Topic starter
02/08/2026 12:18 pm
TL;DR: Italy’s AGCOM rules for adult content require double blind, per-session age checks that return only an over-18 result and do not expose user identity or site context, according to Yoti. That makes reusable digital credentials and wallet-based proofing the practical model, while one-time checks, direct logins, and identity-linked methods no longer fit the compliance bar.
Editorial analysis by NHI Mgmt Group, based on content published by Yoti: “A guide to Italyâs AGCOM new age verification regulations for adult content”.
Key questions
Q: How should organisations design age assurance when the verifier must not know the site?
A: Use a detached proofing flow that returns only the eligibility result the site needs, such as over 18, while keeping the relying party hidden from the verifier.
Q: Why do one-time age checks fail for repeat access under AGCOM-style rules?
A: Because the control objective is session-specific eligibility, not permanent identity recognition.
Q: What are the signs that an age verification flow is too intrusive or poorly designed?
A: The most obvious signs are when the process asks for full identity details, keeps data after the check, or reveals more than a simple yes or no result to the platform.
Practitioner guidance
- Map every age-check method to its disclosure profile Classify whether each method exposes user identity, relying-party context, or only an over-18 result.
- Replace one-and-done checks with session-based revalidation Design the access journey so returning users must prove eligibility again on each visit or session.
- Prefer reusable credentials that support selective disclosure Use wallet-based or digital identity proofing patterns that can present an age-over assertion without date of birth, name, location, or site context.
Bottom line: AGCOM’s age assurance model narrows the problem to proving eligibility without exposing identity, relying party context, or reusable account trust.
Explore further
View Full Forum → | NHI Foundation Course → | Our Services → | Read the full analysis →
02/08/2026 1:20 pm
Double blind age assurance is a privacy architecture, not a lighter form of authentication. AGCOM is effectively separating age eligibility from identity presentation. That changes the control objective from “who is the user?” to “is the user eligible, and can that be proven without disclosure?” The implication is that many familiar IAM patterns now fail by design, not by implementation detail.
A question worth separating out:
A: Age verification establishes eligibility at the point of signup or purchase by proving a person meets a minimum age threshold. Ongoing authentication is the later process of confirming that the same authorised user is still present and legitimate during future interactions. Together they reduce fraud, support compliance, and help businesses keep age-restricted access aligned with the original approval decision.
👉 Read our full editorial: AGCOM age checks shift identity proofing toward double blind verification