Privacy and age verification in gaming: what you need to know

You’ve been looking forward to this gaming session all day. You finally sit down, boot up your console, and get ready to dive in when you’re hit with a screen demanding a live selfie or a picture of your ID to verify your age. 

Gone are the days when you could just enter your birthdate or click a box saying you’re over 18 or over 21. Now you’re being hit with an age gate before you can access social features or make purchases.

It can be frustrating and time-consuming, and you might be wondering why the gaming platform even needs this data and what it’s actually doing with it. 

Handing over your data just to play a game might feel like a massive privacy risk, especially with the constant threat of data breaches and the possibility of platforms sharing or selling the data. However, these checks aren’t there to slow you down or profit from your personal data. 

From complying with global safety laws to the ongoing battle against fraudsters and cheaters, there are specific reasons why companies have changed their policies. Here’s a look at why these age assurance checks are happening, who and what they are meant to protect, and how you can keep your personal data safe.

Which types of games require age verification?

You are most likely to encounter age verification checks on games or platforms that feature gambling, real money transactions, adult content, or social chat features. However, the requirements often depend more on regional laws than on the specific type of game. 

• Gambling: Games that include gambling, prediction markets, or sports betting may be required to verify users’ identities to comply with financial reporting laws and laws designed to protect minors. 

• Loot boxes: Some countries classify loot boxes as gambling, which can trigger identity verification or age assurance requirements. 

• Purchases: In some states, app stores have to verify a person’s age (and obtain parental consent if they’re a child) before enabling downloads and in-app purchases. 

• Social features: Gaming platforms, such as Xbox, PlayStation, and Steam, may require age assurance checks to unlock social spaces in certain regions, like the UK. 

Additionally, even if a game doesn’t initially ask for your ID, you may hit a verification gate if you trigger red flags by making unusually large transactions, transferring large amounts of in-game currency between accounts, or logging in from what the platform has identified as a suspicious IP address.

Why do games and gaming platforms ask about age?

Games and gaming platforms generally ask about your age because they’re required to know how old their users are, they need to verify users’ identities, or they want to create a safer environment. 

To comply with age assurance regulations

Countries around the world are exploring and implementing age assurance or verification requirements for various types of online platforms, including gaming platforms. 

For example, the Online Safety Act (OSA) in the UK requires gaming platforms and providers to assess whether children under 18 are likely to use their platforms. If they are, the provider must conduct a children’s risk assessment and create age-appropriate access, such as disabling certain social features for younger users.

These requirements often build on established legislation, like the Children’s Online Privacy Protection Act (COPPA) in the US and the GDPR in the EU and UK, which set strict age thresholds on the use of data.

To comply with financial regulations 

Operators of sports betting sites, other types of gambling sites, and prediction markets may be required to comply with anti-money laundering (AML) and consumer protection laws, some of which include strict Know Your Customer (KYC) controls. 

Similarly, platforms that allow in-game currency to be exchanged for real-world value could potentially be classified as money service businesses, triggering AML/KYC requirements. These go beyond age verification and require the gaming company to verify your age, date of birth, address, and tax identification number. 

To keep children safe

Age assurance laws are largely intended to protect children by stopping them from gambling, prohibiting them from interacting with adults, and blocking access to unsafe or inappropriate content. Many gaming platforms also proactively take steps to protect children from potentially harmful situations, even if the platform isn’t subject to age assurance laws. 

How does age assurance or verification usually work?

Gaming platforms can use several different methods that fall into two major categories: age assurance and age verification. 

Age assurance is a broad category that typically involves less intrusive techniques to estimate or infer your age without having to see a physical document. One popular method is selfie age estimation, in which AI analyzes your facial features to estimate your age. Other methods estimate or infer your age from data associated with your email address or your account’s history. 

Age verification is a higher-assurance check that may be required by some laws or when the game can’t accurately estimate or infer an age. For instance, if a 15-year-old tries to play a 16+ game, selfie estimation might not be accurate enough to make a good decision. 

Verification methods may require you to upload a picture of your government ID and take a selfie to verify it’s your ID. In some countries, gaming platforms can also verify your age by connecting to databases from financial institutions, phone carriers, credit bureaus, and other companies. 

How age-related laws affect your gaming experience

In practice, the varying legal requirements and business practices can result in different experiences depending on where you live and what you play. However, you might increasingly be expected to go through an age assurance or verification process.

This can also mean that game features change depending on your age. For example, if you’re under a certain age, in-game voice chat capabilities and in-game purchases might be disabled.

Is verifying your identity with gaming platforms risky?

Verifying your identity can be risky depending on how the information is processed. Ideally, the gaming platforms practice data minimization, collecting and retaining only the minimum amount of data needed for verification. 

But if companies don’t immediately delete personal data or copies of government-issued IDs, that data could be leaked or hacked, especially if the company doesn’t have good security practices.

However, for games that involve gambling, regulations may require the platform to retain personal data for an extended period to comply with AML laws. Some platforms may also choose to retain some data for anti-fraud purposes. 

How do I know if a game has good security practices?

Unfortunately, it is hard to tell for certain if a game has good security practices. That said, there are specific green flags you can look for: 

• Data minimization: Ideally, a platform will practice data minimization, meaning that it deletes personal data once the process is complete. However, sometimes companies retain data longer to comply with regulatory requirements or fight more sophisticated forms of fraud. 

• Security certifications: Certifications such as SOC 2 Type II are a strong indicator that a company has undergone independent audits to verify its security controls. 

Many companies use third-party age or identity verification providers rather than handling your personal data themselves. Ideally, the provider has similar data minimization and security practices in place. 

Some providers, like Persona, also offer privacy-preserving methods that only give the gaming platform a confirmation that you’re over a certain age rather than your date of birth or other identifying information.