Topic starter
31/07/2026 5:21 pm
TL;DR: Italy’s AGCOM has approved rules that require pornographic websites to use robust age verification, including double blind checks that keep platforms and providers from seeing user identity data, according to Yoti. The governance issue is no longer whether age assurance exists, but whether verification architectures can prove adulthood without creating reusable identity trails.
Editorial analysis by NHI Mgmt Group, based on content published by Yoti: “Italyâs new age verification regulation for online platforms”.
Key questions
Q: How should organisations reduce identity exposure when verifying age or identity?
A: Use the minimum attributes required for the transaction and avoid exposing full document data when a single assertion will do.
Q: Why do double blind checks matter in age assurance programmes?
A: Double blind checks matter because they reduce the chance that an age-verification flow becomes a tracking mechanism.
Q: What breaks when age checks can be linked across sites or visits?
A: Linkable checks undermine privacy by turning a simple age gate into a behavioural record.
Practitioner guidance
- Define the minimum age assertion Limit age verification responses to a simple over-18 or under-18 outcome and remove any unnecessary identity attributes from the transaction flow.
- Test for linkability across checks Review whether tokens, device signals, or session metadata can be used to connect one age check to another across sites or visits.
- Review verifier ownership and data boundaries Assess whether the age verification provider is structurally independent from the content operator and whether platform staff can access personal data.
Bottom line: Age verification controls are shifting from simple age gating to privacy-preserving assurance that reveals only the minimum needed for access decisions.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
31/07/2026 5:21 pm
Double blind age assurance is becoming a privacy architecture requirement, not a niche design preference. The article shows how regulators are moving beyond simple age-gating toward controls that minimise who can see what. For identity programmes, that means assurance must be designed around data separation, not just around proof of adulthood. Practitioners should expect more scrutiny of whether an age check leaks identity context into the access decision.
A question worth separating out:
Q: Who should be accountable for privacy controls in age verification services?
A: The relying platform remains accountable for the access decision, while the verification provider is accountable for limiting data exposure and maintaining separation of roles. Regulators will usually expect both parties to show that the design supports minimisation, independence, and auditability rather than data accumulation.
👉 Read our full editorial: Italy's age verification rules sharpen privacy and trust demands