Age Checks Answer Who. The Harder Question Is What

Britain has just promised to keep under-16s off social media and under-18s away from “romantic companion” chatbots. Behind every such promise sits an unglamorous engineering question: how do you actually decide, at scale and at speed, what to let through?

The problem we keep trying to legislate away

For most of the last decade, the worry that children are being harmed by the platforms they grow up on has moved steadily from parental anxiety to public policy. The headline figures are worrying. The U.S. Surgeon General’s 2023 advisory reported that up to 95% of 13- to 17-year-olds use a social media platform, with more than a third saying they use it “almost constantly”, and that nearly 40% of 8- to 12-year-olds use social media despite a common minimum age of 13. In Britain, Ofcom has found that roughly 38% of five- to seven-year-olds now use social media and almost a quarter own a smartphone.

Exposure to genuine harm is not hypothetical. Ofcom’s research indicates that nearly three-quarters (73%) of 11- to 17-year-olds encountered harmful content online within a four-week window, most commonly recalling it on TikTok. Australia’s eSafety Commissioner, re-analysing child-sexual-abuse-material reports from a single financial year, found that one in eight involved a perpetrator coercing a child into producing explicit material remotely, often after grooming through games and social platforms. Commissioner Julie Inman Grant warned that predators can “infiltrate your child’s world through smart devices, masquerading as children of a similar age.”

Where the evidence gets genuinely contested is causation. The Surgeon General’s advisory cites research finding that adolescents who spend more than three hours a day on social media were associated with double the risk of poor mental-health outcomes, a correlation rather than a demonstrated cause. Jonathan Haidt’s The Anxious Generation argues that a “phone-based childhood” drove a worldwide rise in adolescent depression and self-harm around 2010. Yet in a Nature review, psychologist Candice Odgers countered that the claim “is not supported by science,” and that fixating on social media may distract from the real drivers of the crisis. A large analysis by Orben and Przybylski, spanning roughly 355,000 adolescents, found the association between technology use and well-being negative but tiny, explaining at most about 0.4% of the variance; Przybylski noted that, in the same data, eating potatoes showed a similar association and wearing glasses a worse one. Other researchers stress the effects are highly individual: a review by Valkenburg and colleagues reports the impact as negative for around 28% of teenagers, positive for around 26%, and negligible for nearly half. The honest summary: the risks are real and well-documented, but the sweeping causal story is still unsettled.

Australia went first, and the results are mixed

Australia is the natural test case because it acted. Its Online Safety Amendment (Social Media Minimum Age) Act 2024 created a world-first ban on under-16s holding social media accounts, enforced from 10 December 2025, with platforms (not parents or children) facing fines of up to A$49.5 million for failing to take “reasonable steps” to comply. The ban covers ten major services, including YouTube, Instagram, TikTok, Reddit, Snapchat and X. YouTube was initially exempt on educational grounds, but that carve-out was later revoked after the regulator pointed to evidence that most 10- to 15-year-olds used the platform and many had encountered harmful content there.

The headline outcomes look impressive. By mid-December 2025, platforms had removed or restricted roughly 4.7 million under-16 accounts, with Meta alone reporting nearly 550,000 removals by the day after the ban began. Public support is strong: a YouGov poll found backing rising to 77%, up from 61% in an August 2024 poll. Inman Grant framed success in public-health terms, arguing that even if some children find workarounds, success is measured by “reduction in harm and in resetting cultural norms,” not by account counts alone.

The criticisms are equally serious. In October 2024, over 140 experts signed an open letter warning that a “ban” is “too blunt an instrument”. Enforcement has proven leaky: a Molly Rose Foundation survey found more than 60% of teens who had accounts before the ban still had access to at least one platform, circumventing checks with a parent’s Face ID, printed mesh masks from Temu, and VPNs. One Australian study reported that 61% of under-16s saw “no or little change” in their use. Privacy advocates warn that age-checking turns platforms into “de facto identity-arbiters” storing millions of sensitive biometric records, which one academic called “the worst possible outcome.” The Cato Institute argues the ban pushes children toward fully encrypted spaces where “it will be far harder for adults to intervene and stop bad actors”. And age checks displace rather than dissolve demand: when Britain enforced Online Safety Act checks in July 2025, Proton reported a more than 1,400% surge in UK VPN sign-ups.

Britain has now chosen to follow. On 15 June 2026, Sir Keir Starmer announced a ban on under-16s using platforms including Snapchat, TikTok, YouTube, Instagram, Facebook and X, explicitly modelled on Australia, with WhatsApp and Signal excluded and livestreaming and stranger contact switched off by default for 16- and 17-year-olds. Around nine in ten parents backed it, with Ofcom set to study effective age assurance and rules due in spring 2027. Notably, Britain went further than Australia on AI: under-18s are to be barred from “romantic companion” chatbots, which must enforce a minimum age of 18, with similar intimate functionalities restricted more widely, though exactly how this will be implemented remains unclear.

The hard part: deciding what to block

Age assurance answers who. The quieter, equally hard question is what: how a system decides, for a given piece of text, whether it crosses a line. This matters acutely for the new AI rules, where the requirement is not “verify a birth date” but “do not let this conversation drift into restricted territory.” Four broad approaches exist, each trading speed against cost against robustness.

