Age assurance methods for worldwide compliance programs
If you’re wondering what’s the best way to conduct age assurance, the reality is that there’s no one way to do it. In fact, a variety of methods exist to help organizations assess a user’s age, ranging from government ID verification and selfie age estimation to database verification, phone-based age assurance, and email age inference. That’s not to mention country-specific methods like ConnectID and credit-card-based age inference.
The reason so many methods are available is because each one uses different types of evidence, signals, and technology. The method that’s best for your platform and use case ultimately depends on where your users live, the regulations you’re subject to, what your users expect, and your organization’s risk appetite.
In this guide, we’ll discuss what age assurance is, available methods, and what to consider before deploying it. We’ll also highlight the importance of deploying successive validation — also known as a waterfall approach — and offer a framework for selecting appropriate methods for your use case.
What is age assurance? A quick overview
Age assurance refers to the methods and processes that help you assess a user’s age so you can provide an age-appropriate user experience on websites, mobile apps, social media platforms, and more.
Age assurance can be achieved through three approaches: age estimation, age inference, or age verification. Here’s what each of these mean:
Age estimation involves estimating a user’s age using biological or behavioral characteristics, such as facial analysis from a selfie or an analysis of their digital presence.
Age inference relies on a variety of signals, like the user’s online activity or the age of their email account, to approximate the user’s age.
Age verification calculates a user’s age using verifiable data and evidence, like a government-issued ID or database record.
Each of these provides a different level of confidence in a user’s age. The best approach for your organization depends on your assurance needs, regulatory requirements, and user expectations.
Age assurance regulations: A shifting landscape
Because there’s no single standard for what age assurance should look like at a global scale, the regulatory landscape is fragmented by nature.
Individual regions, nations, and even states have all begun tackling the question of age assurance with their own laws and regulations. These requirements differ substantially on age thresholds, which platforms are affected, what age assurance methods are acceptable, and other specifics.
Some of the most impactful and far-reaching age assurance regulations include:
State laws in the United States like Texas HB 1181, NY SAFE for Kids Act, and Florida HB 3
Because new age assurance laws are being proposed, considered, and passed on a near-monthly basis, Persona has created Atlas, a free, collaborative database and API for compliance teams.
What are the different types of age assurance methods?
Multiple age assurance methods exist, including government ID checks, selfie age estimation, credit-card based verification, and more. To curate the best end-user experience, it’s important to understand each method and how they differ.
Below, we’ve provided an overview of some of the most common methods that organizations may deploy:
| Method | Description | Considerations | Who can use it |
|---|---|---|---|
| Selfie age estimation | Estimates age from a user-provided selfie. Pair with liveness and deepfake detection to reduce spoofing risk. | User typically needs access to a camera with sufficient image quality and reliable Internet connection. | No limitations. |
| Government ID / document verification | Calculates age through birthdate extracted from submitted documentation. Persona recommends pairing this with selfie verification for increased assurance. | User must have a physical ID; however, not all minors are of age to have documentation. | No limitations. |
| Email-based age estimation | Infers age using an evidence-weight model to assess the likelihood of an email owner’s age. | Users must not be using temporary or new emails. | No limitations. |
| Phone number-based age assurance | Uses records provided by mobile network operators to verify whether a user is over 18. | Won’t work for voice over IP (VOIP), prepaid, or temporary SIMs. | Available for platforms operating in the UK and other locales that require mobile network operators to record the DOB for the person who owns the phone line. |
| Credit-card based age inference | Confirms ownership of a valid credit card. | Requires collecting a user’s credit card number, which they may be reluctant to share. | Available for platforms operating in the UK and other locales which require that the credit card user (i.e., not just the owner) is above 18. |
| Database age verification | Cross-verifies existence and birth date of users through official authoritative, issuing, and source databases. | Official data sources that can be used to corroborate age vary based on regulatory body. | No limitations. |
| Digital IDs (e.g., ConnectID in Australia) | Verifies the age of the user (e.g., 18+) from a source that has already verified the user information (e.g., bank of record for ConnectID) | Coverage and adoption varies by country. | Coverage and adoption varies by country. |
How does each age assurance method work?
