What is the difference between age assurance and business user verification under the Digital Services Act?

Age assurance is about confirming whether a user is above or below a relevant threshold so platforms can apply child protections and ad restrictions appropriately. Business user verification is about identifying sellers on marketplaces so the platform knows who is trading and can suspend or contact them if needed. Both support trust, but they solve different governance problems.

How the two verification problems differ in practice

age assurance is a threshold question: can the service establish that a person is old enough or young enough for a particular rule set to apply? Under the digital services act, that is usually about child protection, age-gated access, and advertising limits. Business user verification is an onboarding and accountability question: can the marketplace identify the trader behind an offer, so the platform can enforce seller obligations, contact the trader, and act on complaints or suspensions.

The distinction matters because the platform is solving two different governance problems. Age assurance is primarily about reducing exposure to minors and proving a user sits on the right side of a policy boundary, while business user verification is about establishing who is commercially operating on the service and linking listings to a verifiable trader. Those goals can overlap operationally, but they are not the same control.

For age-related controls, the relevant question is whether the method is proportionate to the risk and the data minimisation requirement. A strong implementation can confirm eligibility without turning age checks into full identity collection. For business verification, the platform usually needs stronger attribution, because the control has to support seller accountability, notice handling, and enforcement against a trading entity rather than an anonymous account.

When these are conflated, teams either over-collect data for age checks or under-verify sellers and lose enforceability. The Digital Services Act pushes both functions toward trust and safety, but the operational design should stay separate: age assurance protects the user population, while trader verification protects marketplace integrity.

What each control is trying to prove

Age assurance is typically evidence about eligibility, not identity completeness. A platform may only need to know whether someone is above or below a threshold, or in some cases place them into a broad age band. That supports child protection measures, age-appropriate experiences, and ad targeting limits without necessarily revealing the person’s full legal identity.

Business user verification proves something different. The platform is trying to establish that a seller is a genuine business user, identify the responsible trader, and retain enough information to support marketplace governance. This is less about a single age boundary and more about trader traceability, regulatory contactability, and enforcement readiness.

Because the DSA treats online marketplaces and user protection differently, the verification logic should also differ. A platform can use lighter-weight age checks for content access or ad constraints, but seller verification should be designed to survive complaints, fraud inquiries, and suspension workflows. The control objective, not the technical mechanism, determines how much confidence is required.

For a useful external reference on identity proofing and assurance levels, NIST SP 800-63 Digital Identity Guidelines is a strong benchmark for thinking about assurance, even though the DSA use case is regulatory rather than purely authentication-focused. For marketplace controls, OWASP ASVS is useful where implementations need stronger expectations around authentication, session handling, and access control around seller accounts.

Risk and Threat Considerations

The main risk is using the wrong verification standard for the wrong policy objective. If age assurance is treated like full identity proofing, platforms may collect more personal data than they need and create unnecessary privacy and retention exposure. If business user verification is too weak, marketplaces can be populated by untraceable sellers, which undermines consumer trust, incident response, and enforcement.

Failure mechanism: Age checks can fail by over-collecting identity data, while seller verification can fail by accepting superficial business details that do not establish a traceable trader. In both cases, the platform ends up with compliance theatre instead of a control that can actually be enforced.

Impact: Weak age assurance increases the chance that child-protection rules and ad restrictions are applied inconsistently; weak business verification increases fraud, takedown friction, and difficulty contacting or suspending sellers. At scale, the second failure is especially damaging because marketplace abuse can propagate across many listings before it is detected.

Standards & Framework Alignment

This section maps relevant standards and security frameworks to the operational risks and controls described in this guidance.

NIST SP 800-63 provides the primary governance reference for this topic.

Framework	Control / Reference	Relevance
NIST SP 800-63	IAL/AAL/FAL — Identity Assurance, Authenticator Assurance, Federation Assurance	Age assurance relies on confidence levels and proofing strength.
Recommendation — Map the age-check workflow to the minimum assurance level needed for the policy decision.

Practitioner Guidance

What to verify: Decide first whether the workflow needs a threshold decision or a trader attribution decision. If the answer is “threshold,” minimise retained data and test whether the control still works if the platform never stores a full identity record. If the answer is “trader attribution,” require evidence that the seller can be traced, contacted, and actioned, not just that an account was created.

Common mistake: Treating both controls as generic “verification” leads teams to design one process that is either too intrusive for age assurance or too weak for seller governance. The better pattern is to align evidence collection to the enforcement action you expect to take later, because that is what determines whether the control is fit for purpose.

Practitioner takeaway: If you cannot explain what enforcement action the verification will support, the control is probably underspecified, and the DSA distinction between age assurance and business user verification has been lost.