Proton Warns Against Facial Recognition for Age Verification on Platforms
Proton VPN issued a statement warning against scanning faces for age verification on Roblox, Discord, Twitter, YouTube, Instagram, Reddit, Spotify, and Twitch. The post did not include technical details, simply repeating the names of the eight platforms.
The implemented facial recognition is primarily linked to age estimation. Starting January 2026, Roblox will require age checks in areas where chat is available. The provider is Persona, and one method involves estimating age through a short video selfie that requires turning the head; Roblox claims it will delete the footage after estimating age. Users aged 13 and older can also submit government ID, and linked parents can verify through parental controls. The results are divided into six age bands from 5 to 8 years up to over 21 years, with chat restrictions limited to the same band and lower. By the first quarter of 2026, approximately 51% of players are expected to complete the checks.
Discord initially planned to use only facial age estimation or ID scanning. Co-founder and CTO Stanislav Vishnevskiy changed course after user backlash, adding age ranges from credit cards, Apple or Google accounts, and an AgeKey stored in devices or password managers. Credit card data is transferred from the provider k-ID to Stripe for verification, and Discord claims neither it nor k-ID sees card data. Vishnevskiy also stated that regardless of the provider used, Discord will not receive names, credit card details, IDs, or facial scans, only age range signals, and that uploaded data must be deleted immediately after confirmation by the provider.
The UK side has already included selfies in compliance pages. Reddit lists Persona on its Cybersecurity Law page, allowing selfies or ID, with iOS also able to use Apple accounts. Instagram lists Yoti, using video selfies to determine age range or uploading official documents. The UK government’s June 2026 guidance states that facial age estimation is a verification method available to some adults and plans to implement social media restrictions for those under 16 in spring 2027, referencing Australia. Ofcom's high-standard age assurance guidelines are still being supplemented.
Changing countries does not solve the biometric verification on accounts. Roblox's checks are tied to accounts, regardless of where the connection comes from. VPNs can bypass laws that block platforms by region, but cannot circumvent the account thresholds that require selfies or IDs. Proton sells a no-logs encrypted channel, not age proof.
This represents a contradiction where privacy tools are competing against age verification. The buyers are users who do not want to provide their faces to platform providers, while the sellers are companies like Persona, Yoti, and k-ID that exchange selfies for age range signals. Platforms shift fines and child protection responsibilities to providers, only to receive an age range in return. Beneficiaries are the providers that handle the verification process and VPNs that attract customers through this warning. Those under pressure are accounts that lose access to chat, adult content, or live streaming without submitting selfies.
Source: Public Information
ABAB AI Insight
Proton's business is turning this warning into subscriptions. The company grew from Proton Mail, selling no-logs VPNs and using open-source and audits as credentials. Once age laws block websites by region, the use of VPNs shifts from bypassing censorship to circumventing geographical barriers. Selfies tied to accounts like Roblox's cannot be bypassed by VPNs. The warning remains relevant as it places eight everyday applications in the same sentence "do not provide your face," and traffic may not necessarily come from those that can truly bypass.
Platforms are outsourcing facial recognition. Roblox uses Persona for facial age estimation and ID verification, while Discord added Stripe for card verification, app store age ranges, and AgeKey after user backlash. Reddit mentions Persona on its UK page, and Instagram mentions Yoti. The providers return age ranges, not a commitment to keep original selfies in the platform's database. Deletion occurs on the provider's side, and users do not see deletion logs.
A similar structure exists in airport self-service clearance and bank liveness detection. Clear, government electronic gates, and payment companies all exchange faces or IDs for a passing signal. The difference this time is that the threshold is placed before chat, live streaming, and adult content, not at borders. The UK's Cybersecurity Law has already prompted leading services to implement age assurance, with additional restrictions for those under 16 in spring 2027. The industry phase has shifted from "users filling in their birthdays" to "providers issuing age ranges, and platforms enabling features only then."
Essentially, regulatory changes are repricing access. Platforms fear daily fines and child protection responsibilities, not the friction of an additional selfie. By outsourcing verification to Persona, Yoti, and k-ID, platforms only purchase an auditable age signal, while the biometric originals remain with another company. Users lose the ability to access chat without providing their faces, which was possible with old accounts. Proton's opposition cannot eliminate this signal; it can only advise against becoming the raw material for the signal.
ABAB News · Cognitive Laws
Age ranges can be purchased; faces must be provided personally.
Changing countries does not eliminate checks on accounts.
Platforms buy signals; providers retain the originals.