A 12-YEAR-old taps on a social media sign-up page, and so does a 13-year-old. Under Sen. Erwin Tulfo’s Senate Bill (SB) 595, one of them gets through. The other can follow, but a parent has to say yes first. At least four other minor-safety bills are pending in the Senate. The algorithm is supposed to know the difference. Australia and Malaysia require platforms to keep under-16s from holding accounts. The Philippines is attempting something more layered. SB 595 would block children under 13 from social media while requiring verified parental consent for teenagers ages 13 to 17. The design balances child protection with teenage autonomy within a single year.
The National Privacy Commission (NPC) has flagged concerns about collecting minors’ data for this purpose. The bill threatens third-party verifiers with fines of up to P5 million if standards fail.
In an email interview, Oon Ee Khoon, senior vice president and managing director for Asia-Pacific at Jumio, a global identity verification firm, described the technical bind. “The one-year margin between a child who is 12 (banned) and 13 (restricted) is a significant technical challenge for the entire industry,” he wrote. The technology many readers associate with “age verification” is really age estimation, which falls short of the bill’s thresholds.
Why estimation breaks at 13
Age estimation uses artificial intelligence (AI) to guess a user’s age from facial features. It is quick and keeps sensitive documents out of the flow. For adult-only services, it works well enough. Khoon pointed to online gambling, where the gate is age 18.
At the 12-to-13 threshold, the margins tighten quickly. Global privacy laws limit training data for minors, and children rarely carry identification beyond a birth certificate. A child who looks older, or a teenager with what he called a perpetual “baby face,” is easily misread. Face-only estimation is not reliable unless it reaches 99 percent confidence, he said, and that bar is difficult to meet at a regulatory cutoff.
The firm’s position: high-stakes gates need full identity verification — a government-issued ID paired with a live selfie, with the birth date pulled from the document. Liveness checks catch tampering, and the selfie prevents a child from presenting a parent’s ID. “This approach trades probability for certainty: it doesn’t just estimate an age, it confirms that the user is who they say they are,” Khoon wrote. The process is similar to what most people already do to unlock a phone.
Registration with the Philippine Identification (PhilID) system becomes increasingly important, he said. Without a credential for minors, there is no fixed point for any verifier to check against.
Seeing through synthetic faces
Teenagers live among AI aging filters, and any parent with a selfie app knows how convincing they can be. These are generally 2D overlays or 3D animations, Khoon explained, and advanced liveness detection reads how light reflects off skin and how shadows fall across a face.
Enterprise systems also defend against deepfake videos and digital injections, where attackers push a fake file into the verification stream to bypass the camera. Jumio cites its ISO/IEC 30107-3 Level 2 Presentation Attack Detection conformance, an independent test of aggressive spoofing. In a regulated setting where one failure could cost P5 million, he wrote, “‘confident enough’ is grounded in the proven accuracy of our scans, not a guess.”
Audited systems give regulators a defensible floor, and SB 595’s penalty clause tests that floor.
Where burden should sit
Verified parental consent for the 13-to-17 bracket is not a checkbox. Khoon framed it as a shared responsibility. Parents sit at the center, deciding what their child is ready for, but only if platforms give them a real on-ramp rather than a buried toggle. Third-party verifiers carry the technical load and absorb part of the legal risk under SB 595. He wrote that consent “should not be a passive click, but a conscious decision by a responsible adult.”
That choice reshuffles the market for verifiers. Apple’s Declared Age application programming interface (API) pushes the burden of proof to app developers rather than the device maker. Platforms in the Philippines will want a verifier with independently audited liveness detection and a banking-sector track record whose data practices align with NPC rules. Khoon said the advice to Southeast Asian clients right now is to bring verification and monitoring under one roof — less to rebuild when the rules change.
For Filipino families, the picture is calmer than the headlines. The technology to verify age without surrendering a life’s worth of data already exists. What the country lacks at scale is a verifiable credential for the children the bill is meant to protect. A 12-year-old without a PhilID is still the hardest user to verify, and no algorithm is about to change that.
