An age check can keep a child away from adult content. A poorly designed one can also shut that child out of a learning space and require other users to disclose more than the service needs.

Imagine a fifteen-year-old trying to join a moderated learning community. The platform asks for a government identity document and a selfie processed by an outside company. She cannot provide the document, so she is locked out. Another user gets through, but the service and its vendor now hold identity data just to answer an age question.

This is not an argument against age assurance. Some services and features carry risks that justify age limits. But an age check only answers whether a person meets the age requirement. A child who passes that check can still face grooming, cyberbullying, unwanted contact or harmful product design while using the service. The real question is what the service does differently once it knows, or has reason to believe, that the user is a child.

What an age check can do

Age assurance can support a specific decision. It may prevent a child from accessing adult content, gambling or another age-restricted product. It may also help a platform decide which privacy settings, contact permissions or content recommendations should apply to a younger user.

Instagram offers a useful example. Meta says its Teen Accounts are private by default, restrict messages from people the teenager does not follow or is not connected to, limit sensitive content and require parental approval before users under sixteen can weaken certain protections.1

The age information is useful because it changes the product experience. If Instagram only confirmed that the user was fifteen and then gave that user the same default settings as an adult, the check would do little to address unwanted contact or unsuitable recommendations. The protective value comes from the restrictions applied after the user is identified as a teenager.

An age check can still fail in both directions. A child may enter an inaccurate date of birth and be treated as an adult. An adult may be incorrectly classified as a child and lose access to features. A method that depends on formal identity documents can also exclude children and adults who do not have the accepted document, even where the service itself presents little risk.

A service therefore needs to define the decision it is trying to make. It may need a reliable confirmation that someone is over eighteen. It may only need to know whether a user falls within a broad age range. It may need no age restriction at all if the relevant risk can be addressed through safer settings for everyone.

Safety after access

A child who is permitted to use a service still needs protection within it. The main risks may come from who can contact the child, what the recommendation system repeatedly shows, whether the child’s location is visible, how easily another user can save or redistribute an image, or whether a report produces any meaningful response.

Those risks call for product controls. Depending on the service, that may mean private accounts by default, restrictions on unsolicited contact from adults, limits on location sharing, age-appropriate recommendations, controls on livestreaming, effective blocking and reporting, and moderation that can respond quickly when a child reports grooming, threats or sexual content.

Parental tools can help, but they should not become the platform’s substitute for safer design. A parent may not understand every setting, may not be available when harm occurs or may not have the time to monitor each interaction. The platform still decides the default settings, which features it offers and how it responds when its systems detect or receive a report of harm.

When a parent runs the account

There is a separate issue where a parent or another adult runs an account that primarily features a child. Meta says adults may operate Instagram accounts representing children under thirteen if the account biography makes clear that the adult manages the account. It also says that it removes such an account if it learns that the child is operating it personally.2

The adult account holder may pass an age check without difficulty, but that does not remove the risk to the child whose images and videos are being published. The relevant safeguards may include strict message settings, filtering offensive or sexual comments, limiting discoverability, restricting the reuse of the child’s content and giving the adult clear tools to report suspicious contact. Meta’s decision to extend some Teen Account protections to adult-managed accounts that primarily feature children illustrates the problem. The age of the person controlling the account does not tell the platform everything it needs to know about who may be exposed to harm through it.3

This scenario should remain separate from a teenager using an account personally. In the first case, the platform is deciding how to treat a child user. In the second, it is assessing risks created by an adult-managed account that features a child. Both concern child safety, but they require different information and controls.

The Nigerian legal position

Section 31(2) of the Nigeria Data Protection Act 2023 requires a data controller to apply appropriate mechanisms to verify age and consent, taking available technology into account.4 Where a controller relies on consent for a child or someone lacking legal capacity, section 31(1) requires consent from a parent or legal guardian.5

Section 31(3) recognises a government-approved identity document as an appropriate mechanism, but it does not say that it is the only one.6 The method must still be considered alongside section 24, which limits personal data to the minimum necessary for the purpose, and section 28, which requires a data privacy impact assessment where processing is likely to create high risk.7

A white paper developed by Advocacy for Policy and Innovation in partnership with NITDA proposes age-assurance duties for online platforms.8 The paper describes a proposed framework and is not legally binding.9

The proposals extend beyond checking age. They include parental-supervision features, age-appropriate content filters, privacy settings, risk assessments and reporting mechanisms for parents and children.10 The White Paper therefore contains the beginning of a broader safety approach, although any eventual legislation will need to decide which obligations apply to different types of service and risk.

