Industry

Age verification system: How to add it into your business

Any business that sells age-restricted products, provides access to age-gated activities, or delivers services that require adult consent must verify ages. Learn more.

Image of an age verification modal
Read time:
Share this post
Copied
Table of contents
⚡ Key takeaways
  • Any business that sells age-restricted products, provides access to age-gated activities, or delivers services that require adult consent must verify ages.
  • Age gates don't really don’t qualify as a form of age verification because they don’t actually verify that the information provided by the user is accurate.
  • Age verification is usually accomplished through government ID verification.

Age fabrication is a widespread issue: as noted by the Journal of Studies on Alcohol and Drugs, underage customers in the United States consumed 11.73% of all alcoholic drinks sold in the U.S. market in 2016. And according to a recent JAMA research letter, 49.8% of tobacco and vape shops in California failed to check the ID of underage decoys in 2018.

The problem: if you sell age-restricted goods or services to minors, your business could face both fines and legal ramifications that could negatively impact ongoing operations.

And simply incorporating any old age verification system isn’t enough — you also need to ensure your process is simple and seamless to help reduce friction. If users are forced to wait more than three seconds for any function or response, they’re far more likely to abandon your site and find another business that offers a better user experience.

But what does age verification look like in practice? In this piece, we’ll examine some of the current compliance standards of age verification policies, how they’re applied at state and federal levels, which businesses are required to implement these controls, the potential impact to your business if these processes aren’t in place, and how to implement a comprehensive and user-friendly process.

How does age verification work?

Age verification works by requiring customers to prove their age before giving them access to products or services, such as alcohol or lottery tickets. It can look very different depending on whether a person’s age is being verified in person or electronically.

In-person age verification

If an age-restricted item or service is being purchased in person — for example, at a brick-and-mortar liquor store — the buyer will usually be required to present the seller with a government-issued photo ID, such as a driver’s license or passport, that lists their date of birth. 

The seller will then typically check the ID for signs of tampering and to ensure that any special design features (such as holographic foils and text) are present. They will also check the photo on the ID to make sure it matches the face of the person in front of them. 

Some IDs include security features, such as barcodes or NFC chips, which are specifically designed to help weed out fake or forged IDs. These can be scanned to help the seller determine whether or not an ID is legitimate. 

Electronic age verification

When a customer wants to purchase an age-restricted item or service electronically, such as through a website or mobile app, the seller must still verify their age. This is usually accomplished through government ID verification. 

Government ID verification usually works like this:

  • The user is prompted to take a photo of their driver’s license (or other accepted ID)
  • The ID is analyzed for authenticity
  • The user is prompted to take a selfie or series of selfies
  • The photo in the ID is compared against the selfie(s) to ensure that it was not stolen
  • Information is extracted from the ID and checked against the information provided by the user; the system then automatically determines whether or not the person is of legal age to complete the purchase 

In states where mobile driver’s licenses (mDLs) are issued and accepted, a customer can use these instead of taking a photo of their physical ID. 

Secure, localized age verification
Comply with changing age regulations and minimize fraud solutions

Meeting age verification compliance standards

Both federal- and state-level compliance regulations exist to help ensure consistency in age verification expectations and processes. In many cases, federal rules establish a broad framework for compliance around certain goods — such as tobacco — while state rules provide more specific guidance.

State and federal regulations

Let’s break down a few examples of state and federal interaction around age verification compliance.

Consider the example of tobacco mentioned above. Under the Tobacco 21 legislation signed into law on December 20th, 2019, “it is now illegal to sell any tobacco product — including cigarettes, cigars, and e-cigarettes — to anyone under 21.” The law applies to all persons and retailers without exceptions. According to the FDA, sellers must now check the photo ID of anyone under 27 who attempts to purchase a tobacco product. Businesses are also only permitted to sell tobacco products in vending machines located within adults-only facilities and cannot give away free samples of any tobacco product.

Age minimums for alcohol sales have also been established. As noted by the CDC, under the National Minimum Drinking Age Act of 1984, the required age for the sale of alcohol was raised to match the minimum legal drinking age (MLDA) of 21 years.

