Loading story…
Microsoft is expanding Windows Family Safety with Microsoft-account-based age verification and more prominent parental-control and consent options. Its Microsoft Age Verification (MAV) service will allow users to verify their age once through a Microsoft account, then reuse that verification status across Microsoft products and Windows experiences.
New Windows Age APIs let compatible applications receive non-identifying age ranges and determine whether account-level age verification has been completed without access to a user's full date of birth. The APIs may ultimately classify users as children, minors, or adults under regional policy; they are available to Windows Insiders ahead of a broader rollout, while enhanced parental-control onboarding is being introduced in France and other regions.
See the reporting duties and controls this puts on the clock.
1 event from the most recent confirmed update back to the earliest known activity.
Microsoft introduced Windows Age APIs and expanded Microsoft Age Verification, enabling applications to receive privacy-preserving age ranges and account-level age-verification status. The APIs are available to Windows Insiders, while Windows setup in France and other regions is surfacing parental controls and consent options more prominently.
Vulnerabilities, threat actors, malware, products, organizations, and breaches Mallory has linked to this story.
See what this changes for your reporting obligations and which controls it puts on the clock.
4 references tracked. Mallory keeps watching after this page renders.
xakep.ru
Open sourcecryptika.com
Open sourcecybersecuritynews.com
Open sourceblogs.windows.com
Open sourceMap indicators from this story to your assets and identify affected systems in minutes.
Every observed campaign, victim, and pivot linked to actors named in this story.
Malware, exploits, and IOCs connected to the activity described here.
YARA, Sigma, and Snort rules deployed to your SIEM as soon as they’re published.
Get matching new stories delivered to your team as they break — not the next morning.
Ask questions about this story and take action on the answers.
Other stories Mallory is tracking that overlap on entities, sources, or topic labels.
California’s **Digital Age Assurance Act (AB 1043)** establishes a statewide requirement for *operating system providers* to collect a user’s age information during OS account setup and expose an age-range signal to application developers through a “reasonably consistent” real-time API when an app is downloaded or launched. The law’s definition of OS provider is broad enough to include major commercial platforms (**Windows, macOS, Android, iOS**) as well as **Linux distributions** and **Valve’s SteamOS**, and it specifies four age brackets: *under 13*, *13 to under 16*, *16 to under 18*, and *18+*. Developers who request and receive the signal are treated as having “actual knowledge” of the user’s age range, shifting compliance and content-suitability liability toward app providers; enforcement is assigned to the California Attorney General with penalties up to **$2,500 per affected child** for negligent violations and **$7,500** for intentional violations. Separate reporting highlights broader **age/identity verification** pressure across consumer platforms, including Discord’s planned move to require age verification in 2026, which has triggered privacy concerns about submitting government IDs or face scans and renewed scrutiny following a prior breach that exposed IDs for roughly **70,000 users**. Other items in the set are not about AB 1043 or OS-level age signaling and instead cover general security roundups, interviews, conference write-ups, exam prep material, and unrelated policy or industry commentary; they do not add substantiated details about the California OS age-verification mandate or its implementation requirements.
Jun 29, 2026
Discord has begun a global rollout of age assurance that classifies users as adults, teens, or unconfirmed and automatically applies age-appropriate access restrictions. The company says more than 90% of users should not need to actively verify their age; adults who are misclassified can use an eligibility-confirmation process to regain access to age-restricted content. The deployment builds on Discord’s earlier global **teen-by-default** safety settings. The rollout replaces Discord’s February proposal to require facial age estimation or government-ID scans before users could enter age-restricted spaces. Discord revised the approach after substantial privacy backlash, sharpened by a 2025 compromise at a third-party verification provider that exposed government IDs for 70,000 Discord users in the UK and Australia. Organizations should note the reduced reliance on explicit identity checks but continue to assess how Discord’s age classification and appeal processes affect employee, community, and youth-safety use cases.
Sep 25, 2026
Apple introduced expanded *age assurance* capabilities for the App Store to support compliance with new or emerging regulations in multiple jurisdictions, including Brazil, Australia, Singapore, Utah, and Louisiana. As of **Feb. 24, 2026**, Apple began blocking downloads of **18+ rated apps** in Brazil, Australia, and Singapore unless the user is confirmed to be an adult, using what Apple describes as “reasonable methods” for age confirmation. Apple also expanded the **Declared Age Range API** (iOS/iPadOS/macOS) and related platform components (including PermissionKit’s *Significant Change API*, a new StoreKit age-rating property type, and App Store Server Notifications) to provide developers with an age category plus signals about the assurance method and whether regulatory requirements apply; in Brazil, certain disclosures (e.g., loot boxes) can drive an app’s rating to **18+**. Broader policy debate continues around online age assurance in the U.S. and internationally, with jurisdictions adopting or considering stricter mandates and platforms preparing new verification requirements. Public skepticism remains elevated due to backlash against age-gating (including reported VPN usage spikes in response to the UK’s requirements) and concerns about data security following breaches at age-verification providers (e.g., **Sumsub** disclosing a previously undetected 2024 compromise). The policy environment is also being shaped by U.S. state laws and litigation, including the Supreme Court’s decision in *Free Speech Coalition v. Paxton* upholding Texas’s age verification law, while proponents argue that privacy-preserving age assurance approaches are becoming more technically mature and scalable.
Jun 29, 2026