How Online Age Verification Works, and What Every Method Costs in Privacy

Age verification online is a fragmented market of methods that verify, estimate or infer a user’s age, from scanning a government ID to intercepting mobile network data, to scanning a credit-card number or to using facial recognition. No single method is definitively best: each incurs a privacy cost.

Even "age assurance", the proper term for anything done to guarantee that online users are adults, is not one technology.

The Office of the Australian Information Commissioner calls age assurance "an umbrella term for methods used to verify, estimate or infer an individual’s age or age range to determine eligibility for an online service or content", with specific techniques including everything from scanning identity documentation to using algorithms to estimate age.

No matter what technique is applied, the privacy cost is the data that the system gets to check or process light-weight verification when one sends a message to mobile operator. Heavy-weight verification is ID scanning. At the far end, services are being built where the owner will get mail that might include an age estimation badge.

The method spectrum

None of these techniques is perfect, which is why the online age-assurance market is still fragmented.

Scans of ID documents like driver’s licences and passports used to be by far the commonest form of age verification, even for online services, because they used the most reliable — and intrusive — personal data: dates of birth as third-party confirmed.

The European Commission last year produced a blueprint for an "age-18" technology that would let users prove they are over 18 for age-restricted content without revealing other personal information. One-time age proofs would be issued by separate entities, and a special soft-credential would be generated for each interaction with the service.

Even the most privacy-preserving schemes still involve some initial disclosure: the EU’s technical arbitration sets a single age verification provider who handles the biometric and identity check, but for the service itself does not learn which document was scanned.

The UK Information Commissioner’s Office summarises the range of approaches as including self-declaration, AI and biometric-based systems, and technical design measures.

The UK’s ICO and the Office of the Privacy Commissioner of Canada both recommend data minimisation, saying only enough personal data should be collected for the age check, that the personal data should be deleted after the age signal has been generated, and that providers of age assure systems should not use the data they collect for any other purpose.

The French authority CNIL adds that self-declaration is "needed" for age-assurance for pornographic content that the French criminal code codifies in Article 227-24 and elsewhere.

Where law bites

The French data-protection authority CNIL has noted that French law and certain European regulations instituted by French law impose age requirements, and mandates for adult verification on a range of services, such as online betting and online gambling.

The CNIL is emphatic that for pornographic content, this cannot rely on a simple self-declaration, because Article 227-24 of the French Criminal Code prohibits pornographic content from being, in general, accessible to minors.

Article 227-24 reads: "Any person shall be deemed to have a criminal intent to expose the public, male or female minors under 18, directly or indirectly to acts of sexuality, or pornography. Persons guilty of violating this article are liable to two years imprisonment and a fine of € 30.000."

What you should know

The methods involve a spectrum of disclosure. You know that.

The clearest evidence of the actual practices under age verification is that not one online age-verification system arrives at reliable adult verification only by declaring a single time only that the user is over 18. They all collect more data.

The EU blueprint establishes this by making the issuer verify the age with detailed personal information, like a date of birth, but only providing the services a proof.

And every national authority recommends data minimisation, deletion, and purpose limitation in principle, which means there is not trial that allows underage kids to define scope of the personal-data collection process.