If you have a kid or teen at home, you’ve probably heard of Roblox—an online gaming platform where millions of users create, share and play games in a virtual world with its own currency.

The company’s new age verification requirement for users under the age 13 sounds like a smart safety measure, but it actually highlights a critical vulnerability affecting gaming platforms, social media sites and any technology company relying on camera-based authentication to protect minors online.

Vir Phoha, professor of electrical engineering and computer science at Syracuse University and a Fellow of the Institute of Electrical and Electronics Engineers (IEEE) and American Association for the Advancement of Science, warns that these systems may create a false sense of security. His research focuses on cybersecurity, machine learning and biometrics—including touch-based and network-based authentication systems.

While AI-powered facial recognition can estimate age within two to three years by analyzing wrinkles and skin condition, Phoha warns the systems are “highly susceptible to spoofing.” Simple presentation attacks—like a printed photo, a smooth mask to mimic younger skin or even a silicone dummy face—can fool verification systems, especially when users authenticate through their own laptop or phone cameras lacking sophisticated liveness detection.

As more platforms implement age verification requirements to comply with child safety regulations, Phoha says the technology may create a false sense of security.

Phoha answers three questions about the effectiveness of this technology and is available for interviews on biometric authentication, age verification technology and cybersecurity topics.

What are the the challenges and effectiveness of systems that collect biometric information via palms, eyes, face, etc.?

“Typically, age estimation from a face using a camera relies on features such as wrinkles, skin condition and sagging. The deep learning (AI) models are trained on millions of labeled faces to recognize age-specific features on a face. The training labels adjust for gender, race, etc. Although literature supports high accuracy in age estimation, ranging from a difference of two to three years, I believe the methods are highly susceptible to spoofing.

“Also, the accuracy of authentication methods depends on lighting conditions, pose etc. Typically, the features of the account for the variations in light, pose, etc. Literature also suggests using eyes and typing patterns, including the use of language to predict age, although these studies are not common.”

Tell us more about authentication methods and their reliability for protecting minors online.

“Most authentication is done through deep learning and pattern recognition algorithms. However, all camera-based methods are susceptible to spoofing. Earlier experiments of presentation attacks showed that a copy of a face printed on paper was able to fool the system, because the proposed system by Roblox will use 3D, which can also be fooled, for example, by a simple skin colored (smooth mask to appear as younger, healthier skin). Or a dummy 3D face made of silicone. Because the verification of an individual’s face may be done using the individual’s (laptop or desktop) camera, it will likely not have sophisticated hardware to test for liveness, such as twitching, blood flow, sweat glands, etc.”

What are the broader implications for how tech platforms balance safety with privacy concerns?

“If the features of the face (and not the images of the face) are stored (or destroyed immediately) after collection, one can hope that no personally identifiable information will be discernible.”