Age assurance providers all claim to be accurate, private and compliant, but the evidence behind those claims varies enormously, and a weak choice shows up as children getting through, adults being turned away, or a regulator asking how you know your checks work. Regulation is now driving purchases: in the UK, Ofcom expects "highly effective" age assurance under the Online Safety Act, and the European Commission has published an age verification blueprint built on the EU Digital Identity Wallet specifications. This vendor-neutral buyer's guide helps product, trust and safety, privacy and security teams set requirements, compare facial age estimation, document checks, data-based checks and reusable age tokens, test accuracy and bias, and run a proof of concept. For how the methods and laws work, see the Age Assurance Guide.
Key takeaways
- Buy against the regulator's criteria. Ofcom judges age assurance on whether it is technically accurate, robust, reliable and fair; ask every provider for evidence on each.
- Ask for independent accuracy results. NIST's ongoing age estimation evaluation and accredited certification against ISO/IEC 27566-1 or PAS 1296 are stronger evidence than vendor test sets.
- Measure both error types by group. Under-age users passed and adults wrongly blocked both matter, and both vary by age band, sex and region of origin.
- Offer more than one method. A waterfall of estimation, then document or data-based checks, keeps completion high and gives a route to people who cannot use the first method.
- Minimise what leaves the check. The best designs return only "over or under the threshold" and delete images and documents immediately.
Define requirements
- Legal threshold and regime: the age gates you must enforce (13, 16, 18 or others) and the laws that apply in each market. Ofcom lists methods it considers capable of being highly effective (open banking, photo-ID matching, facial age estimation, mobile network operator checks, credit card checks, digital identity services and email-based age estimation) and methods that are not (self-declaration, payment methods that do not require the user to be over 18, and contractual restrictions).
- Risk level per feature: access to pornography or gambling needs stronger assurance than age-appropriate content settings. Map each feature to the assurance level and acceptable error.
- Population and markets: countries, document types, mobile operators and banks you need covered, and the age bands most of your users fall in.
- Channels and volumes: web, native app, console or smart TV, with peak volumes and acceptable latency.
- Repeat checks: whether users must be re-checked per session, per device or once, which decides whether reusable age tokens or wallet credentials matter.
- Privacy constraints: data protection impact assessment, processing locations, retention limits and whether the provider may use images for model training. In the UK, the ICO's age assurance guidance for the Children's code expects age assurance to be used in a risk-based and proportionate way.
- Accessibility and inclusion: alternatives for users without documents, bank accounts or a camera, and for those whose appearance does not suit estimation.
Capability areas
| Method | What it does | Strengths | Watch for |
|---|---|---|---|
| Facial age estimation | Estimates age from a selfie without identifying the person | Low friction, no documents, can delete image immediately | Error grows near the threshold; needs a buffer ("challenge age") and liveness to stop photos, masks and injected video |
| Photo-ID document matching | Reads date of birth from an identity document and matches the holder's selfie | Exact age, high assurance | Document coverage, forged and digitally altered documents, more personal data handled |
| Data-based checks | Confirm age from open banking, credit card, mobile network operator or credit reference data | No biometrics, quick for adults with records | Excludes people without records; ensure the source actually confirms age, not just payment |
| Email-based age estimation | Infers age from where an email address has been used | Very low friction | Coverage varies by market; understand the data sources |
| Reusable age tokens and wallets | Present a previously verified "over 18" attribute from a digital identity service or wallet | Strong privacy (attribute only), fast repeat checks | Ecosystem coverage still growing; token binding to the user and device |
| Orchestration | Routes users through a sequence of methods with fallbacks | Higher completion, single integration | Each underlying method still needs its own evidence |
The EU age verification blueprint, made available by the European Commission on 14 July 2025 as open-source specifications and a reference implementation, lets users prove they are over a threshold without sharing other personal information and is built on the EU Digital Identity Wallet specification. As of the Commission's April 2026 update it was technically ready, with a citizen app described as coming soon. Ask providers how they will accept such credentials. See the Digital Identity Wallets Guide.
Evaluation criteria
| Criterion | What good evidence looks like |
|---|---|
| Technical accuracy | Mean absolute error and threshold error rates by age band; participation in NIST's Face Analysis Technology Evaluation age estimation and verification track, which reports false positive rates for 14 to 17 year olds at an 18 threshold and Challenge 25 results |
| Fairness | Error rates broken down by sex and region of origin, with the gap between best and worst groups stated |
| Robustness | Presentation attack detection tested to ISO/IEC 30107-3 and injection attack detection for virtual cameras and emulators; results from accredited labs |
| Reliability | Repeat results for the same person are consistent; evidence sources are trustworthy and documented |
| Certification | Certification by an accredited body against ISO/IEC 27566-1:2025 (Age assurance systems, Part 1: Framework, published December 2025), PAS 1296 or IEEE 2089.1, with the certificate scope stated |
| Privacy | Only the age result returned; images and documents deleted at once; no training on your users' data; processing locations disclosed |
| Completion and inclusion | Completion rates by method, accessible flows, fallback routes |
| Integration and operations | APIs and SDKs for each channel, configurable thresholds and buffers, signed results, audit logs, uptime commitments |
Questions to ask vendors
- What are your false positive rates for 13 to 17 year olds at an 18 threshold, and false negative rates for adults aged 18 to 30, broken down by sex and region?
- Have you submitted to NIST's age estimation evaluation, which version was tested, and how does it compare with what you will deploy?
- Which standards are you certified against, by which accredited body, and what does the certificate scope cover?
- What challenge age or buffer do you recommend for our threshold, and what does it do to completion?
- How do you detect injected video, virtual cameras, deepfake faces and replayed sessions, and who tested it?
- Exactly what data do you keep after a check, for how long, where, and is any of it used for training?
- What does our platform receive: a signed over or under result, an estimated age, or personal data?
- How do you support people without documents or for whom estimation fails?
- Will you accept reusable age credentials such as EU wallet age attestations, and how are tokens bound to the user?
- What evidence will you provide if a regulator asks how our age checks meet its criteria?
Red flags
- A single "accuracy" figure with no breakdown by age band, sex or region.
- No independent test results, or results only on the vendor's own dataset.
- Estimation offered with no buffer near the threshold.
- Liveness performed only on the device with no server-side check, or no answer on injection attacks.
- Default rights to retain images or use them for model training.
- Payment card checks that do not distinguish credit from debit cards, which Ofcom does not treat as highly effective when the payment method does not require the user to be over 18.
- Certification claims without a named accredited body or a certificate you can verify.
Proof of concept
- Agree success measures before testing: completion rate, false positives near the threshold, false negatives for young adults, latency and cost per check.
- Run a consented test population spanning age bands either side of your threshold, with a range of skin tones, sexes and lighting conditions, and record results by group.
- Run an attack set: printed and screen photos, masks, virtual camera injection, face swaps and borrowed adult documents. See the Deepfake-Resistant Identity Verification Guide.
- Test every fallback route and the accessibility of each flow.
- Verify data handling in practice: inspect what your platform receives and request deletion evidence.
- Check the results map onto the regulator's four criteria and keep the record as compliance evidence.
How NHI Mgmt Group can help
We provide independent requirements and evaluation support for age assurance, identity verification and wider customer identity programmes. Browse vendors in our products directory or contact us.
Related NHI Mgmt Group resources: Age Assurance Guide · Identity Verification Buyer's Guide · Biometrics Guide · CIAM Buyer's Guide