Age Verification Methods

Age Verification and Estimation Methods

Overview

Age verification and age estimation are distinct but complementary approaches to determining whether a user is a child for the purpose of applying appropriate data protection safeguards. Age verification provides a definitive confirmation of age through documentary or transactional evidence. Age estimation provides a probabilistic assessment of age using technological methods such as facial analysis, behavioural analysis, or device signals. The selection of an appropriate method requires balancing accuracy, privacy impact, accessibility, and proportionality. This skill covers the full spectrum of available methods, their regulatory context under the GDPR, UK AADC, COPPA, and emerging legislation such as the EU Digital Services Act (DSA) and the UK Online Safety Act 2023, and provides implementation guidance based on ICO and CNIL recommendations.

Regulatory Context

GDPR Article 8(2)

"The controller shall make reasonable efforts to verify in such cases that consent is given or authorised by the holder of parental responsibility over the child, taking into consideration available technology."

The "reasonable efforts" standard is context-dependent. The EDPB has not prescribed specific technologies but expects controllers to adopt verification proportionate to the risk of the processing.

UK AADC Standard 3 — Age-Appropriate Application

"Take a risk-based approach to recognising the age of individual users and ensure you effectively apply the standards in this code to child users." The ICO guidance states that the level of certainty required depends on the risks to children from the processing. Higher risks demand more robust age assurance methods.

UK Online Safety Act 2023

Section 11(3) requires providers of regulated user-to-user services and search services to use "proportionate systems or processes" designed to prevent children from encountering primary priority content that is harmful to children. Ofcom's codes of practice specify age verification as a recommended measure for pornographic content and age estimation for broader content categories.

EU Digital Services Act — Article 28

Providers of online platforms accessible to minors must put in place appropriate and proportionate measures to ensure a high level of privacy, safety, and security of minors on their service. This includes age verification for services with content restrictions.

France — Loi SREN (2024)

France's law to regulate and secure the digital space requires age verification for access to pornographic websites, mandating technical solutions certified by CNIL that verify age without identifying the user. The CNIL-approved reference system requires a "double-blind" architecture where the identity verification provider and the content provider cannot link the user's identity to the content access.

Age Verification Methods

Method 1: Document-Based Verification

Description: User uploads or presents a government-issued identity document (passport, national ID card, driver's licence) which is verified against document security features and optionally against government databases.

Technical Implementation:

• Optical Character Recognition (OCR) extracts date of birth and document details
• Machine Readable Zone (MRZ) validation for passports and ID cards conforming to ICAO Doc 9303
• Document authenticity checks: hologram detection, microprint analysis, UV feature verification (for physical presentation)
• Optional: NFC chip reading for ePassports conforming to ICAO 9303 Part 10
• Optional: Liveness check to confirm the person presenting the document matches the photo

Accuracy: Very high (99%+ when combined with liveness detection)

Privacy Considerations:

• Collects highly sensitive identity data (ID number, full name, address, photo)
• Data minimisation: extract only date of birth, discard full document image immediately after verification
• Storage: do not retain the document image or full identity data; retain only a binary age-confirmed flag and a verification token
• DPIA required under Art. 35 due to large-scale processing of identity documents

Accessibility: Excludes individuals without government-issued ID (estimated 1.5 million UK adults lack photo ID per Electoral Commission 2021 data). Not appropriate as the sole method.

Use Cases: Age-restricted content (gambling, alcohol, adult content), high-risk services

Method 2: Facial Age Estimation (AI-Based)

Description: Machine learning models estimate a user's age from a facial image captured by the device camera. The estimation provides an age range (e.g., "over 18" or "13-17") rather than a precise age.

Technical Implementation:

• Convolutional Neural Network (CNN) trained on large-scale age-labelled facial datasets
• Real-time processing on-device (edge computing) to avoid transmitting facial images to servers
• Liveness detection to prevent spoofing via photographs or video replay
• Age estimation outputs a confidence interval (e.g., estimated age 14 +/- 2 years with 95% confidence)
• The facial image is processed in volatile memory and not stored

Accuracy: Mean Absolute Error (MAE) of 1.5-3 years depending on the model and demographic. Accuracy varies by: age group (lower accuracy for children under 8 and adults over 65), ethnicity (documented bias in some commercial systems), lighting and image quality.

Privacy Considerations:

• Facial images constitute biometric data under GDPR Art. 4(14) and Art. 9(1) if used for unique identification
• When used solely for age estimation (not identification), the processing may not constitute "biometric data for the purpose of uniquely identifying" under Art. 9 — the ICO has confirmed this interpretation in its Children's Code guidance
• On-device processing with no server transmission significantly reduces privacy risk
• DPIA is recommended even when processing is on-device due to sensitivity of facial data

Key Providers: Yoti (Age Estimation), VerifyMyAge (EstimateMyAge), Privately SA

ICO Position: The ICO has stated that facial age estimation technology that processes images locally, does not store images, and does not identify the individual can be a proportionate method for age assurance. The ICO conducted a joint audit with the Australian Information Commissioner (OAIC) of Yoti's age estimation technology in 2022 and concluded it met data protection requirements when implemented with appropriate safeguards.

Method 3: Digital Identity Verification

Description: User authenticates through a trusted digital identity provider (eID, digital wallet, Open Banking) that confirms age without disclosing full identity to the relying party (service provider).

Technical Implementation:

• OpenID Connect for Identity Assurance (OIDC4IDA) protocol for attribute-based verification
• The identity provider confirms a specific attribute (e.g., "is_over_18": true) via a signed assertion
• The relying party receives only the age attribute, not the user's name, address, or other identity data
• EU Digital Identity Wallet (eIDAS 2.0 Regulation, expected 2026 rollout) will enable selective attribute disclosure
• UK Digital Identity and Attributes Trust Framework (DIATF) provides a certification scheme for identity providers

Accuracy: Very high (dependent on the identity provider's verification of the underlying identity)

Privacy Considerations:

• Minimal data disclosure: only the specific age attribute is shared
• The identity provider knows the user's identity but not which service they are accessing (if double-blind architecture is used)
• The service provider knows the user is accessing their service but not their full identity
• Aligns with CNIL's recommended "double-blind" approach for age verification

Use Cases: EU/EEA services preparing for eIDAS 2.0 Digital Identity Wallet; UK services using DIATF-certified providers

Method 4: Self-Declaration with Risk Mitigation

Description: User declares their age through a date-of-birth field or age-range selector. The declaration is treated as the baseline, supplemented by risk-based measures to detect false declarations.

Technical Implementation:

• Neutral age prompt: "What is your date of birth?" with a scrollable date picker (no calendar default to current date)
• No indication of the "correct" answer or the age threshold being applied
• Behavioural signals that may indicate false declaration: immediate re-entry with a different date, cookie evidence of prior declaration, typing speed patterns inconsistent with the declared age
• If false declaration is suspected, escalate to a higher-assurance verification method

Accuracy: Low as a standalone method. Children commonly misrepresent their age online. Ofcom's 2023 research found that 33% of UK 8-17 year olds have a social media profile despite being below the platform's minimum age.

Privacy Considerations: Minimal data collection (only declared date of birth). No biometric processing. No identity document collection.

Use Cases: Low-risk services as a first-line screening measure, always combined with additional safeguards for medium and high-risk services