Topic starter
02/08/2026 12:18 pm
TL;DR: Double blind age checks for adult content must return only an over-18 result, with Yoti reporting that AGCOM hides both user identity and site context. Repeated visits need repeated proof, so age-gating has to behave like a session check rather than a standing login.
Editorial analysis by NHI Mgmt Group, based on content published by Yoti: “A guide to Italyâs AGCOM new age verification regulations for adult content”.
Key questions
Q: Why do one-time age checks fail for repeat access under AGCOM-style rules?
A: Because the control objective is session-specific eligibility, not permanent identity recognition.
Q: What are the signs that an age verification flow is too intrusive or poorly designed?
A: The most obvious signs are when the process asks for full identity details, keeps data after the check, or reveals more than a simple yes or no result to the platform.
Q: How should organisations design age assurance when the verifier must not know the site?
A: Use a detached proofing flow that returns only the eligibility result the site needs, such as over 18, while keeping the relying party hidden from the verifier.
Practitioner guidance
- Map every age-check method to its disclosure profile Classify whether each method exposes user identity, relying-party context, or only an over-18 result.
- Replace one-and-done checks with session-based revalidation Design the access journey so returning users must prove eligibility again on each visit or session.
- Prefer reusable credentials that support selective disclosure Use wallet-based or digital identity proofing patterns that can present an age-over assertion without date of birth, name, location, or site context.
Bottom line: AGCOM’s age assurance model narrows the problem to proving eligibility without exposing identity, relying party context, or reusable account trust.
Glossary terms: Double Blind Verification, Selective Disclosure Credential, Session-Based Revalidation, Identity-Linked Proofing
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
This topic was modified 2 days ago by NHI Mgmt Group
02/08/2026 1:20 pm
Double blind age assurance is a privacy architecture, not a lighter form of authentication. AGCOM is effectively separating age eligibility from identity presentation. That changes the control objective from “who is the user?” to “is the user eligible, and can that be proven without disclosure?” The implication is that many familiar IAM patterns now fail by design, not by implementation detail.
A question worth separating out:
A: Age verification establishes eligibility at the point of signup or purchase by proving a person meets a minimum age threshold. Ongoing authentication is the later process of confirming that the same authorised user is still present and legitimate during future interactions. Together they reduce fraud, support compliance, and help businesses keep age-restricted access aligned with the original approval decision.
👉 Read our full editorial: AGCOM age checks shift identity proofing toward double blind verification