Should organisations allow digital ID for under-16 users?

What makes under-16 digital ID different from adult identity programmes?

Under-16 digital ID is not just a lighter version of adult identity. It introduces a different duty set around consent, parental or guardian involvement, data minimisation, retention, and recovery when a child cannot reliably manage account access alone. The programme has to work for minors without normalising broader tracking, persistent profiling, or disproportionate reuse of identity data.

The practical issue is supportability as much as assurance. If the identity flow cannot handle changes in guardianship, device loss, disputes, or evolving consent status, the organisation is effectively asking minors to absorb operational failure that adults can often resolve themselves.

Age also changes the design target. A suitable flow for a teenager may need stronger human oversight, narrower data collection, and clearer fallbacks than a general population identity journey, especially where the digital ID is tied to education, health, travel, or other sensitive services.

What governance model should organisations use for minors?

Organisations should treat minors as a separate policy population, not a minor variation of the standard identity lifecycle. That means defining who can consent, who can override, who can recover access, how long data is kept, and what happens when a user ages into adult status. Governance should also specify whether the identity is issued for a single service, a broader ecosystem, or a federated use case.

A separate governance model matters because the answer to “can we identify the user?” is different from “should we?” For under-16s, the organisation needs a clear lawful basis, an age-appropriate user journey, and controls that prevent the digital ID from becoming a general-purpose surveillance layer. That is especially important where biometrics, device signals, or cross-service correlation could expand the footprint beyond the original purpose, as reflected in the design and processing principles in EU General Data Protection Regulation (GDPR).

Supportability should be part of governance, not an afterthought. If the organisation cannot resolve parental disputes, revoked consent, or recovery requests without exposing excessive personal data, the model is incomplete. For this reason, the identity policy should state upfront what evidence is acceptable for age assurance, what support staff may see, and when human review is required.

Where do the main risks show up in practice?

The biggest risk is over-collection combined with long-lived reuse. A child-facing identity programme can drift into broad profiling if teams optimise for convenience, single sign-on reach, or future reuse across services. That creates a higher-stakes privacy problem than simple login fraud, because the harm can persist well after the original enrolment.

There is also an access and assurance risk if the identity is too weak to recover safely or too strong to revoke cleanly. If a minor loses access and the recovery path is ad hoc, the organisation may end up trusting informal support channels, weak proofing, or repeated exception handling. Those patterns undermine both security and trust, and they are exactly the kind of control failure that strong identity guidance is designed to prevent, including the assurance and lifecycle discipline in NIST SP 800-63 Digital Identity Guidelines.

Biometric or high-persistence identifiers deserve special caution because they can outlast the original use case. If the programme cannot limit correlation, constrain retention, or offer a credible non-biometric path, the system may create a permanent identity trail that is disproportionate for minors. The result is not just technical risk, but governance risk, because the organisation may be unable to justify why a child needed that much identity material in the first place.

Risk and Threat Considerations

Under-16 digital ID can create a disproportionate privacy and safeguarding exposure if the programme is designed around adult assumptions. The main failure mode is not only account compromise, but durable identity tracking, weak consent handling, and recovery processes that leak more data than the original login ever required.

Failure mechanism: Organisations collect more identity evidence than necessary, retain it too long, or reuse it across services, then rely on weak recovery or exception handling when a minor loses access or consent changes.

Impact: The result can be persistent profiling, difficulty revoking access, family or guardian disputes, unsafe support interactions, and a digital ID posture that exceeds the stated use case.

Practitioner Guidance

What to prioritise: Start with the recovery and dispute model, not the happy-path enrolment flow. If you cannot explain who may act for the child, how consent changes are recorded, and how access is revoked without overexposing data, the programme is not ready.

What to verify: Check that the identity journey has age-appropriate defaults, a narrow data set, a documented transition path when the user reaches adulthood, and a support process that does not force staff to improvise. If biometrics or strong identifiers are used, verify that there is a non-discriminatory fallback.

Common mistake: Treating “teen users” as a product segment rather than a governance class. That usually leads to adult-style identity reuse, weak role clarity for guardians, and privacy leakage through convenience features.

Practitioner takeaway: A digital ID for under-16 users is acceptable only when the organisation can prove it is age-appropriate, narrowly scoped, and operationally recoverable without turning identity into long-term surveillance.

Related resources from NHI Mgmt Group

• How should organisations design digital identity flows so users keep control of their data under eIDAS 2.0?
• How do organisations operationalise NHI ownership at scale?
• When should organisations treat an NHI as a high-priority risk?
• How can organisations reduce the blast radius of compromised agent identities?