Notifications
Clear all
Topic starter
31/07/2026 5:21 pm
TL;DR: Italy’s AGCOM has approved rules that require pornographic websites to use robust age verification, including double blind checks that keep platforms and providers from seeing user identity data, according to Yoti. The governance issue is no longer whether age assurance exists, but whether verification architectures can prove adulthood without creating reusable identity trails.
NHIMG editorial — based on content published by Yoti: AGCOM age verification rules and double blind assurance for adult-content access
Questions worth separating out
Q: How should organisations implement age verification without over-collecting personal data?
A: Use the minimum attribute needed for the access decision, then prove age through a trusted credential or wallet flow that does not expose the full identity record.
Q: Why do double blind age checks matter for identity governance?
A: They prevent the verifier from learning which platform requested the check and prevent the platform from seeing underlying identity data.
Q: What do teams get wrong about anonymous age assurance?
A: Teams often focus on the result screen and ignore the surrounding system.
Practitioner guidance
- Map the age-verification data path Document every point where user identity, platform identity, or request metadata could be exposed, including logs, redirects, support tooling, and retry logic.
- Test double blind behaviour under failure conditions Validate what happens when checks time out, are retried, or are routed through third-party components.
- Review verifier ownership and operating model Assess whether the provider is structurally independent from the business that benefits from the age decision.
What's in the full article
Yoti's full article covers the operational detail this post intentionally leaves for the source:
- The regulatory context behind AGCOM's Resolution No. 96/25/CONS and how it aligns with UK and French age-verification rules
- The exact double blind requirements for providers, platforms, and user privacy boundaries
- Yoti's implementation claims for anonymous age checks and how the Digital ID flow is structured
- The practical distinction between age assurance, identity disclosure, and platform visibility
👉 Read Yoti's analysis of AGCOM's double blind age verification rules →
Age verification and double blind checks: what do teams need?
Explore further
31/07/2026 5:21 pm
Age verification is becoming an identity governance problem, not just a compliance checkbox. The AGCOM model shows that regulators are no longer satisfied with simple gating controls. They want proof of adulthood with minimal disclosure, independent verification, and clear separation between requester and verifier. For identity teams, that shifts the question from "can we verify age?" to "can we verify age without building a new personal data exposure path?"
A question worth separating out:
Q: Who is accountable when age verification fails a regulatory review?
A: Accountability usually sits across product, compliance, legal and security because the failure is both operational and evidentiary. The organisation should assign ownership for threshold setting, logging, testing and retention so no single team can treat the control as complete on its own.
👉 Read our full editorial: Italy's age verification rules sharpen privacy and trust demands
