Privacy and age verification in gaming: what you need to know

When games ask you to verify your age, it's because laws in the UK, US, and other regions now require gaming platforms to know how old their users are, particularly before granting access to social features, gambling, in-app purchases, and adult content.

The requirement comes from legislators and regulators, not from the game itself. The UK's Online Safety Act, for example, requires platforms to assess whether children are likely to use their services and restrict access accordingly.

That context doesn't make the experience less frustrating. And, handing over your ID to play a game raises real questions about what happens to that data, who can access it, and whether platforms are sharing or selling it.

This article explains why age checks exist, who they are meant to protect, and how to keep your personal information safe while gaming.

Which types of games require age verification?

You are most likely to encounter age verification checks on games or platforms that feature gambling, real money transactions, adult content, or social chat features. However, the requirements often depend more on regional laws than on the specific type of game. To illustrate:

• Gambling: Games that include gambling, prediction markets, or sports betting may be required to verify users’ identities to comply with financial reporting laws and laws designed to protect minors. 

• Loot boxes: Some countries classify loot boxes as gambling, which can trigger identity verification or age assurance requirements. 

• Purchases: In some states, app stores have to verify a person’s age (and obtain parental consent if they’re a child) before enabling downloads and in-app purchases. 

• Social features: Gaming platforms, such as Xbox, PlayStation, and Steam, may require age assurance checks to unlock social spaces in certain regions, like the UK. 

Even if a game doesn’t initially ask for your ID, you may hit a verification gate if you trigger red flags by making unusually large transactions, transferring large amounts of in-game currency between accounts, or logging in from what the platform has identified as a suspicious IP address.

Why do games and gaming platforms ask about age?

Games and gaming platforms generally ask about your age because they’re required to know how old their users are, they need to verify users’ identities, or they want to create a safer environment. Here's what each of these mean:

Complying with age assurance regulations

Countries around the world are exploring and implementing age assurance or verification requirements for various types of online platforms, including gaming platforms. 

For example, the Online Safety Act (OSA) in the UK requires gaming platforms and providers to assess whether children under 18 are likely to use their platforms. If they are, the provider must conduct a children’s risk assessment and create age-appropriate access, such as disabling certain social features for younger users.

These requirements often build on established legislation, like the Children’s Online Privacy Protection Act (COPPA) in the US and the GDPR in the EU and UK, which set strict age thresholds on the use of data.

Complying with financial regulations 

Operators of sports betting sites, other types of gambling sites, and prediction markets may be required to comply with anti-money laundering (AML) and consumer protection laws, some of which include strict Know Your Customer (KYC) controls. 

Similarly, platforms that allow in-game currency to be exchanged for real-world value could potentially be classified as money service businesses, triggering AML/KYC requirements. These go beyond age verification and require the gaming company to verify your age, date of birth, address, and tax identification number. 

Protecting minors and children

Age assurance laws are largely intended to protect children by stopping them from gambling, prohibiting them from interacting with adults, and blocking access to unsafe or inappropriate content. Many gaming platforms also proactively take steps to protect children from potentially harmful situations, even if the platform isn’t subject to age assurance laws. 

How does age assurance or verification usually work?

Gaming platforms can use several different methods that fall into two major categories: age assurance and age verification. 

Age assurance is a broad category that typically involves less intrusive techniques to estimate or infer your age without having to see a physical document. One popular method is selfie age estimation, in which AI analyzes your facial features to estimate your age. Other methods estimate or infer your age from data associated with your email address or your account’s history. 

Age verification is a higher-assurance check that may be required by some laws or when the game can’t accurately estimate or infer an age. For instance, if a 15-year-old tries to play a 16+ game, selfie estimation might not be accurate enough to make a good decision. 

Verification methods may require you to upload a picture of your government ID and take a selfie to verify it’s your ID. In some countries, gaming platforms can also verify your age by connecting to databases from financial institutions, phone carriers, credit bureaus, and other companies. 

How do age-related laws affect your gaming experience?

In practice, the varying legal requirements and business practices can result in different experiences depending on where you live and what you play. However, you might increasingly be expected to go through an age assurance or verification process.

This can also mean that game features change depending on your age. For example, if you’re under a certain age, in-game voice chat capabilities and in-game purchases might be disabled.

Is verifying your identity with gaming platforms risky?

Verifying your identity can be risky depending on how the information is processed. Ideally, the gaming platforms practice data minimization, collecting and retaining only the minimum amount of data needed for verification. 

But if companies don’t immediately delete personal data or copies of government-issued IDs, that data could be leaked or hacked, especially if the company doesn’t have good security practices.

However, for games that involve gambling, regulations may require the platform to retain personal data for an extended period to comply with AML laws. Some platforms may also choose to retain some data for anti-fraud purposes. 

How do I know if a game has good security practices?

Unfortunately, it's hard to tell for certain if a game implements good security practices. That said, there are specific green flags you can look for: 

• Data minimization: Ideally, the platform practices data minimization, meaning that it deletes personal data once the process is complete. However, some companies retain data longer to comply with regulatory requirements or fight more sophisticated forms of fraud. 

• Security certifications: Certifications such as SOC 2 Type II are a strong indicator that a company has undergone independent audits to verify its security controls. 

Many companies use third-party age or identity verification providers rather than handling your personal data themselves. Ideally, the provider has similar data minimization and security practices in place. 

Some providers, like Persona, also offer privacy-preserving methods that only give the gaming platform a confirmation that you’re over a certain age rather than your date of birth or other identifying information.