Along with federal laws, many states have enacted their own age-related sales restrictions. In New York, for example, businesses are not only responsible for sales made directly to underage individuals but are also responsible for “indirect deliveries,” which occur when another person purchases alcohol and then passes it on to a minor. If businesses do not comply with these regulations, the New York Liquor Authority can issue temporary or permanent bans on liquor licenses or assess fines of up to $10,000 per violation.  

In California, Bill 2511 now requires that all online businesses selling age-restricted products or services such as fireworks, firearms, tobacco, or ammunition must “take reasonable steps, as specified, to ensure that the purchaser is of legal age at the time of purchase or delivery, including, but not limited to, verifying the age of the purchaser.” Businesses that fail to comply with this legislation may be subject to a $7,500 fine per violation.

Is age verification required at your business?

Any business that sells age-restricted products, provides access to age-gated activities, or delivers services that require adult consent must verify ages. Some of the business types include:

Tobacco and alcohol sales

As mentioned earlier, both tobacco and alcohol sellers must make an effort to verify the age of online purchasers. In the case of tobacco, this verification includes everything from cigarettes to smokeless tobacco, cigars, hookah pipes, e-cigarettes, nicotine gels, and dissolvables. Tobacco can only be sold to those over 21. Cannabis laws are slightly different: Many states permit the use of medical marijuana for those over 18, but businesses can only sell cannabis to people over 21. As noted above, the minimum age for alcohol sales is 21 across the United States.

Gambling operations

The United States legalized online gambling sites in 2011, and the market was worth nearly $2 billion in 2020. Along with success, however, comes more stringent restrictions that require online gaming sites to verify the age of potential players. The legal gambling age varies by state. Some, like Montana and Oklahoma, have set the minimum age at 18, while the majority of states have opted for 21.

Gaming sites

As noted by Business Insider, the pandemic created an opportunity for a new type of online wagering: video games. Platforms emerged that allowed players to bet real money on the outcomes of their favorite video games, but many of these new platforms did little to keep out underage bettors, despite requirements to do so. (Gaming sites generally follow the same rules as casino gambling, with legal ages set at either 18 or 21 by state.) As this market evolves, businesses should expect stronger restrictions and steeper penalties if they fail to follow these rules.

Medical services

Companies that offer medical services are also required to verify ages — a task that has become even more critical thanks to the rise of telemedicine. According to Forbes, most medical practices currently lack the ability to verify identity online. But with telemedicine here to stay, both age and identity verification expectations will rapidly evolve. Generally speaking, patients must be at least 18 to give informed consent for medical procedures or services.

eCommerce businesses

Any online business that sells age-restricted products or services must implement an age verification system. These products may include alcohol, tobacco, firearms, ammunition, or adult content. Failure to do so could result in fines, legal challenges, and a damaged reputation. Depending on the product being purchased, the legal age may range from 18 to 21.

Food delivery services

Food delivery services are also required to verify ages if consumers purchase alcohol. Regardless of whether alcohol is part of a larger food purchase or ordered on its own, delivery drivers must see proof of legal age before releasing any alcohol to customers. Anyone ordering alcohol must be 21 or older.

Adult entertainment

In the United States, companies operating in the adult entertainment space, such as those that sell or distribute pornography online, have always been required to ensure that a person was at least 18 years of age before they could access the website. This was typically achieved via age gating (discussed below) which was fairly easy to bypass.

Recently, Louisiana passed a law requiring more stringent age verification before a person can access online pornography. The law requires businesses to verify users’ ages via a “commercially reasonable method,” and calls out government ID verification and database verification as potential solutions.

Social media

While not regulated in the US on a national level yet, there has been bipartisan support for social media legislation aimed at protecting children. In the meantime, some states are taking matters into their own hands. For example, in March 2023, Utah's governor signed two bills into law that restrict children's use of social media platforms and requires social media companies to verify the ages of all users in the state.

What is age gating in identity verification?

