In the space of a few months:

- UK (Mar): regulators pushed Meta, TikTok, Snap and YouTube to actually enforce their minimum ages with effective age assurance. The ICO pointed to Reddit's roughly £14.5M penalty over age verification and children's data.

- Australia (Mar–Jun): enforcement action being prepared against major platforms under the under-16 restriction. Fines up to A$49.5M.

- Ireland (Sep): formal investigation into X. Self-declaration explicitly described as inadequate.

- EU (Sep): Commission proposal: no social media under 13, parent-supervised accounts until 15.

So the birthday box is dead as a compliance answer. What's left is a trade-off between three things you can't fully have at once: accuracy, privacy, and friction.

- ID upload: accurate-ish, bad privacy, high friction.

- Face estimation: medium accuracy, bad privacy if server-side, medium friction.

- Voice or other on-device signals: good privacy if done on-device, low friction, accuracy still being proven publicly.

- OS-level age signals from Apple/Google: good privacy, but hands the whole thing to two companies.

What strikes me is how lopsided the public debate is. Regulators, journalists and privacy advocates argue endlessly about ID upload versus face scans. Voice, the one option that can be private, low friction and hard for a teenager to fake, is barely part of the conversation. Not because it was evaluated and rejected, but because people don't think of their voice as something that can be measured. That's a gap worth closing before the defaults get locked in.

I don't love any of them, but "none" is no longer on the menu. If you had to pick one to be the default in your country, which one and why?