Every age assurance method relies on different types of information and analysis to estimate or determine a user’s age. Here’s how some of the most common methods work:
What is selfie age estimation?
Selfie age estimation analyzes facial features from a live selfie to estimate a person’s age and assess whether they are likely to meet a specified age threshold, without verifying their identity. A robust age assurance system also checks for spoofing, presentation attacks, and AI-generated images to ensure authenticity.
Who it works for: Any user with a smartphone camera or webcam.
Considerations
You may need to provide fallback options for users close to age thresholds to minimize the risk of false positives and false negatives.
Processing selfies for age estimation requires appropriate privacy and data security safeguards.
It’s essential that your solution has effective liveness detection to protect against physical and digital spoofs.
What is government ID and document verification for age assurance?
Government ID verification extracts the date of birth from a valid government-issued identity document (e.g., a driver’s license, passport, or national ID card) to determine the user’s age.
Who it works for: Individuals who possess valid government-issued identification documents.
Considerations
Coverage can be limited for younger audiences, who may not yet have government IDs.
Ownership eligibility varies by document type; passports, for example, are often available at a younger age than driver’s licenses.
Some jurisdictions (e.g., Australia) require platforms to offer reasonable alternatives to government document verification.
It can’t, on its own, protect against minors using stolen or borrowed IDs unless it’s also paired with selfie verification.
It excludes users without government IDs, who may still be old enough to access age-restricted websites and content.
What is email-based age estimation?
Email-based age estimation analyzes digital signals associated with a user’s email address, like the email account’s age and digital footprint, to assess the likelihood that the owner of the email account meets an age threshold.
Who it works for: Users with established email accounts that have sufficient digital history to generate a confident estimate of age.
Considerations
Coverage varies dramatically based on email quality (e.g., newly created emails or disposable addresses yield poor results).
It may require two-factor authentication to ensure email account ownership.
What is phone-number based age assurance?
Phone-based age assurance verifies whether a user is over an age threshold by using subscriber data that’s associated with a phone number and provided by mobile network operators (MNOs).
Who it works for: Individuals 18 or older with mobile phone contracts in countries like the UK where MNOs maintain date of birth on every phone number holder.
Considerations
Geographic coverage depends on country regulations. For example, phone-based coverage works in the UK, where per-line data is available, but is limited in the US, where only account holder information is accessible.
It does not cover voice over IP (VOIP), prepaid, or temporary phone numbers due to registration visibility from MNOs.
It requires two-factor authentication to ensure phone ownership.
What is credit-card-based age inference?
Credit-card-based age inference confirms whether a user is 18 or older by validating that they possess a legitimate credit card from a country where an individual must be at least 18 years old to open an account. The system verifies the card is a functioning credit card by applying a temporary charge, confirming it’s a credit card (and not a debit card, which may be subject to different age restrictions), and validating the card’s origination from an eligible country.
Who it works for: This method may verify any adult who is 18 or older in a country where 18 is the minimum age to have a credit card.
Considerations
Credit-card based verifications may not be available or allowed in all jurisdictions.
It excludes populations without credit cards (e.g., younger adults, unbanked individuals).
The temporary charge may cause friction for some users.
What is database verification for age assurance?
To confirm the user’s age, database verification cross-references user-provided information against reliable, trusted databases.
Who it works for: Individuals with established records, such as those with credit history or long-term residency in a given country.
Considerations
Database coverage varies by country.
Some users (like children, young adults, recent immigrants, or individuals without credit history) may not appear in credit databases.
It requires collecting and processing multiple PII data points, which some users may be reluctant to share.
What are Digital IDs?
Digital IDs are a rapidly developing form of ID that countries are continuing to explore. They serve as digital counterparts to physical IDs and can be used to securely verify age after a user signs up. In many cases, digital IDs are being developed to only share an age determination (e.g., 18+) without the need to share personal information (e.g., date of birth or name).
