Proton VPN issued a statement warning against scanning faces for age verification on Roblox, Discord, Twitter, YouTube, Instagram, Reddit, Spotify, and Twitch. The post did not include technical details, simply repeating the names of the eight platforms.

The implemented facial recognition is primarily linked to age estimation. Starting January 2026, Roblox will require age checks in areas where chat is available. The provider is Persona, and one method involves estimating age through a short video selfie that requires turning the head; Roblox claims it will delete the footage after estimating age. Users aged 13 and older can also submit government ID, and linked parents can verify through parental controls. The results are divided into six age bands from 5 to 8 years up to over 21 years, with chat restrictions limited to the same band and lower. By the first quarter of 2026, approximately 51% of players are expected to complete the checks.

Discord initially planned to use only facial age estimation or ID scanning. Co-founder and CTO Stanislav Vishnevskiy changed course after user backlash, adding age ranges from credit cards, Apple or Google accounts, and an AgeKey stored in devices or password managers. Credit card data is transferred from the provider k-ID to Stripe for verification, and Discord claims neither it nor k-ID sees card data. Vishnevskiy also stated that regardless of the provider used, Discord will not receive names, credit card details, IDs, or facial scans, only age range signals, and that uploaded data must be deleted immediately after confirmation by the provider.

The UK side has already included selfies in compliance pages. Reddit lists Persona on its Cybersecurity Law page, allowing selfies or ID, with iOS also able to use Apple accounts. Instagram lists Yoti, using video selfies to determine age range or uploading official documents. The UK government’s June 2026 guidance states that facial age estimation is a verification method available to some adults and plans to implement social media restrictions for those under 16 in spring 2027, referencing Australia. Ofcom's high-standard age assurance guidelines are still being supplemented.

Changing countries does not solve the biometric verification on accounts. Roblox's checks are tied to accounts, regardless of where the connection comes from. VPNs can bypass laws that block platforms by region, but cannot circumvent the account thresholds that require selfies or IDs. Proton sells a no-logs encrypted channel, not age proof.

This represents a contradiction where privacy tools are competing against age verification. The buyers are users who do not want to provide their faces to platform providers, while the sellers are companies like Persona, Yoti, and k-ID that exchange selfies for age range signals. Platforms shift fines and child protection responsibilities to providers, only to receive an age range in return. Beneficiaries are the providers that handle the verification process and VPNs that attract customers through this warning. Those under pressure are accounts that lose access to chat, adult content, or live streaming without submitting selfies.

Source: Public Information