Kids Are Beating UK Age Checks With a $2 Eyebrow Pencil and 20 Seconds
Kids Are Beating UK Age Checks With a $2 Eyebrow Pencil and 20 SecondsA 12-year-old drew a mustache on his face and a multi-billion-dollar age verification industry said “welcome, sir”
A new UK survey of 1,270 kids found that 46% think age checks are easy to bypass — while only 17% say they’re difficult. One 12-year-old grabbed his mum’s eyebrow pencil, scribbled a mustache on his upper lip, and the facial analysis system immediately verified him as 15.
The UK Online Safety Act went live in July 2025. It was supposed to be the gold standard for keeping kids off adult sites. Governments spent years debating it. Tech companies spent millions building compliance tools. And a child with a kohl pencil and a mirror just dismantled the entire thing in the time it takes to microwave a Hot Pocket.
🧩 Dumb Mode Dictionary
| Term | What It Actually Means |
|---|---|
| Age Verification | The system that asks you to prove how old you are before using a website — usually with your face, an ID, or a birthdate |
| Facial Analysis/Estimation | Software that looks at your face through a camera and guesses your age (not the same as facial recognition — it doesn’t know WHO you are, just how OLD you look) |
| UK Online Safety Act | A British law from 2025 that forces websites to check if users are old enough, or face huge fines |
| Ofcom | The UK’s internet and media regulator — they’re the ones enforcing the age check rules |
| VPN | A tool that makes the internet think you’re in a different country, so local rules don’t apply to you |
📜 How We Got Here
Right, so here’s what’s actually happening. The UK government passed the Online Safety Act in late 2023, it came into force in July 2025, and Ofcom started actually enforcing age verification requirements. The idea was simple: if a site has content that’s not suitable for kids, the site has to check you’re old enough before letting you in.
Companies like Yoti built facial age estimation tools that scan your face through a webcam, run it through a machine learning model, and spit out an estimated age. No ID needed, no credit card — just your face.
The problem? These systems were built to stop casual access by young children. They were never stress-tested against a 12-year-old with access to a cosmetics drawer and zero respect for authority.
📊 The Receipts
The Internet Matters report surveyed 1,270 kids (ages 9-16) and their parents across the UK. Here’s what they found:
| Stat | Number |
|---|---|
| Kids who say age checks are easy to bypass | 46% |
| Kids who say age checks are difficult | 17% |
| Kids who admit actually bypassing them | 32% |
| Parents who actively helped their kids bypass checks | 17% |
| Parents who just looked the other way | 9% |
So nearly 1 in 5 parents are literally helping their kids get around the system their government built to protect those same kids. You can’t make this stuff up.
🎭 The Cheat Codes Kids Are Using
The drawn-on mustache is the headline-grabber, but kids are running a whole playbook:
- Eyebrow pencil mustache — A 12-year-old drew one on, got verified as 15. That’s the entire story of a billion-dollar industry.
- Fake birthdates — The oldest trick in the book. Born in 1902? Sure, welcome aboard, grandpa.
- Someone else’s face — Just hold up dad’s photo to the camera. Or your older sibling’s.
- Video game characters — Some kids submitted images of video game avatars and the system said “looks 18 to me.”
- AI-generated faces — Kids are using free AI face generators to create convincing adult faces.
- VPNs — Route your traffic through a country that doesn’t require age checks. A 10-year-old can set this up in 2 minutes.
The facial analysis models were trained on adult faces. They weren’t trained on “12-year-old who drew facial hair on himself with a makeup pencil.” And that gap between what the AI expects and what a creative kid actually does — that’s where the entire system falls apart.
🗣️ What the Timeline's Saying
The reaction has been… exactly what you’d expect.
Privacy advocates are doing victory laps, saying they warned everyone that age verification was security theater that would collect biometric data from millions of people while doing exactly nothing to protect kids.
The Register reported that the picture emerging is “one of expensive, intrusive infrastructure being undone by a child with twenty seconds, a mirror, and a kohl pencil.”
Meanwhile, half of US states have now passed or are pushing similar age verification laws. The UK just proved these systems are basically a door with a “PLEASE DO NOT ENTER” sign on it — and American legislators are copying the homework anyway.
🔍 The Deeper Problem Nobody's Talking About
Here’s the part that should actually worry you: the age checks that DO work are the invasive ones. Government ID upload. Credit card verification. Full biometric scanning.
So the choice isn’t “good age verification vs. bad age verification.” It’s “age verification that doesn’t work” vs. “age verification that works but creates a massive database of exactly which adults visit which adult websites.”
That’s not a bug in the system. That’s the system. And every 12-year-old with an eyebrow pencil is accidentally proving that the only way to make this work is to build a surveillance machine. Kids these days — accidentally becoming privacy activists while trying to bypass parental controls.
Cool. A $2 Pencil Just Roasted a Billion-Dollar Industry… Now What the Hell Do We Do? ( ͡° ͜ʖ ͡°)
🕳️ The Verification Stress-Tester
Age verification companies (Yoti, AgeChecked, VerifyMy) are going to be SCRAMBLING to patch their facial analysis models right now. There’s a 2-4 week window where companies will pay serious money for adversarial testing — finding creative ways to fool their systems before regulators come knocking.
Build a simple toolkit: different drawn-on facial hair styles, printed photos at various angles, AI-generated face images, and document your bypass rate. Package this as a “red team” (fancy term for “hired attacker”) testing service specifically for age verification companies. You’re not selling hacking — you’re selling quality assurance (QA).
