Age Assurance Guide: Verification and Estimation

Age assurance has moved from a tick box to a legal requirement in a growing number of places. The UK Online Safety Act requires "highly effective" age assurance for services that host pornography and for many services likely to be accessed by children, Australia has set a minimum age for social media, EU guidance under the Digital Services Act expects proportionate age assurance, and several US states have passed age verification laws. At the same time, collecting identity documents from every visitor creates privacy and security risks of its own. This guide explains the methods, the rules, accuracy and circumvention, and how to design age checks that are effective and privacy preserving.

Key takeaways

Age assurance is the umbrella term. It includes age verification (establishing age from evidence) and age estimation (inferring an age range, for example from a face).
Self-declaration is not enough where regulation demands highly effective checks.
Choose methods by the risk of the content or service, and offer more than one route for inclusion.
Design for data minimisation: confirm "over 18", not a full identity, and do not keep what you do not need.
ISO/IEC 27566-1:2025 gives the first international framework for age assurance systems.

Methods compared

Method	How it works	Strengths	Weaknesses
Self-declaration	User enters a date of birth or ticks a box	No friction	Easily bypassed; not accepted where checks must be highly effective
Photo ID matching	Document checked and matched to a live selfie	High confidence	Collects more data than needed; excludes people without ID
Facial age estimation	A model estimates age from a live face image	No documents; quick	Error margins near thresholds; needs liveness and injection defences
Digital identity or wallet	A trusted credential proves an age attribute	Strong and privacy preserving with selective disclosure	Depends on wallet availability
Open banking or credit card checks	Confirms an account that requires adulthood	Uses existing checks	Excludes some adults; card checks can be misused
Mobile network operator checks	Checks whether age restrictions apply to the phone account	Low friction	Coverage varies
Email-based estimation	Infers age from where an email address has been used	Low friction	Coverage and accuracy vary

Ofcom's guidance under the UK Online Safety Act lists methods such as photo ID matching, facial age estimation, open banking, digital identity services, credit card checks, email-based estimation and mobile network operator checks as capable of being highly effective, and states that self-declaration and general terms of service are not.

The regulatory landscape

This is an orientation, not legal advice. Rules are changing quickly; check current requirements in each market.

United Kingdom: under the Online Safety Act, services that allow pornographic content must use highly effective age assurance, with Ofcom's children's safety duties applying from July 2025. Services likely to be accessed by children must also assess and manage risks, often using age assurance.
European Union: Commission guidelines under Article 28 of the Digital Services Act set expectations for protecting minors online, including age assurance, and the Commission has piloted an age verification app blueprint designed to work with the European Digital Identity Wallet.
Australia: a minimum age of 16 for holding accounts on certain social media platforms applies from December 2025, requiring platforms to take reasonable steps to prevent under-age accounts.
United States: many states have passed age verification laws, particularly for adult content, and the Supreme Court upheld Texas's law for pornographic sites in 2025. Federal law (COPPA) governs collection of data from children under 13.

Accuracy, thresholds and fairness

Age estimation gives a range with an error margin. Use a buffer above the legal age (for example, estimating over 25 to allow over 18 without further checks) and send borderline cases to a stronger method.
Ask for independent testing of estimation accuracy across ages, sexes and skin tones.
Offer alternatives for people who fail estimation or lack documents, so checks do not exclude adults unfairly.

Attacks and circumvention

Presentation and injection attacks against facial checks, using photos, masks, videos or virtual cameras. Liveness and injection detection are essential. See the Biometrics Guide.
Borrowed credentials: a child using a parent's card, ID or verified account.
VPNs to reach services from places without age rules.
Account sharing and resale of verified accounts.
Phishing sites posing as age checks to harvest ID documents.

Privacy-preserving design

Use a third-party age assurance provider that returns only a yes or no (or an age band) to the service, so the service never sees the evidence.
Prefer selective disclosure from digital identity wallets, which can prove "over 18" without revealing a date of birth. See the Digital Identity Wallets Guide.
Delete images and documents immediately after the check unless there is a clear legal reason to keep them.
Complete a data protection impact assessment; children's data carries extra obligations. See the Identity Data Privacy and Consent Guide.
Reuse a successful check for a reasonable period rather than asking every visit, while re-checking when risk changes.

Age assurance and identity

Age assurance is a specialised form of identity proofing: it needs to establish one attribute, not a full identity. The same principles apply as for proofing: choose assurance by risk, defend against spoofing and injection, and measure how often checks are bypassed. See the Identity Proofing and KYC Guide and the Customer IAM (CIAM) Guide.

Practitioner checklist

Identify which markets, services and content types require age assurance, and to what standard.
Select methods that meet that standard, with at least one alternative route.
Use buffers above the legal age for estimation and step up for borderline cases.
Require liveness and injection attack detection for facial methods.
Minimise data: return yes or no, delete evidence promptly, and prefer selective disclosure.
Test providers against ISO/IEC 27566-1 and independent accuracy evaluations.
Monitor for circumvention and adjust.

Standards and references

Related NHI Mgmt Group resources: Identity Proofing and KYC Guide · Biometrics Guide · Digital Identity Wallets Guide · Customer IAM (CIAM) Guide

Age Verification and Age Assurance Guide