How to implement an age verification system for your businesses
Age fabrication is a widespread issue: as noted by the Journal of Studies on Alcohol and Drugs, underage customers in the United States consumed 11.73% of all alcoholic drinks sold in the U.S. market in 2016. And according to a recent JAMA research letter, 49.8% of tobacco and vape shops in California failed to check the ID of underage decoys in 2018.
The problem: if you sell age-restricted goods or services to minors, your business could face both fines and legal ramifications that could negatively impact ongoing operations.
And simply incorporating any old age verification system isn’t enough — you also need to ensure your process is simple and seamless to help reduce friction. If users are forced to wait more than three seconds for any function or response, they’re far more likely to abandon your site and find another business that offers a better user experience.
But what does age verification look like in practice? In this piece, we’ll examine some of the current compliance standards of age verification policies, how they’re applied at state and federal levels, which businesses are required to implement these controls, the potential impact to your business if these processes aren’t in place, and how to implement a comprehensive and user-friendly process.
Defining age verification
Age verification is the process of confirming a person’s age before granting them access to age-restricted products, services, or content. The process typically involves the collection and verification of personal information or documents such as a government-issued ID or credit card. Age verification is commonly used in industries such as online gambling, alcohol sales, tobacco products, medical services, adult entertainment, and e-commerce to prevent minors from accessing age-restricted materials.
It’s common for people to confuse age verification with age gating, but these are not the same thing. Age gating is a method used to restrict access to content, services, or products based on a user’s age; however, unlike age verification, which confirms the age of an individual, age gating simply requires users to self-declare their age or date of birth (DOB) before accessing the restricted material. Age gating typically involves a pop-up or verification page where users enter their age or DOB to confirm they meet a minimum age requirement. Because the user self-attests their age, no verification is actually taking place to validate the person’s age.
Age verification processes
Age verification works by requiring customers to prove their age before giving them access to products or services, such as alcohol or lottery tickets. There are a variety of age verification methods that can look very different depending on whether a person’s age is being verified in person or electronically.
With the rapid advancement of AI, which makes creating fake identities easier than ever, online and in-person retailers and service providers must carefully consider which age verification methods will accurately verify a person’s age.
In-person age verification
If an age-restricted item or service is being purchased in person — for example, at a brick-and-mortar liquor store — the buyer will usually be required to present the seller with a government-issued photo ID, such as a driver’s license or passport, that lists their date of birth.
The seller will then typically check the ID for signs of tampering and to ensure that any special design features (such as holographic foils and text) are present. They will also check the photo on the ID to make sure it matches the face of the person in front of them.
Some IDs include security features, such as barcodes or NFC chips, which are specifically designed to help weed out fake or forged IDs. These can be scanned to help the seller determine whether or not an ID is legitimate.
Third-party age verification
When a consumer wants to access age-restricted content online, such as adult entertainment or sensitive content, the website must validate that the individual is over the age threshold. Some age-restricted websites use third parties like Google to authenticate a user’s age using a single sign-on model that allows the verified identity to be shared across participating websites.
When a consumer visits an age-restricted site, the system checks with a third party to validate the user’s age. The third-party (e.g., Google) then attests to whether the individual is over the age threshold without sharing their exact age.
Electronic age verification
When a customer wants to purchase an age-restricted item or service electronically, such as through a website or mobile app, the seller must still verify their age. This is usually accomplished through government ID verification.
Government ID verification usually works like this:
The user is prompted to take a photo of their driver’s license (or other accepted ID)
The ID is analyzed for authenticity
The user is prompted to take a selfie or series of selfies
The photo in the ID is compared against the selfie(s) to ensure that it was not stolen
Information is extracted from the ID and checked against the information provided by the user; the system then automatically determines whether or not the person is of legal age to complete the purchase
In states where mobile driver’s licenses (mDLs) are issued and accepted, a customer can use these instead of taking a photo of their physical ID.
Implementing government ID age verification
There are a variety of third-party age verification software options on the market that specialize in verifying government-issued identification documents for electronic age verification. These systems typically use the following workflow to verify a visitor’s age:
When visitors attempt to access age-restricted content or services, they are prompted to upload a scanned image or a photo of their ID card, driver's license, passport, or another form of government ID.
The uploaded document is then analyzed using optical character recognition (OCR) technology to extract relevant information such as name, date of birth, and ID number.
This information is cross-referenced with a verification database, such as government databases or other authoritative sources, to verify the user's age.
