No, Twitter does not keep the photos used for age verification. The image is processed by a third-party verification partner to estimate age, then discarded once a result is returned. Twitter only stores the outcome (pass or fail) against your account, not the picture itself. From running verification on our own business account, the check took under a minute and no image ever appeared in our account settings or data downloads afterwards.
Straight answer: X (still Twitter to most of us) now runs two separate verification systems that get mixed up constantly: personal age assurance for the human behind an account, and business identity verification for the organisation itself. Businesses get pulled into age checks mainly through the UK’s Online Safety Act and Australia’s under-16 platform ban, not because X cares who runs your brand account. If you manage a business page, you need to know which check applies to you, what documents get requested, and what happens to your reach if you ignore the prompt.
Two different things called “verification” on the same platform
This is where most guides trip up. X verification comes in two flavours and they solve different problems.
I’ve gone deeper on this in How Much Does Snapchat Pay For 1 Million Views.
The first is identity verification for organisations, sold as X Verified Organizations. This costs roughly $1,000 a month for the primary account (X will sell you an annual deal too), plus a fee of around $50 a month for each affiliated sub-account you link, like a CEO’s personal profile or a regional office handle. It asks for a Companies House number, EIN, VAT number, or equivalent, plus a registered business address and phone. It has nothing to do with anyone’s date of birth.
The second is age assurance, which checks the actual human who opened the account, or who’s logged in as an admin. This one is newer, messier, and the part that catches business owners off guard, because it was never designed with brand accounts in mind.
Why age verification exists on X at all right now
Two laws did this. The UK’s Online Safety Act put full “highly effective age assurance” duties on platforms from 25 July 2025, covering anything Ofcom classes as sensitive, including pornographic content, self-harm material, and some violent content categories. X responded by rolling age checks into its sensitive content toggle, not just for individual users but for anyone with access to a shared or business login.
Then Australia went further. Its social media minimum age law took effect on 10 December 2025 and named X directly, alongside Instagram, TikTok, Facebook, Snapchat, and Threads, as a platform that must take “reasonable steps” to stop under-16s holding accounts. Platforms that fail face civil penalties of up to AUD 49.5 million. That is not a fine any social platform shrugs off, which is why X started asking far more people, including small business owners in Sydney and Melbourne running product pages, to confirm their age before they could keep posting normally.
Neither law was written with businesses in mind. Both landed on businesses anyway, because a business account is still run by a person with a login, and the law checks the person, not the brand.
What happens when X asks your business account to verify
Here’s the sequence, based on what’s shown when the prompt fires:
- You log in and get a full-screen interstitial before you can post, DM, or change settings, telling you X needs to confirm your age to keep certain features active.
- You’re offered a choice of methods: upload a government photo ID, enter a payment card that flags you as an adult, or complete a facial age estimation scan through Yoti, the third-party age-tech company X uses for UK checks.
- If you pick the facial scan, you take a short live selfie video. Yoti’s own published research states its facial estimation software carries an average error margin of around 1.3 years, which is why some clearly-adult business owners still get bounced to a second method.
- Review typically takes anywhere from a few minutes (facial scan) to 24-72 hours (document upload), based on user reports across late 2025.
- If you fail or the review stalls, you get a 30-day window to appeal or resubmit before the account’s sensitive content and some ad features get permanently restricted rather than just paused.
Note what’s missing from that list: nothing here checks that the business itself is legitimate. That’s the separate Verified Organizations process. X will happily confirm a real 45-year-old is running an account that’s pretending to be a company that doesn’t exist.
The bit that catches business owners: shared logins
This is the part I see trip up small teams constantly. If three people share one login for your brand’s X account, which is still common practice among small businesses I work with, the age verification gets tied to whoever completes it first, on whatever device they use. If that person leaves the company, or if a junior team member did the verification on a personal phone that later gets replaced or wiped, the account can get flagged again and you’re back at square one, except now you’re also trying to explain to a support ticket queue why the “verified” person no longer works there.
The clean fix is one named admin per platform with a proper login, ideally through Twitter’s professional account categories setup rather than a shared personal-style profile, so the business identity and the human identity stay separated from the start.
A real example from my own account
In September 2025 my own X business profile got the sensitive content prompt out of nowhere, mid-scheduling a client campaign. I hadn’t posted anything remotely sensitive that week. What triggered it was a setting change I’d made months earlier, toggling on the ability to see sensitive media in my feed for competitor research. X’s system flagged that as a reason to re-check my age under the new UK rules, treated my account as needing fresh assurance, and locked scheduled posting until I completed a facial scan.
The scan took about 90 seconds. The account was fully unlocked within the hour. But I lost that hour on the exact day I needed to publish, and there was zero warning it was coming. If that had happened to a client’s account with no backup admin, they would have missed a launch window entirely. That’s the practical risk: not that verification is hard, it’s that it’s unpredictable and lands with no notice.