Who it works for: Individuals with digital IDs in countries that support them.
Considerations:
Coverage may vary based on country maturity for digital ID adoption
What is successive validation in the context of age assurance?
Successive validation is a layered approach to age assurance where a platform deploys certain verification methods to a user in a sequence. Also known as a waterfall approach, it customizes verification methods to each user based on need.
Typically, the first method introduces the least amount of friction to complete while providing assurance in a user’s age. If that method allows the platform to estimate or verify the user’s age with a high degree of confidence, then the sequence ends with either a pass or a fail.
However, if the first check results in an indeterminate age, the user is prompted to complete an additional method — usually one that involves a bit more friction. This process can be repeated with as many methods as the platform chooses to implement.
Organizations use successive validation for a simple reason: there’s no single age assurance method that is guaranteed to work for your entire user base. Let’s use government documentation as an example. While it’s one of the most common forms of in-person age verification, it’s usually not enough online. The reasons for that are wide-ranging; for example:
The user may have recently moved to a new country and has not yet received a valid government ID that would pass an ID check
The user isn’t of sufficient age to qualify for particular forms of government ID, like a driver’s license
The jurisdiction’s regulations may explicitly prohibit government ID verification as the sole method for age assurance in order to curb unfair discrimination
Since not every user will be able to complete every age assurance method, successive validation gives you and your users more options to complete the process. And, by maximizing the number of individuals who can verify their age and use your platform, you can stay aligned with regulatory standards while reducing regulatory risk.
What’s an example of a waterfall approach to age assurance?
Consider a social media platform that needs to check if a user is 16 or over. To meet this requirement, it might use two age assurance methods: one low-friction option that all users encounter; and a second, higher-friction method that users only see if they fail a check, can’t complete the check, or the result is indeterminate.
In practice, this could:
Start with selfie age estimation: As a first step, selfie age estimation analyzes a user’s selfie to estimate whether they appear over 16. While most adult users will pass quickly, it may be more difficult to make a confident determination for some users (e.g., a user who is within three years of a cutoff age of 16).
Escalate to government ID/documentation: To achieve a higher assurance level, the platform may then request a government-issued ID, which is then matched to the user through portrait to selfie matching.
Using these two approaches in succession would help the social media platform meet compliance regulations while minimizing user friction where possible.
How do I choose the right age assurance method?
The right age assurance methods for your platform depend on who your users are, where they’re located, and what they expect from the product experience. Consider these factors when building your strategy:
Regulatory requirements
Because different jurisdictions may set different standards for age assurance, regulatory requirements should be your first consideration when selecting assurance methods. For example, some regulations might dictate the age threshold you’re required to enforce, the level of confidence you’re required to achieve, and the methods you can and can’t deploy. Others may specify the precise appeals process for users who fail an initial age assessment.
If you operate in multiple markets, you’ll likely need a flexible age assurance solution that allows you to tailor your flows by region instead of applying the same process to all users.
User demographics
Each age assurance method requires different types of evidence, so you’ll need to understand who your average user is and whether they’re likely to have access to the evidence required for whatever method you choose to deploy.
For example, younger users may not have access to a driver’s license, credit card, or other records that certain methods rely on, even if they’re old enough to use your platform. Likewise, recent immigrants may not yet appear in local databases, and unbanked users may not be able to complete credit-card-based checks.
Knowing what your average user can do will make it easier to identify the methods that’ll work for the greatest portion of your users. It can also inform what fallback methods you decide to offer.
Geographic coverage
Certain methods require that you have access to particular types of data, often from an issuing or authoritative database. But because data coverage and availability vary significantly by market, a method that works in one jurisdiction may not work everywhere. For example, phone-based age assurance is only possible in markets where MNOs record — and make available — the age of a line holder. Whether or not other forms of database verification can work will also depend on database coverage and quality.
