Age assurance benchmarking shows privacy and accuracy can coexist

At a glance

What this is: This is a benchmarking update showing that privacy-preserving age assurance can meet production-ready performance, with strong results for accuracy, usability, and privacy testing.

Why it matters: It matters because age assurance sits at the boundary of identity verification, privacy, and platform governance, where teams need controls that are defensible to regulators and usable for real users.

By the numbers:

• 92% of participants completed tasks without issues
• 95.8% had no privacy concerns
• True Positive Rates above 94% for age gates of 13 and 16
• 100% accuracy, though on a small sample

👉 Read Yoti’s benchmark findings on age verification and age estimation performance

Context

Age assurance is a digital identity control, not just a product feature. It has to balance verification strength, privacy minimisation, user experience, and regulatory defensibility, which is why benchmarking matters more than marketing claims. In this trial, the relevant question is whether age verification and age estimation can perform reliably without turning identity checks into unnecessary data collection.

For IAM and identity verification teams, the real issue is governance at the edge of trust: what evidence is collected, how it is processed, and how consistently it performs across populations and document types. That makes this topic relevant to privacy, fraud prevention, and assurance programmes that already rely on controls such as document checks, liveness detection, and policy-based verification. The result is typical of a mature age assurance discussion, not an isolated technical case.

Key questions

Q: How should organisations govern age assurance in regulated digital services?

A: They should treat age assurance as a risk-based identity control, not a standalone product choice. That means defining the evidence required for each age decision, setting pass and fail thresholds, limiting data collection, and documenting who reviews exceptions. The governance model should also record how the control performs across different user groups and device conditions.

Q: Why do age verification systems need both privacy and accuracy controls?

A: Because a system that is accurate but over-collects data creates privacy and compliance risk, while a privacy-friendly system that cannot reliably assess age creates safety and regulatory risk. Effective governance needs both. Teams should judge the control by how much evidence it collects, how well it performs, and whether the result is defensible to auditors and regulators.

Q: What do security and identity teams get wrong about age verification?

A: They often treat it as a one-time onboarding check instead of an ongoing governance process with evidence, testing, and jurisdiction-specific rules. That approach misses auditability, model drift, and threshold ambiguity, which are the points most likely to create compliance failure in production.

Q: How do you know if age assurance is actually working?

A: Look for evidence of boundary accuracy, independent validation, demographic consistency and complete decision logs. If you cannot reconstruct how a specific user was approved or blocked, the control may function technically but still be weak from a governance perspective.

Technical breakdown

How privacy-by-design age assurance works

Age assurance systems usually combine document verification, facial age estimation, liveness detection, and decision thresholds. Privacy-by-design means the system collects only the minimum data needed to answer the age question, then limits retention and reuse. In practice, that shifts the control model away from broad identity capture and toward narrow-purpose verification with explicit policy boundaries. The security challenge is not only model accuracy, but whether the workflow avoids over-collection while still producing a decision regulators can defend.

Practical implication: treat age assurance as a scoped identity workflow and verify that data collection, retention, and review are all purpose-limited.

Why accuracy, usability, and fairness all affect identity governance

Age assurance fails operationally when one control dimension is optimised at the expense of the others. A highly accurate model that users cannot complete, or a frictionless flow that weakens assurance, does not meet governance needs. Fairness also matters because performance can vary by document type, skin tone, lighting, or camera quality. That is why benchmarking should assess error rates, completion rates, privacy concerns, and exception handling together rather than as separate vendor claims.

Practical implication: evaluate age assurance with combined assurance, usability, and fairness metrics, not a single accuracy figure.

What TRL 9 means for production age verification

TRL 9 indicates a system has been demonstrated in an operational environment, which is a stronger signal than lab-only validation. For identity programmes, that matters because production readiness depends on handling real-world inputs such as blurred documents, spoof attempts, and cross-border identity evidence. The technical standard should therefore include robustness testing, injection resistance, and interoperability, not just algorithmic performance. Age assurance becomes governable when the deployment context is part of the control evaluation.

Practical implication: require operational testing evidence before approving age assurance for regulated or high-risk user journeys.

Threat narrative

Attacker objective: The attacker wants to pass an age gate without satisfying the intended identity or age assurance requirement.

1. Entry occurs when an attacker tries to bypass age gates with spoofed documents, blurred images, or manipulated submission flows.
2. Escalation follows if the assurance workflow lacks robust liveness detection, injection checks, or document authenticity validation.
3. Impact is unauthorised access to age-restricted services, weak regulatory compliance, and increased exposure to fraud or safety failures.

NHI Mgmt Group analysis

Privacy-preserving age assurance only works when identity evidence is tightly scoped. The trial reinforces a simple governance point: collecting more data does not automatically produce stronger assurance. For age verification programmes, the right model is minimum necessary evidence plus strong validation controls. That aligns with privacy-by-design expectations in digital identity governance and avoids turning age checks into unnecessary identity surveillance. Practitioners should treat minimisation as a control objective, not a compliance afterthought.