Once the verification process is successfully completed, visitors who meet the minimum age threshold are granted access to the desired content or service.
Some ID verification systems are more advanced and customizable than others. For example, some systems allow you to add more layers of verification, like selfie capture, to further ensure the user’s identity and age.
When implementing a government ID verification system, it’s essential that the chosen vendor meets stringent security and privacy measures to ensure the user’s personal information is protected during the verification process. This ensures compliance with privacy regulations and instills trust among users.
How GenAI and deepfakes exacerbate age fabrication
Generative artificial intelligence (GenAI) has ushered in a new era of image manipulation, making it easier for users to skirt electronic age verification systems and even in-person age verification. GenAI enables individuals to create highly realistic synthetic images and videos (called deepfakes), allowing them to create convincing older versions of themselves and potentially gain entry to age-restricted spaces.
As more people gain access to deepfake technology — and with no regulations limiting who can use this technology — the prevalence of age fabrication will only increase. A Europol study estimates that as much as 90% of online content may be synthetically generated by 2026. Meanwhile, the realism and sophistication of these images are increasing, making AI-generated images harder to discern from reality.
Deepfakes present a significant challenge in the context of age verification because many age verification methods rely heavily on visual cues. As a result, age verification systems are becoming more advanced in detecting suspicious images to prevent fraud. For example, some companies are building micromodels that leverage AI to spot different tells or signs typically associated with AI-generated images. The model might be trained to detect unnatural lighting or spot an atypical artifact, such as an extra finger, which could indicate that the image has been fabricated.
Meeting age verification compliance standards
Both federal- and state-level compliance regulations exist to help ensure consistency in age verification expectations and processes. In many cases, federal rules establish a broad framework for compliance around certain goods — such as tobacco — while state rules provide more specific guidance.
State and federal regulations
Let’s break down a few examples of state and federal interaction around age verification compliance.
Consider the example of tobacco mentioned above. Under the Tobacco 21 legislation signed into law on December 20th, 2019, “it is now illegal to sell any tobacco product — including cigarettes, cigars, and e-cigarettes — to anyone under 21.” The law applies to all persons and retailers without exceptions. According to the FDA, sellers must now check the photo ID of anyone under 27 who attempts to purchase a tobacco product. Businesses are also only permitted to sell tobacco products in vending machines located within adults-only facilities and cannot give away free samples of any tobacco product.
Age minimums for alcohol sales have also been established. As noted by the CDC, under the National Minimum Drinking Age Act of 1984, the required age for the sale of alcohol was raised to match the minimum legal drinking age (MLDA) of 21 years.
Along with federal laws, many states have enacted their own age-related sales restrictions. In New York, for example, businesses are not only responsible for sales made directly to underage individuals but are also responsible for “indirect deliveries,” which occur when another person purchases alcohol and then passes it on to a minor. If businesses do not comply with these regulations, the New York Liquor Authority can issue temporary or permanent bans on liquor licenses or assess fines of up to $10,000 per violation.
In California, Assembly Bill 2511 now requires that all online businesses selling age-restricted products or services such as fireworks, firearms, tobacco, or ammunition must “take reasonable steps, as specified, to ensure that the purchaser is of legal age at the time of purchase or delivery, including, but not limited to, verifying the age of the purchaser.” Businesses that fail to comply with this legislation may be subject to a $7,500 fine per violation.
Is age verification required at your business?
Any business that sells age-restricted products, provides access to age-gated activities, or delivers services that require adult consent must verify ages. Some of the business types include:
Tobacco and alcohol sales
As mentioned earlier, both tobacco and alcohol sellers must make an effort to verify the age of online purchasers. In the case of tobacco, this verification includes everything from cigarettes to smokeless tobacco, cigars, hookah pipes, e-cigarettes, nicotine gels, and dissolvables. Tobacco can only be sold to those over 21. Cannabis laws are slightly different: Many states permit the use of medical marijuana for those over 18, but businesses can only sell cannabis to people over 21. As noted above, the minimum age for alcohol sales is 21 across the United States.
Gambling operations
The United States legalized online gambling sites in 2011, and the market was worth nearly $2 billion in 2020. Along with success, however, comes more stringent restrictions that require online gaming sites to verify the age of potential players. The legal gambling age varies by state. Some, like Montana and Oklahoma, have set the minimum age at 18, while the majority of states have opted for 21.