Age gating is when a website requires users to self-certify their age before accessing age-restricted content or services. Organizations can implement age gates in different ways, such as when: 

  • A beer company asks, “Are you over 21 years of age?” and the individual has to click “yes” to enter the site.
  • An online betting platform asks individuals to enter their birthdays before they’re allowed access.
  • An adult entertainment site requires individuals to select their age from a drop-down menu before the individuals can proceed.

Websites have used age gates for decades. However, they really don’t qualify as a form of age verification because age gates don’t take any steps to confirm the user’s age or prevent underage access. 

As a result, most countries require businesses to go beyond self-certified age gates and verify customers’ ages before offering them age-restricted products or services. In practice, this means obtaining and confirming valid documentation that clearly demonstrates a customer’s age.

How Persona’s age verification system can help

Persona can help verify user ages, protect your website or mobile application from bad actors, and increase conversions. We provide no- or low-code integration of our digital age verification technology, which includes:

  • Automated government ID upload and capture
  • Selfie capture with facial analysis and age estimation
  • Integrated database checks to verify ages and identities
  • Assessment without data storage, so you can stay compliant with regulations pertaining to underage users’ PII
  • Dynamic user experience that you can customize based on your business needs and risk tolerance
  • Customized branding so the verification experience feels native to your platform

With these tools in mind, a common flow for age verification might look like: 

  1. Request a government ID
  2. Assess if the ID is valid
  3. Check the ID’s information against issuing databases
  4. Check the ID against blocklists to avoid onboarding repeat offenders

Depending on your risk tolerance and compliance requirements, you can add additional verifications for further assurance. 

For example, after a user uploads an ID, you can request a selfie to ensure an underage individual isn't someone else’s ID. If Persona uncovers a mismatch, we can block the user from continuing their transaction or the onboarding process. 

Persona also helps you onboard good users and reduce drop-off by:

  • Guiding users through the verification process
  • Leveraging auto-capture to minimize data entry errors
  • Enabling users to switch between devices, e.g. signing up for a service on their laptop and taking and uploading a selfie from their phone
  • Supporting more than 200 countries and territories and 20 languages 

We know every business has unique identity verification (IDV) needs, so we built a flexible platform. Persona provides the “building blocks,” so you can customize and automate workflows and continually fine-tune them to boost conversion rates, increase operational efficiency, and comply with relevant regulations. 

Online age verification regulations in the U.S.

In the United States, businesses must abide by both the state and federal laws and regulations that dictate age verification requirements for the sale, distribution, and delivery of age-restricted goods like alcohol and tobacco.

At the Federal level, for example, the National Minimum Drinking Age Act of 1984 requires businesses to verify that a customer is at least 21 years old before they can purchase or receive alcohol. Prior to that law, each state was allowed to enact its own, sometimes differing, laws — similar to marijuana laws today.

At the state level, Louisiana and California both recently passed laws requiring certain online businesses to perform age verification.

The Louisiana law, Act 440, specifically applies to companies that sell or distribute pornography online. The law requires that those businesses verify a user is at least 18 years of age before being granted access to adult content. While Act 440 doesn’t require all businesses to use a specific type of verification, it does call out government ID verification and database verification as two potential options.

The California Law, California Age-Appropriate Design Code Act (AADC), applies to any business that is likely to be accessed by children. It requires those businesses to implement more robust privacy policies for any user younger than 18 years. Companies that fail to comply with the requirements of the law could face penalties as high as $7,500 per violation, per child.

While the law doesn’t specifically require age verification, many industry experts believe that businesses will turn to age verification to comply with the requirements of the law and avoid such steep penalties. AADC goes into effect in July 2024.

Free white paper
See how experts evaluate verification solutions

Cutting out complexity: why you need an online age verification solution

The simplest form of online age verification is the familiar “are you ___ years old?” pop-up seen on many websites. The problem? While this approach is streamlined, it relies entirely on trust; users can simply lie if they’re underage. Because of this, simply asking users if they’re a certain age doesn’t usually satisfy due diligence, which requires companies to implement steps that actually reduce overall risk.

The other side of the age confirmation coin is complexity. If your age verification process is cumbersome and slow, users will simply take their business somewhere else.

