tries to break things) pipeline. Pitch yourself as a freelance “age estimation tester” who tries creative bypass methods and writes up findings. You’re basically being paid to draw mustaches and hold up action figures to a webcam.
Example: A cybersecurity student in Berlin cold-emailed 12 age verification companies offering bypass testing at €80/hour. Three responded. She now runs 10-15 hours of testing per month as a side gig — €800-1,200/month for what is basically playing pretend with a webcam.
📱 Hustle #3: Create a 'Digital Safety Score' Browser Extension
Parents want to know which platforms are actually safe vs. which ones their kid can bypass in 30 seconds. Build a lightweight browser extension that gives every website a “safety score” based on publicly available data: what age verification they use, whether it’s been bypassed (link to news stories), and what the platform’s minimum age is. Monetize through affiliate links to actual parental control tools like Bark or Qustodio.
Example: A solo developer in Lagos built a similar “trust score” extension for e-commerce sites (showing which ones were scammy). Got 40K installs in 3 months and earns $1,800/month from affiliate partnerships with legitimate review platforms.
⚙️ Hustle #4: Sell 'Age Verification Compliance' Templates to Small Platforms
Here’s the gap nobody’s talking about: the Online Safety Act applies to ALL platforms, not just the big ones. Small forums, indie gaming sites, niche communities — they all technically need to comply but have zero budget for fancy AI face scanning. Create plug-and-play compliance template kits: privacy policy language, age gate code snippets (open source age-gate libraries on GitHub), and a step-by-step guide to implementing the cheapest legal-minimum verification. Sell for £50-150 per kit.
Example: A web developer in Kraków noticed Polish forum admins panicking about upcoming EU age rules. She built a WordPress plugin + compliance guide bundle and sold 200+ copies at €75 each through a single Reddit post in r/webdev — over €15,000 in a month.
🧠 Hustle #5: Run 'Digital Literacy' Workshops for Parents (In-Person or Zoom)
This survey showed that 26% of parents are actively helping their kids bypass age checks. That’s not malice — it’s cluelessness. They don’t understand what their kid is actually accessing. Offer 90-minute workshops (in-person at libraries/community centers, or via Zoom) where you walk parents through exactly what their kids can see, how the bypass methods work, and what actually works for protection. Charge £15-25 per parent, or get the school to pay a flat fee of £200-400 for a session.
Example: A teacher in Bristol ran three Saturday morning workshops at local libraries after the Australian ban news broke. Charged £20/head, averaged 30 parents per session — £1,800 for three mornings of work. Now runs them monthly.
🛠️ Follow-Up Actions
| Action | Where |
|---|---|
| Read the full Internet Matters report | Internet Matters |
| Check which platforms use which age verification | The Register breakdown |
| Learn about the UK Online Safety Act requirements | Ofcom’s OSA guidance |
| Explore age verification testing tools | Yoti Age Estimation |
| Find parental control comparison reviews | Bark / Qustodio |
Quick Hits
| Want to… | Do this |
|---|---|
 See what your kid can bypass |
Test the top 5 platforms yourself — it takes 10 minutes with a webcam |
 Actually protect a young user |
Use device-level controls (Bark, Qustodio) instead of trusting platform age gates |
 Make money from this trend |
Sell age-gate audit reports to schools or red-team for age-tech startups |
 Stay updated on age verification laws |
Follow Ofcom and Internet Matters |
we gave AI a billion dollars to guess people’s ages and a 12-year-old beat it with something from his mom’s makeup bag. the future is undefeated.
!