Gaming sites
As noted by Business Insider, the pandemic created an opportunity for a new type of online wagering: video games. Platforms emerged that allowed players to bet real money on the outcomes of their favorite video games, but many of these new platforms did little to keep out underage bettors, despite requirements to do so. (Gaming sites generally follow the same rules as casino gambling, with legal ages set at either 18 or 21 by state.) As this market evolves, businesses should expect stronger restrictions and steeper penalties if they fail to follow these rules.
Medical services
Companies that offer medical services are also required to verify ages — a task that has become even more critical thanks to the rise of telemedicine. According to Forbes, most medical practices currently lack the ability to verify identity online. But with telemedicine here to stay, both age and identity verification expectations will rapidly evolve. Generally speaking, patients must be at least 18 to give informed consent for medical procedures or services.
eCommerce businesses
Any online business that sells age-restricted products or services must implement an age verification system. These products may include alcohol, tobacco, firearms, ammunition, or adult content. Failure to do so could result in fines, legal challenges, and a damaged reputation. Depending on the product being purchased, the legal age may range from 18 to 21.
Food delivery services
Food delivery services are also required to verify ages if consumers purchase alcohol. Regardless of whether alcohol is part of a larger food purchase or ordered on its own, delivery drivers must see proof of legal age before releasing any alcohol to customers. Anyone ordering alcohol must be 21 or older.
Adult entertainment
In the United States, companies operating in the adult entertainment space, such as those that sell or distribute pornography online, have always been required to ensure that a person was at least 18 years of age before they could access the website. This was typically achieved via age gating (discussed below) which was fairly easy to bypass.
Recently, Louisiana passed a law requiring more stringent age verification before a person can access online pornography. The law requires businesses to verify users’ ages via a “commercially reasonable method,” and calls out government ID verification and database verification as potential solutions.
Social media
While not regulated in the US on a national level yet, there has been bipartisan support for social media legislation aimed at protecting children. In the meantime, some states are taking matters into their own hands. For example, in March 2023, Utah's governor signed two bills into law that restrict children's use of social media platforms and requires social media companies to verify the ages of all users in the state.
What is age gating in identity verification?
As mentioned earlier, age gating is when a website requires users to self-certify their age before accessing age-restricted content or services. Organizations can implement age gates in different ways, such as when:
A beer company asks, “Are you over 21 years of age?” and the individual has to click “yes” to enter the site.
An online betting platform asks individuals to enter their birthdays before they’re allowed access.
An adult entertainment site requires individuals to select their age from a drop-down menu before the individuals can proceed.
Age gating vs. real age verification
Websites have used age gates for decades. However, age gating doesn’t actually qualify as a form of age verification because it doesn’t take steps to confirm the user’s age or prevent underage access.
Age gates are easy for underage users to bypass because they rely on self-attestation. In other words, an individual could fabricate their birthdate or age to access a site or purchase an age-restricted product or service. As a result, most countries require businesses to go beyond self-certified age gates and verify customers’ ages before offering them age-restricted products or services. In practice, this means obtaining and confirming valid documentation that clearly demonstrates a customer’s age.
How Persona’s age verification system can help
Persona can help verify user ages, protect your website or mobile application from bad actors, and increase conversions. We provide no- or low-code integration of our digital age verification technology, which includes:
Automated government ID upload and capture
Selfie capture with facial analysis and age estimation
Integrated database checks to verify ages and identities
Assessment without data storage, so you can stay compliant with regulations pertaining to underage users’ PII
Dynamic user experience that you can customize based on your business needs and risk tolerance
Customized branding so the verification experience feels native to your platform
With these tools in mind, a common flow for age verification might look like:
Request a government ID
Assess if the ID is valid
Check the ID’s information against issuing databases
Check the ID against blocklists to avoid onboarding repeat offenders
Depending on your risk tolerance and compliance requirements, you can add additional verifications for further assurance.
For example, after a user uploads an ID, you can request a selfie to ensure an underage individual isn't someone else’s ID. If Persona uncovers a mismatch, we can block the user from continuing their transaction or the onboarding process.
Persona also helps you onboard good users and reduce drop-off by:
Guiding users through the verification process
Leveraging auto-capture to minimize data entry errors
Enabling users to switch between devices, e.g. signing up for a service on their laptop and taking and uploading a selfie from their phone
Supporting more than 200 countries and territories and 20 languages
We know every business has unique identity verification (IDV) needs, so we built a flexible platform. Persona provides the “building blocks,” so you can customize and automate workflows and continually fine-tune them to boost conversion rates, increase operational efficiency, and comply with relevant regulations.