Choosing controls from the actual risk

The European Commission’s 2025 guidance under the Digital Services Act is not Nigerian law, but offers a useful design approach. Before introducing an age restriction, a platform should assess whether it is proportionate or whether less far-reaching measures could achieve a high level of safety. The guidance treats age assurance as a complement to other safeguards rather than a substitute for them.11

The assessment should begin with the service itself. Can strangers contact a child? Can adults search for or follow children? Does the recommendation system repeatedly promote distressing or sexual material? Can users share a child’s location, download an image or move a conversation into an encrypted or disappearing channel? How easy is it for a child to block another user, report conduct and understand what happened to the report?

Once those risks are clear, the platform can decide where age information is actually required and what other controls should apply. A strong age check may be justified before granting access to adult content. A learning community may obtain better protection from moderated membership, restricted messaging and careful handling of profile information. A service that does not need to identify its users should not collect identity documents merely because age assurance is available.

The DPIA should examine both sides of the decision. It should consider the harm that may follow if a child is treated as an adult, and the exclusion or privacy risk created by the age-assurance method itself. It should also examine the provider performing the check, the information it receives, how long it retains that information, whether its result can be challenged and what happens to a user who cannot complete the process.

Child safety online begins with the risks children face while using a service. Age assurance can help a platform apply the right protections, but confirming age is not itself the protection. The service still has to decide who can contact a child, what the child can be shown, which features are available and what happens when something goes wrong.

Footnotes

  1. Meta, ‘Introducing Instagram Teen Accounts: Built-In Protections for Teens, Peace of Mind for Parents’ (17 September 2024, updated 11 June 2025) <https://about.fb.com/news/2024/09/instagram-teen-accounts/amp/> accessed 24 September 2026. ↩
  2. Meta, ‘Expanding Teen Account Protections and Child Safety Features’ (23 July 2025, updated 23 October 2025) <https://about.fb.com/news/2025/07/expanding-teen-account-protections-child-safety-features/> accessed 24 September 2026. ↩
  3. Meta (n 2). ↩
  4. Nigeria Data Protection Act 2023, s 31(2) <https://ndpc.gov.ng/wp-content/uploads/2024/03/Nigeria_Data_Protection_Act_2023.pdf> accessed 24 September 2026. ↩
  5. Nigeria Data Protection Act 2023 (n 4), s 31(1). ↩
  6. Nigeria Data Protection Act 2023 (n 4), s 31(3). ↩
  7. Nigeria Data Protection Act 2023 (n 4), ss 24(1)(c) and 28(1). ↩
  8. Secretariat of the Online Harms Protection Bill Project, White Paper on the Framework for an Online Harms Protection Bill in Nigeria (Advocacy for Policy and Innovation in partnership with the National Information Technology Development Agency, December 2024) 67 <https://nitda.gov.ng/wp-content/uploads/2024/12/Updated-OHP-WHITE-PAPER-copy-compressed.pdf> accessed 24 September 2026. ↩
  9. White Paper on the Framework for an Online Harms Protection Bill in Nigeria (n 8) 3, 8. ↩
  10. White Paper on the Framework for an Online Harms Protection Bill in Nigeria (n 8) 67–68. ↩
  11. European Commission, ‘Guidelines on measures to ensure a high level of privacy, safety and security for minors online, pursuant to article 28(4) of Regulation (EU) 2022/2065’ [2025] OJ C/2025/5519, paras 31–33 <https://eur-lex.europa.eu/legal-content/EN/TXT/PDF/?uri=OJ%3AC_202505519> accessed 24 September 2026. ↩