If you need an age verification system, your best bet is to find one that bridges the gap between speed and security to help reduce risk and ensure regulatory due diligence. With Persona, users can verify their identity in seconds, and you can specify everything from which forms of verification you’ll require to how many attempts users can attempt verification in a row.

The Persona age verification process is simple: First, users take a picture of their ID. Then, Persona verifies the authenticity of the ID, extracts the birth date, and approves or denies the request based on the calculated age. If there’s concern that individuals may be using someone else’s ID (such as a child using their parent’s ID), you can also request a selfie for extra verification.

Persona also helps reduce user drop-off by guiding users through the verification process, leveraging auto-capture to minimize data entry errors, empowering easy device switching, and supporting more than 200 countries and territories and 20 languages. With our trusted identity infrastructure, age verifications typically take around 5 seconds — much faster than traditional identity verification providers who use manual review processes, which can take hours or days to return results.

The bottom line: age verification is essential for online businesses and retailers. But complexity can cause customer frustration, while oversimplification can introduce security risk. Persona’s market-leading age verification solution empowers easy age verification that’s compliant, accurate, and comprehensive.

Need robust, reliable, and streamlined age verification? Contact us to learn more or get started for free.

Frequently asked questions

How do online sites verify age?

Online sites have a few options when it comes to verifying age. For example, they can use “age gates” that ask users to self-attest to their age. However, many sites now favor digital solutions that allow users to take a picture of their ID and submit it for verification.

How do online tobacco retailers verify age?

Many tobacco retailers now use third-party age and identity verification services as recommended by the FDA in its Update for Retailers.

Can adult verification be proven by phone?

If you have a data-sharing agreement with mobile network operators (MNOs), it might be possible to verify a user’s age by phone number. In order for this to work, you would collect a user’s phone number and then query the MNOs’ database of customers, specifically checking the age of the customer associated with the phone number. 

But this isn’t foolproof. An underage user might provide a phone number that isn’t theirs — for example, a child might input their parent’s phone number, or that of an older friend — in order to access your website. In order to prevent this, you would need to pair the technique with other verification methods, such as device verification.

Likewise, verifying age by phone number may not meet the requirements of certain laws, which may specifically require government ID verification.

Can Social Security numbers be used to verify age?

One form of SSN verification works by collecting a user’s Social Security number, name, and date of birth, and then comparing them against official records on a pass/fail basis. With this in mind, it can potentially be used to verify a user’s age (by confirming whether or not the date of birth provided by the user is, in fact, truthful).

Of course, SSN verification cannot detect instances of identity theft. With this in mind, it’s often paired with other verification methods.

Continue reading

Continue reading

Know Your Employee (KYE): How identity verification fits in the picture
Know Your Employee (KYE): How identity verification fits in the picture
Industry

Know Your Employee (KYE): How identity verification fits in the picture

A thorough Know Your Employee (KYE) process helps you verify the identity, credentials, and background of new and existing employees to control for fraud.

Data subject access requests for the GDPR
Data subject access requests for the GDPR
Industry

Data subject access requests for the GDPR

Learn about data subject access requests (DSARs) for the GDPR and individuals’ rights to access their personal data.

Online KYC during user onboarding
Online KYC during user onboarding
Industry

Online KYC during user onboarding

Many businesses need to have a KYC process for onboarding new users. Learn what's required, common steps, and more.

How age verification systems can help you prepare for CA AADC
Industry

How age verification systems can help you prepare for CA AADC

There are several steps you can take to prepare for CA AADC before 2024, including internal research, DPIAs, and implementing age verification tools.

From clicks to compliance: Mastering age verification online
Industry

From clicks to compliance: Mastering age verification online

Age verification is an important part of protecting online minors. Learn more about the how and why behind age verification for online platforms.

What is selfie identity verification, and how does it work?
Industry

What is selfie identity verification, and how does it work?

Learn about selfie identity verification and liveness detection, how they work together, the challenges they address, and their shortcomings.

Ready to get started?

Get in touch or start exploring Persona today.