Online age verification regulations in the U.S.
In the United States, businesses must abide by both the state and federal laws and regulations that dictate age verification requirements for the sale, distribution, and delivery of age-restricted goods like alcohol and tobacco.
At the Federal level, for example, the National Minimum Drinking Age Act of 1984 requires businesses to verify that a customer is at least 21 years old before they can purchase or receive alcohol. Prior to that law, each state was allowed to enact its own, sometimes differing, laws — similar to marijuana laws today.
At the state level, Louisiana and California both recently passed laws requiring certain online businesses to perform age verification.
The Louisiana law, Act 440, specifically applies to companies that sell or distribute pornography online. The law requires that those businesses verify a user is at least 18 years of age before being granted access to adult content. While Act 440 doesn’t require all businesses to use a specific type of verification, it does call out government ID verification and database verification as two potential options.
The California Law, California Age-Appropriate Design Code Act (AADC), applies to any business that is likely to be accessed by children. It requires those businesses to implement more robust privacy policies for any user younger than 18 years. Companies that fail to comply with the requirements of the law could face penalties as high as $7,500 per violation, per child.
While the law doesn’t specifically require age verification, many industry experts believe that businesses will turn to age verification to comply with the requirements of the law and avoid such steep penalties. AADC goes into effect in July 2024.
Cutting out complexity: why you need an online age verification solution
The simplest form of online age verification is the familiar “are you ___ years old?” pop-up seen on many websites. The problem? While this approach is streamlined, it relies entirely on trust; users can simply lie if they’re underage. Because of this, simply asking users if they’re a certain age doesn’t usually satisfy due diligence, which requires companies to implement steps that actually reduce overall risk.
The other side of the age confirmation coin is complexity. If your age verification process is cumbersome and slow, users will simply take their business somewhere else.
If you need an age verification system, your best bet is to find one that bridges the gap between speed and security to help reduce risk and ensure regulatory due diligence. With Persona, users can verify their identity in seconds, and you can specify everything from which forms of verification you’ll require to how many attempts users can attempt verification in a row.
The Persona age verification process is simple: First, users take a picture of their ID. Then, Persona verifies the authenticity of the ID, extracts the birth date, and approves or denies the request based on the calculated age. If there’s concern that individuals may be using someone else’s ID (such as a child using their parent’s ID), you can also request a selfie for extra verification.
Persona also helps reduce user drop-off by guiding users through the verification process, leveraging auto-capture to minimize data entry errors, empowering easy device switching, and supporting more than 200 countries and territories and 20 languages. With our trusted identity infrastructure, age verifications typically take around 5 seconds — much faster than traditional identity verification providers who use manual review processes, which can take hours or days to return results.
The bottom line: age verification is essential for online businesses and retailers. But complexity can cause customer frustration, while oversimplification can introduce security risk. Persona’s market-leading age verification solution empowers easy age verification that’s compliant, accurate, and comprehensive.
Need robust, reliable, and streamlined age verification? Contact us to learn more or get started for free.
Online sites have a few options when it comes to verifying age. For example, they can use “age gates” that ask users to self-attest to their age. However, many sites now favor digital solutions that allow users to take a picture of their ID and submit it for verification.
Many tobacco retailers now use third-party age and identity verification services as recommended by the FDA in its Update for Retailers.
If you have a data-sharing agreement with mobile network operators (MNOs), it might be possible to verify a user’s age by phone number. In order for this to work, you would collect a user’s phone number and then query the MNOs’ database of customers, specifically checking the age of the customer associated with the phone number.
But this isn’t foolproof. An underage user might provide a phone number that isn’t theirs — for example, a child might input their parent’s phone number, or that of an older friend — in order to access your website. In order to prevent this, you would need to pair the technique with other verification methods, such as device verification.
Likewise, verifying age by phone number may not meet the requirements of certain laws, which may specifically require government ID verification.
One form of SSN verification works by collecting a user’s Social Security number, name, and date of birth, and then comparing them against official records on a pass/fail basis. With this in mind, it can potentially be used to verify a user’s age (by confirming whether or not the date of birth provided by the user is, in fact, truthful).
Of course, SSN verification cannot detect instances of identity theft. With this in mind, it’s often paired with other verification methods.