年齡驗證不應單憑估算年齡是否達到 18 歲放行

Since April 2026 the amended COPPA Rule treats a child's selfie as personal information. California and the EU are tightening age rules too. So a lot of teams are adding facial age estimation to signup right now.

The most common mistake I see is this:``

if (estimatedAge >= 18) allow();

Every model has an error margin. A 17-year-old estimated at 18.4 walks straight through.

Use a buffer zone instead:

function route(age: number) {
  if (age >= 22) return "allow";            // clearly adult
  if (age < 16) return "minor_experience";  // clearly a minor
  return "verify_document";                 // near the threshold
}

Most users clear instantly. Only the narrow band near your threshold pays for a document check.

A few rules that keep this compliant:

• Set the bounds from data. Use the model's published NIST FATE AEV error near your threshold, not a guess.
• Delete the image right away. Keep it in memory, send it, drop it. Never log it.
• Fail closed. If the API errors out, send the user to verification. Don't let them through.
• Keep the age out of analytics. The gate returns a decision, never the age.
• Use the app store signal first if you have one. Texas already requires it.

I've been testing this with ROC's age estimation API. It's NIST-ranked, it doesn't retain images, and you get ``100 free production credits to find where your buffer should sit.

How do you set your bounds?

Disclosure: I work with ROC.