Similarly, some methods are only possible in specific jurisdictions. Credit-card-based age inference, for example, can only be deployed in countries where the user must be above a certain age (typically over 18) to open a credit card account.
User experience
Every age assurance method introduces a certain degree of friction, but how much will vary considerably between methods. A user might, for example, consider it a small ask to upload a selfie for age estimation. But they may think twice before uploading a photo of their ID — either because they don’t feel comfortable sharing the document, or because the process of retrieving it is seen as too large of a hurdle.
Before choosing a particular method, consider the effort it requires to complete and whether the level of friction it imposes is appropriate for the level of assurance you need. If multiple methods satisfy your requirements, think about offering users a choice so they can select the method they prefer.
The “right age assurance method” is usually a pairing
Don’t try to find the one age assurance method that will fit all of your requirements. In many instances, the best practice isn’t to deploy a single technology. Instead, use multiple complementary technologies that account for different risks and user expectations while still aligning with your compliance requirements.
How does Persona help with age assurance?
Persona’s highly configurable identity platform helps you design a customized approach for your users, your product, and the regulatory and risk requirements you face. Options include phone and email age inference, selfie age estimation, and verification methods such as government ID and selfie checks, database verification, and credit card verification.
For eligible users in Australia, Persona also integrates with ConnectID, offering an option to confirm age (e.g., 16+ or 18+) without receiving additional personal information.
Persona’s age assurance methods have been independently evaluated including:
iBeta (ISO 30107-3 Levels 1 & 2)
Germany’s KJM (Kommission für Jugendmedienschutz)
UK’s Age Check Certification Scheme (ACCS)
Ranked top two in Australia’s Age Assurance Technology Trial
Independent evaluations give product teams the confidence to build age-appropriate experiences that align with their requirements.
Working through age assurance requirements across markets? Leading companies like Substack and Lime have turned to Persona to help them solve their challenges while balancing accuracy, privacy, and user experience. Talk with our team about how to implement age assurance on a global scale.
The information provided is not intended to constitute legal advice; all information provided is for general informational purposes only and may not constitute the most up-to-date information. Any links to other third-party websites are only for the convenience of the reader.
FAQs
What’s the difference between age verification and age estimation?
Toggle description visibility
Age estimation analyzes a user’s features, typically their selfie, to determine their likely age based on their submission. On the other hand, age verification uses verifiable data — like a user’s date of birth (extracted from an ID) — to determine their age. While age estimation is relatively accurate, age verification typically offers greater confidence in a user’s assessed age.
How accurate is age estimation?
Toggle description visibility
Age estimation as a class of age assurance technologies is generally very accurate — accurate enough that it convinced the Australian Age Assurance Technology Trial, which evaluated 60 age assurance technologies offered by a total of 48 vendors, that age assurance was possible to deploy on a large scale.
Among other measures, the Trial evaluated different technologies and methods to understand how close their estimates came, on average, to a user’s true age. It did this by calculating the Mean Absolute Error (MAE), the average difference between the estimated age and the true age. The smaller this number, the smaller the difference, and the more accurate the age estimate.
According to the Trial, age estimation technologies as a whole were found to produce an MAE of 2.72, meaning that the difference between the estimated age and the true age was 2.72 years. Some vendors and solutions can get even more accurate, including Persona, which the Trial indicated returned a MAE of 1.72.
What happens when someone fails an age assurance check?
Toggle description visibility
Platforms are responsible for designing their own age assurance protocols, including what happens when a user fails a check. That being said, platforms should ensure that they’re following the requirements of the regulatory regime(s) they’re subject to.
Occasionally, users who are old enough to access age-restricted content and websites may incorrectly fail an age check. This might be due to poor selfie lighting or image quality that makes it difficult to accurately gauge a user’s age; because they’re close to the age threshold the platform uses in age estimation; or because they don’t have a valid ID.
