Topic starter
02/08/2026 12:24 pm
TL;DR: Age assurance is shifting from trust claims to measurable, certifiable controls, as Australia’s Age Assurance Technology Trial found Yoti’s September 2024 facial age estimation model reached a 1.80-year mean absolute error for ages 12 to 23, while New York’s draft SAFE for Kids Act sets minimum accuracy, circumvention and independent testing expectations, according to Yoti. The direction of travel is clear: age assurance is moving toward measurable, certifiable controls.
Editorial analysis by NHI Mgmt Group, based on content published by Yoti: “Thoughts from our CEO: Despite opposition, most Brits support online age protections”.
By the numbers:
- The true positive rates were found to be consistently above 94% from age 13 upwards in the trial.
Key questions
Q: How should organisations govern age assurance in regulated digital services?
A: They should treat age assurance as a risk-based identity control, not a standalone product choice.
Q: Why does privacy-preserving age verification matter for online safety and user trust?
A: Privacy-preserving age verification matters because it lowers the amount of sensitive data shared during access checks while still enforcing age-restricted access.
Q: What breaks when age assurance is deployed without independent testing?
A: Controls drift between claimed performance and real-world use.
Practitioner guidance
- Define certified age-check settings Document the exact age thresholds, accuracy requirements and configuration options that are approved for production use, and block any unreviewed variant from release.
- Require independent evidence packs Ask vendors and internal teams for test evidence covering accuracy, false positives, false negatives, circumvention detection, deletion and data minimisation before approving deployment.
- Separate identity proof from age proof Prefer methods that confirm age status without collecting full identity documents unless a regulated use case genuinely requires them.
Bottom line: Age assurance is moving into a regulated evidence model where accuracy, anti-circumvention and privacy controls must be independently demonstrated.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:24 pm
Age assurance is becoming an evidence discipline, not a trust claim. Regulators are starting to ask whether a method can be measured, certified and re-tested, rather than whether a vendor believes it works. That changes the control objective for identity verification teams, because the question moves from capability to proof. Practitioners should treat accuracy, circumvention resistance and deletion practices as auditable control outcomes, not product features.
A question worth separating out:
Q: Which controls matter most when age assurance data is involved?
A: Data minimisation, deletion, encryption and version-controlled configuration matter most because they determine whether the age check can be defended as a narrow eligibility control. If the process stores more data than needed or allows uncertified settings, the organisation inherits unnecessary privacy and compliance risk.
👉 Read our full editorial: Age assurance regulation is tightening around privacy and accuracy