Google’s Age Signals Could Protect Kids But Raise New Privacy Questions

Google wants apps to know when their users are children. Its new Play Age Signals API gives developers access to age-related signals that they can use to tailor app experiences based on a user’s age group.

The move could make it easier for developers to build age-appropriate experiences without asking every user to repeatedly verify their age. But it also raises a bigger question: does making age verification easier reduce the amount of data companies collect about children, or could it create another route to tracking and profiling them?

Paul Feng, VP, Google Play Engineering, Product and UX, says the API is designed to help developers provide age-appropriate experiences and meet regulatory requirements. Instead of requiring every app to independently determine a user's age, eligible apps can request an age signal from Google Play.

The signal can indicate an age range rather than exposing an exact date of birth. That distinction matters for privacy because an app that only needs to know whether someone is a minor may not need access to their exact birth date or identity document.

Google says developers are responsible for deciding how to act on the signal. They can use it to restrict certain content or features, modify privacy settings or introduce additional safeguards for younger users. Google also restricts the use of age signals for advertising, profiling and analytics.

But privacy and age-assurance experts say the risks do not disappear simply because an app receives an age band instead of a date of birth.

The privacy paradox

Malcolm Gomes, COO of IDfy and head of Privy by IDfy, argues that age assurance itself does not necessarily create the privacy problem. The bigger issue is how much information companies collect to establish age and what they do with it afterward.

“Age assurance done well reveals one bit of information, whether a user is above or below a threshold, and nothing more,” Gomes said.

He argues that companies should collect the minimum information required to establish age and discard the underlying verification data once it has served its purpose.

That becomes particularly important if age verification involves identity documents or facial information. A system that uses an ID or face scan to establish age but then retains that information could turn a child-safety measure into a new repository of sensitive data.

The preferred model, Gomes said, would process the verification data to produce an age result and then discard the underlying document or facial information, retaining only evidence that the verification occurred.

The paradox is straightforward: the more accurately platforms need to establish that someone is a child, the more information they may need to process. But the more information they retain, the greater the privacy risk the age check itself creates.

When an age band becomes a profile

An age band may look relatively harmless on its own. But when combined with a device identifier, location information and behavioural history, it can become much more revealing.

“An age band on its own looks harmless,” Gomes said. “Combined with a device identifier, a location, and a behaviour history, ‘13 to 17’ stops being a coarse label and starts identifying a specific child and what they do online.”

An app may only need to know that a user is under 18 to restrict certain features. It does not necessarily need to know the person's exact age, identity or browsing history.

The more information that enters the system, however, the greater the risk that age assurance becomes another component of a broader user profile.

This is also where India's DPDP framework becomes relevant. Gomes argues that separating the organisation that verifies age from the company providing the service could limit how much information a single platform holds. An independent verifier could establish the user's age and return only the result, without sharing the underlying identity document or browsing behaviour.

But outsourcing verification does not remove accountability. The platform remains responsible for how a child's data is processed, even when another company performs the verification.

Experts question the need for another layer

Paul Walsh, an online safety and privacy expert, takes a more critical view of Google's approach.

Walsh argues that Android already provides parents with device-level controls that can restrict children's access to apps and content. In his view, Google's new app-level mechanism adds another layer without solving the underlying problem.

“There’s no technical reason for this surveillance API,” Walsh said.

He also questions what happens when age verification moves through Google's infrastructure. In his view, routing these checks through a central platform could create a larger pool of information about which users are children and which apps they access.

“Google can now centralise identity telemetry and monitor user activity across apps,” he said.

Walsh also argues that age signals could create a false sense of security if developers fail to implement age-based restrictions effectively.

That highlights an important distinction between knowing a user's age and actually protecting them. An age signal only provides information. The developer still has to decide what to do with it.

Accuracy remains a problem

Age verification also faces a technical limitation: determining someone's age is not always straightforward. This becomes particularly difficult around legal thresholds such as 18.

Gomes points to NIST evaluations of facial age-estimation systems and argues that while such technology can distinguish a young child from an older adult, it is less reliable when separating teenagers from adults. He says facial estimation should therefore act as a first filter rather than the sole basis for consequential decisions.

If a minor is classified as an adult, a platform could process that user's data under rules that do not provide the same protections as those applicable to children.

This makes borderline cases particularly important. A system that confidently distinguishes a nine-year-old from a 40-year-old may still struggle with the legally significant difference between 17 and 18.

Under the DPDP framework, the platform cannot simply blame the algorithm or verification provider for such an error. Gomes argues that responsibility ultimately remains with the data fiduciary processing the child's information.

The concentration problem

Google's scale creates another question. If one platform becomes an important age-assurance layer for millions of children, it could create a concentration risk.

A single breach could expose information relating to a large number of children, while a flaw in an age-assurance system could affect an entire population at once.

The alternative is not necessarily to abandon age assurance. Instead, companies could design systems that minimise what they retain. A platform could establish that a user is a minor without keeping the identity document, facial scan or other underlying verification information.

That distinction is central to the privacy debate around Google's API.

The real test begins after age verification

For Gomes, identifying a child should trigger stronger privacy protections rather than simply act as a gatekeeper for content.

Once a platform establishes that someone is a minor, it should reduce unnecessary processing, including behavioural tracking, advertising profiles and engagement optimisation.

“The age check is only worth its privacy cost if it results in less processing of the child, not more,” Gomes said.

That may ultimately be the most useful test for Google's Age Signals API.

The technology could solve a genuine problem: developers should not have to collect identity documents simply to determine whether a user is a minor. But an age signal can also become another attribute in a broader profile if it is linked to device, location and behavioural data.

The question, therefore, is not simply whether Google can tell an app that a user is a child. It is what happens after the platform knows.

Google says developers can use the Age Signals API to build age-appropriate experiences, while restricting its use for advertising, profiling and analytics. However, the company has not addressed AIM's specific questions around how the system determines age, data retention, accuracy, safeguards against profiling and its implications for India's DPDP framework.