Example: A 24-year-old cybersecurity student in Bristol, UK, sets up a freelance “age gate red team” on LinkedIn and cold-emails 15 verification startups with a 3-minute video showing 8 different bypass methods. Three companies respond within a week. She charges £2,000 per audit. First month: £6,000.
Timeline: First client in 7-10 days (companies are panicking right now). Steady work for 3-6 months until models get patched. Then pivot to the next wave of verification tech.
📡 The Compliance Panic Broker
Right now, every website with UK traffic is reading this news and thinking: “Wait, does OUR age gate actually work?” Most of them don’t know. They just bolted on whatever their legal team told them to.
Become the person who audits small-to-mid-size websites for Online Safety Act compliance. You don’t need to be a lawyer. You just need to test their age gate with the methods kids are using, document the results in a professional PDF, and tell them “you’re exposed — here’s what to do.” Charge £500-1,500 per site. The websites that fail your audit will pay you to fix it too.
Example: A 21-year-old in Nairobi, Kenya, targets UK-based e-commerce sites selling age-restricted products (vapes, alcohol, knives). He tests 40 sites’ age gates in one week using the methods from the Internet Matters report, finds 35 of them are trivially bypassable, and sends each one a cold email with a free sample report. Seven hire him for the full audit. Revenue: £5,250 in two weeks.
🪟 The Parent-Proof Kit
17% of parents are HELPING their kids bypass age checks. That means there’s a market of parents who want their kids to have access to certain platforms but don’t know how to navigate the verification maze. And there’s an opposite market: parents who want verification that actually WORKS at home.
Build a Notion template or simple web guide called something like “The Actually-Working Parental Control Stack” — a step-by-step setup using OpenDNS Family Shield (free), device-level restrictions, and router-level blocking. Sell it on Gumroad for $9-15. Market it on parenting subreddits and Facebook groups with the hook: “The government’s age checks don’t work. Here’s what does.”
Example: A 28-year-old mother in Manila, Philippines, creates a 20-page guide with screenshots for every major device (iPhone, Android, Windows, Mac, smart TV). She shares a free preview on r/parenting with the headline “Age verification is broken — I tested it myself.” Post goes semi-viral. Sells 400 copies in the first week at $12 each. Revenue: $4,800.
🎰 The Face-Age Arbitrage
Here’s the weird angle: if facial age estimation is this unreliable, then ADULTS who look young are getting locked out of legitimate services. There are real people over 18 who can’t pass these checks because the AI thinks they’re 15.
Build a niche service that helps baby-faced adults get verified. A professional “verification photo prep” guide — lighting angles, camera distance, facial expressions that read as older to the AI. Test which angles add estimated years across Yoti’s age estimation and similar tools. Package findings as a $19 guide or $49 one-on-one video consultation.
Example: A 26-year-old photographer in São Paulo, Brazil, tests 200 photos at different angles and lighting conditions against 3 popular age estimation APIs. Discovers that overhead lighting + slight chin-up adds 4-6 years to estimated age consistently. Sells the findings as “How to Look Your Age Online” on Etsy and Instagram. Pulls in $2,300/month from a $19 digital download.
🎣 The Regulation Tracker Newsletter
Age verification laws are exploding. UK just proved theirs don’t work. Half the US states are rolling out their own versions. The EU is cooking up the Digital Services Act enforcement. Australia’s teen social media ban is already failing. Every single website, app developer, and legal team needs to know which rules just changed, which ones are coming, and which ones actually matter.
Start a free Substack tracking age verification regulation changes worldwide. Post 2x/week. Monetize with a $15/month “compliance alerts” tier that sends same-day notifications when new laws pass or enforcement actions happen. The niche is small but the people in it (compliance officers, legal teams, age verification companies) have budget.
Example: A 23-year-old law student in Berlin, Germany, launches “Age Gate Watch” on Substack. Covers the UK mustache story as issue #1, gets shared by 3 privacy-focused Twitter accounts. Hits 800 free subscribers in 2 weeks. Converts 40 to the paid tier. Revenue: €600/month and growing.
🛠️ Follow-Up Actions
| Want To… | Do This |
|---|---|
| Understand the UK law | Read the full Online Safety Act text and Ofcom’s guidance |
| Test age estimation yourself | Try Yoti’s age estimation demo with different setups |
| Read the full survey | Check Internet Matters for the complete report |
| Track US state age verification laws | Follow EFF’s legislative tracker for state-by-state updates |
| Set up actual parental controls | Start with OpenDNS Family Shield — free, takes 5 minutes |
Quick Hits
| Want To… | Do This |
|---|---|
 Check if YOUR site’s age gate works |
Test it with the methods kids are using — fake birthdate, photo of someone else, drawn-on facial hair |
 Actually protect your kid online |
Skip the government’s broken system — use OpenDNS Family Shield + device-level restrictions |
 Sell compliance audits |
Cold-email UK websites selling age-restricted products with a free sample bypass report |
 Stay informed on age laws |
Bookmark Ofcom’s online safety page and EFF for US updates |
Governments spent years and billions building a digital bouncer — and a 12-year-old walked right past it with his mum’s makeup bag. Sleep well, regulators.
[Source: Cybersecurity News | TechCrunch | Euronews | The Register]
!