The oldest is the keyword or regular-expression blocklist, a list of forbidden strings. It is instant and nearly free, but notoriously brittle. The classic failure is the Scunthorpe problem, named after a 1996 incident in which AOL’s profanity filter blocked residents of the English town because its name contains an offensive substring. Blocklists cannot read context, so they over-block innocent phrases and under-block anything phrased creatively.

The most common is the guard LLM, a second model that reads the conversation and judges it. Meta’s Llama Guard is a 7-billion-parameter model that classifies both prompts and responses as safe or unsafe. Anthropic reports that its Constitutional Classifiers cut jailbreak success from 86% to 4.4%. This sophistication is expensive. Running a second model adds inference latency and an extra call, and output checks must wait for the full response before judging it. There is a clear trade-off between defence sophistication and resource intensiveness. And because a guard LLM reasons over instructions, it can be argued out of its judgement: against adaptive attacks, most guardrails’ attack-success rate exceeds 90%, and they struggle with novel jailbreaks lacking clear patterns.

In between sit dedicated lightweight classifiers, purpose-built models like Detoxify, a fine-tuned BERT that outputs fixed categories, or Google Jigsaw’s Perspective API. OpenAI’s moderation endpoint is free. These are fast and cheap, but inherit context-blindness: profanity tends to be flagged regardless of tone or intent, and the categories are fixed in advance.

The newest approach is embedding plus a lightweight probe. Text is converted once into a numeric vector capturing its meaning, then a small classifier scores that vector. Research shrinking such a guard from Llama Guard’s 7 billion parameters to about 67 million while keeping comparable performance reported inference of about 0.05 seconds versus over 140 seconds for a fine-tuned Llama Guard on the same GPU. Cheap classifiers such as logistic regression and gradient boosting, trained on embeddings, can even detect prompt-injection attacks.

Method	Speed	Cost	Accuracy / robustness	Notes
Keyword / regex blocklist	Instant	Negligible	Brittle; many false positives	The Scunthorpe problem; no context awareness
Guard LLM (LLM-as-judge)	Slow; waits for full response	High; extra model call	Strong, but jailbreakable by persuasion	Adaptive-attack success can exceed 90%
Dedicated lightweight classifier	Fast	Low; free options exist	Decent but context-blind, fixed categories	Flags profanity regardless of intent
Embedding + probe	Fast; ~0.05s in research	Low; one embedding pass	Measures meaning, not surface text	Probe scoring is simple arithmetic

How Hyperfence approaches the problem

Hyperfence is built around the last of these approaches, and the under-18 intimate-AI rule is exactly the kind of problem it is designed for. It is an LLM proxy that sits between an application and its model provider, checking text in both directions. Its tagline, “Provably safe, not ‘probably safe’,” captures the design intent. The company describes the product as a way to “detect policy violations and block harmful prompts or responses deterministically, faster and cheaper than a second guard LLM”.

Underneath, the idea is simple. Incoming or outgoing text is first turned into a numeric vector that captures its meaning rather than its spelling, an embedding. A small, pre-trained linear “probe” then checks which side of a learned boundary, the “fence,” that meaning falls on, and the system allows or blocks accordingly. The crucial property is where the time goes. The embedding pass is millisecond-scale work, and the probe’s decision is just a tiny arithmetic operation, microsecond-scale. Because the embedding measures meaning, the Scunthorpe problem largely dissolves: “Scunthorpe” sits nowhere near obscenity in meaning-space.

The cost argument follows directly. There is no second LLM call, and so no additional per-token charge, no “token tax” levied on every request just to police it. And because the probe scores meaning rather than reasoning over an instruction, it is not susceptible to the persuasive jailbreaks that can talk an LLM judge into compliance; the same input yields the same decision, conditional on the embedding. For streaming, response chunks are validated before release, preserving the live experience while preventing blocked content from leaking out.

Two modes cover the practical cases. Block mode blocklists a topic, for instance sexual content, the natural fit for the new under-18 restriction. Hyperfence ships with a bundled sexual-content filter that can be enabled. Allow-only mode inverts the logic: an online retailer could allow its customer-service chatbot to discuss only its products and the company, and block anything off-topic. This also blunts a now-familiar kind of misuse, where users coax a company’s chatbot into unrelated work, in effect a free general-purpose assistant running on the firm’s bill, or steer it into off-script commitments. In one well-publicised case, a Chevrolet dealership’s assistant was talked into “agreeing” to sell a car for $1 and into writing software, before the dealer pulled it offline. Because the fence is drawn around meaning, an off-topic request is refused however cleverly it is worded. Policies are set per customer or token and can be hot-reloaded.

Conclusion

The legislative direction is now clear: Australia has acted, Britain is following, and the AI provisions push the problem from who is online to what a conversation is allowed to become. The lesson from Australia is sobering. Accounts were removed by the million, yet one analysis cited by The Conversation found that around 70% of children retained active accounts, and the underlying mental-health science remains genuinely contested. Whatever one makes of the bans, the engineering beneath them deserves the same scrutiny as the politics. Deciding what to let through, at speed and at scale, is not a solved problem; it is a set of trade-offs. Approaches that judge meaning cheaply and deterministically, like the embedding-and-probe model Hyperfence builds on, belong in that toolkit: not a complete answer on their own, but a fast and predictable way to help decide where the line should fall.

The problem we keep trying to legislate away

Australia went first, and the results are mixed

The hard part: deciding what to block

How Hyperfence approaches the problem

Conclusion

Sources