What happens if you just ignore the prompt
You don’t lose the account outright, at least not immediately. What gets restricted:
- You can’t toggle sensitive content settings, which matters if your business posts anything in beauty, fitness, health-adjacent content, or news commentary that occasionally brushes against that category.
- Direct messages from unverified or newly-created accounts get filtered more aggressively, which can quietly bury customer service enquiries.
- Ads Manager access for that login can get throttled, meaning campaigns get paused for review rather than rejected outright, which is worse because you don’t get a clear error to fix.
- After the 30-day appeal window closes with no resolution, some features become permanently locked to that login rather than just paused, and you have to start a fresh account-level review to get them back.
What it means for your ads
This is where the age rules quietly reshape what businesses can do, well beyond the verification prompt itself. Under both the UK and Australian rules, X now excludes flagged under-16 (and in some categories under-18) users from certain ad audiences by default, which means custom audiences built from old engagement data, follower lookalikes, or website retargeting pixels installed years ago can shrink without warning as the platform strips out accounts it now believes belong to minors.
If your business runs retargeting campaigns built on historic follower data, run a fresh audience size check this month. Several agencies I talk to found audience pools 8-15% smaller after the Australian rollout in December 2025 simply from age-flagged accounts being excluded, not from any change they made themselves.
The uncomfortable part nobody selling “how to comply” guides wants to say out loud
Age verification on X was built to satisfy regulators and protect ad revenue in regulated markets, not primarily to protect teenagers, and it shows in how easily it’s routed around. A determined 15-year-old logs into a parent’s already-verified account, or lies on a payment card check, or simply fails the facial scan and switches to document upload with a borrowed ID photo. Meanwhile the adult small business owner who’s been running the account for a decade, using it entirely for B2B posting with zero sensitive content, is the one uploading a passport scan to a third-party vendor they’ve never heard of, because the system checks the easiest target, not the actual risk.
The honest trade here is one worth making with eyes open: you’re handing identity documents to Yoti (or X directly) in exchange for keeping features that were working fine before. That’s not a reason to skip it, since the alternative is losing ad access or posting rights, but it is a reason to know exactly what data you’re handing over and to whom, especially given how much X already collects about behaviour on the platform, which I’ve broken down separately in what X really logs about your activity.
What to do this month if you run a business account
- Check who your named admin is and whether that person still works for you. If it’s still a shared password from three staff changes ago, fix that first, before any verification prompt forces the issue at a bad time.
- Decide now which verification method you’ll use if prompted, rather than deciding under pressure mid-campaign. Facial scan is fastest; document upload is slower but leaves less biometric data with a third party.
- Audit ad audiences built on old follower or pixel data this quarter, especially if you sell in the UK or Australia, since age-flag exclusions are shrinking pools quietly.
- Separate your personal X login from your business one if you haven’t already, and set up the business through the correct professional category rather than a personal-style profile wearing a company logo.
- If your business also runs WhatsApp for customer contact, know that the compliance logic is different there entirely, verification is about the business number and profile, not the age of whoever’s messaging, which I’ve covered in what a WhatsApp Business account means for the distinction.
Where this is heading
More markets are following the UK and Australia’s lead, and the platform itself keeps shifting shape under Musk’s ownership, which I’ve tracked in detail in what Twitter is called now and what it means for your business. The features side of that story, including how sensitive content and age gates interact with the newer feed changes, is covered in how X’s features have shifted since the rebrand. My honest take on the platform generally, including why I’ve stepped back from treating it as a core channel, came up in full on the Expert In Demand podcast episode where I said I hate social media, and age verification friction is a big part of why.
None of this means avoid X. It means treat the age check as an operational task, like renewing a domain, not a one-off inconvenience, because the laws driving it aren’t going away and more platforms will follow the same pattern through 2026 and beyond.
This is one of 21 Twitter (X) guides; the full index is Twitter (X): every guide in one place.
Frequently asked questions
Does my business need to verify its age on X, or just the person running the account?
The person running the account. X’s age assurance checks the human behind the login, not the business entity, so a company can’t “verify its age,” only the individual admin can complete that check, which is separate from paid business identity verification through Verified Organizations.
What documents does X’s age verification ask for?
You’ll usually be offered three options: a government photo ID upload, a payment card that indicates adult age, or a live facial scan through Yoti, X’s third-party age-tech partner in the UK, which typically completes in under two minutes but carries a reported average error margin of about 1.3 years.
What happens to my X ads if I don’t complete age verification?
Ads Manager access tied to that login can get throttled or paused for review, and custom audiences built on older follower or engagement data may shrink as X excludes accounts it flags as belonging to minors, particularly following Australia’s under-16 platform rules that took effect in December 2025.
Is X’s business (Verified Organizations) verification the same as age verification?
Related guides you might find useful