Age assurance is now a standards problem, not a feature comparison problem. The article shows why regulators will increasingly need explicit performance, security, and certification requirements rather than broad policy language. Without clear thresholds, teams end up comparing tools on incomplete claims about accuracy or user experience. In identity programmes, standards such as NIST SP 800-63 Digital Identity Guidelines help anchor assurance thinking, but age estimation still needs sector-specific governance. Practitioners should expect more prescriptive controls, not looser ones.

Age assurance introduces a verification trust gap when organisations confuse confidence with certainty. A system can be operationally strong and still produce residual error, bias variation, or false confidence if governance assumes the check is absolute. That matters for IAM and fraud teams because age-restricted access decisions often get treated as binary, when the underlying evidence is probabilistic. The correct model is risk-based policy, not blind automation. Practitioners should calibrate decisions to assurance level and exception path.

Facial age estimation creates a policy boundary between identity verification and identity profiling. The same technology can either support a narrow age gate or become a broader biometric processing system, depending on governance. That boundary matters for privacy, data minimisation, and auditability. Where biometric signals are involved, teams need explicit retention, consent, and review controls, especially when personal data is used for access decisions. Practitioners should document where age assurance stops and identity processing begins.

Benchmark results only matter when they can be translated into operating policy. The article’s strongest signal is not a single accuracy number, but the combination of operational usability and low privacy concern with repeatable testing. That is the profile identity architects should look for when selecting controls for regulated journeys. The next step is not more experimentation, but policy mapping. Practitioners should translate benchmark evidence into approval criteria, exception handling, and audit evidence.

What this signals

Age assurance will increasingly be evaluated as part of identity governance rather than as a standalone trust-and-safety feature. The practical challenge for programmes is to make the control defensible across privacy, fraud, and compliance requirements without creating unnecessary user friction. That shift will push more teams toward policy-defined assurance levels and better audit evidence.

Verification trust gap: organisations will need to distinguish between a system that performs well in a benchmark and a system that holds up under real operating conditions. This is where identity programmes should borrow from the discipline behind NIST SP 800-63 Digital Identity Guidelines and translate findings into reviewable policy, not just procurement language.

For practitioners

• Define age assurance as a scoped identity control Limit collection to the minimum evidence needed for the specific age decision, then document retention, review, and deletion rules for every workflow.
• Set approval thresholds before deployment Require explicit pass criteria for accuracy, completion rate, privacy concern, and robustness testing before allowing the control into production.
• Separate age verification from broader identity profiling Prevent teams from reusing biometric or document evidence for unrelated purposes unless policy, consent, and legal review clearly permit it.
• Build exception handling for uncertain outcomes Route low-confidence or failed checks into manual review, secondary evidence, or policy-based denial rather than forcing a binary accept-or-reject default.

Key takeaways

• Age assurance is becoming an identity governance problem, not just a trust-and-safety feature decision.
• The benchmark suggests privacy, usability, and accuracy can be aligned, but only when controls are measured together.
• Identity teams should convert trial results into policy thresholds, exception handling, and audit evidence before deployment.

Key terms

• Age Assurance: Age assurance is the set of controls used to determine whether a person can access content or services restricted by age. It can include document checks, biometrics, in-band verification and decision logging, but the governance requirement is the same: the organisation must be able to justify the outcome.
• Facial Age Estimation: Facial age estimation uses a selfie or live camera image to estimate whether a person is above or below a required age threshold. It is a probabilistic verification method, so its governance depends not only on model accuracy but also on how the image is captured, processed, retained, and disclosed.
• Privacy by Design: An approach that builds privacy controls into systems from the start rather than bolting them on later. It requires default settings, access patterns, and data flows to be designed around minimisation, transparency, and accountability so that compliance is operational, not just documented.
• Liveness Detection: Liveness detection is the mechanism that checks whether a biometric sample comes from a real, present person rather than a spoof such as a photo, screen, or mask. In identity programmes, it is a core defence against presentation attacks and should be tested under realistic operating conditions.

What's in the full report

Yoti's full article covers the operational detail this post intentionally leaves for the source:

• Detailed benchmarking tables for age verification and age estimation performance across test scenarios
• Lab-test findings on spoof attempts, expired IDs, blurred documents, and cross-border document handling
• User testing results from mystery shopper and school trials, including usability and privacy feedback
• The trial’s discussion of minimum standards, certification, and regulator expectations

👉 Yoti’s full post covers the trial results, testing conditions, and regulatory recommendations in more detail.

Deepen your knowledge

The NHI Foundation Level course, the industry's only accredited NHI security programme, covers NHI governance, machine identity security, and secrets management. It helps practitioners translate identity controls into practical operating models across modern security programmes.