Many jurisdictions specify that platforms must have a plan in place to aid these affected users, such as fallback methods or an appeals process. For example, the Social Media Minimum Age Regulatory Guidance released by Australia’s eSafety Commissioner specifies that, among other considerations:
- All age assurance methods should be backed by accessible, timely, and accurate review processes.
- Providers should offer accessible, fair, and timely complaints or review mechanisms for end-users in relation to any adverse outcomes resulting from any age assurance processes.
- There should be human in the loop or human oversight to mitigate the risks of incorrect decisions, including unreasonably blocking or removing accounts that don’t belong to age-restricted users.
- Fully automated reviews should be avoided.
Similarly, the UK Online Safety Act specifies that platforms subject to the law must have a complaints procedure in place to address incorrect assessment of a user’s age during age assurance.
In cases where fallback methods aren’t prescribed by the law, platforms should use their user expectations and conversion requirements to inform their processes. Potential options include:
- Allowing users to retry age assurance a limited number of times
- Implementing a fallback ladder where other verification processes are used after the first is failed
- Manually reviewing failed attempts, particularly those tied to an appeal or complaint
What age assurance methods do regulators recommend?
Toggle description visibility
Generally speaking, most regulators don’t require that digital platforms implement specific methods for age assurance. Instead, they recommend that platforms take a risk-based approach to determining which methods to use and why. That being said, some regulators, like Brazil’s National Data Protection Agency (ANPD), do offer more prescriptive recommendations for when certain methods may be appropriate.
Likewise, some jurisdictions specifically state that certain methods can’t be used, or that they can’t be the only method available to users.
How does age assurance affect conversion?
Toggle description visibility
Even lower-friction age assurance methods like selfie age estimation can add steps to the account creation or log in process. As with all other sources of friction, it’s important to roll out age assurance thoughtfully to avoid negative impacts on conversion.
One way to preserve conversion rates is to allow users to choose between different methods. By giving them options, you can increase the likelihood they'll complete the process. On the flip side, failure to properly communicate your age assurance processes to your users can harm conversions by undermining user trust.
With this in mind, a simple way to protect conversions is to explain in plain language why you're asking them for information — whether it's based on a regional regulation, to protect minors from potentially harmful content, or something else entirely. Other communication strategies include:
- Explaining how you'll protect the data they share with you
- Ensuring clear consent language and options, tailored to the privacy and data laws of their country or region
Does age verification mean platforms need to store user IDs?
Toggle description visibility
Many online platforms delete IDs immediately after verifying a user’s age, depending on the requirements they’re subject to based on the jurisdiction. Check the platform’s privacy policies to understand how it processes, stores, and deletes data.
How do you design an age assurance process people trust?
Toggle description visibility
Some users might understandably be reluctant to take a selfie or share their ID — especially if they’re accessing a new website or platform. To share their information, they need to trust that you’ll process their data responsibly and securely.
Consider practicing privacy by design with measures like:
- Storing the age attribute rather than the identity: Of course, you’ll need to comply with the retention requirements of the regulations you’re subject to. Aim to store only the results of your assessment instead of the sensitive data itself. For example, you might record “Over 18? = True” rather than date of birth.
- Using the smallest possible retention windows by default: Try to keep age assurance evidence like user IDs and selfies for the minimum possible length of time required by law. While this will vary by jurisdiction, in most cases it will be between 3-7 days if you have reason to believe suspicious activity has occurred. Otherwise, many regulations allow personal data in submissions to be deleted immediately after an age outcome has been successfully reached.
- Being transparent with your users: Wherever possible, explain to users what age assurance evidence is kept and for how long before it’s deleted. Simply communicating your policies clearly can go far for building trust.
How does Persona handle data used in age checks?
Toggle description visibility
Persona’s recommended configuration automatically redacts all sensitive data including selfie photos, government ID portraits and details, date of birth, email addresses, phone numbers, and other data. Only the age outcome — such as “over 18,” the method used, and the time the user was evaluated — are retained. Persona does not sell or share personal data processed for verification or use it to train AI models.