Age Verification in 2026: Terms and Tradeoffs

As concerns have grown surrounding the under-moderated exposure of children to online content, age checks have become part of the internet’s core infrastructure. In the UK alone, more than 69 million age checks were completed across a sample of 32 online services between July and December 2025, representing 23 times as many as in the preceding six months. This raises questions of how to verify age while respecting privacy concerns.

The more intrusive age checks become, the greater the risk that platforms collect unnecessary personal data or force users to repeatedly prove who they are just to access ordinary services. So, the challenge lies in safeguarding minors and doing so without requiring everyone to disclose sensitive identity information whenever they go online, which could push users toward less moderated parts of the internet.

Let's break down some terms related to age verification, the regulations behind them, and the risks of identity-linked checks.

Age gating vs. age assurance vs. age verification

The terms around online age checks are often used interchangeably, but in fact describe different parts of the process.

Age verification forms part of many Know Your Customer (KYC) processes. Regulated businesses often need to verify identity attributes, such as date of birth, during onboarding to ensure users are eligible to access their services. This is particularly important in iGaming, where age verification cannot be deferred until a player reaches a transaction or deposit threshold. UK online gambling rules, for example, require operators to verify name, address, and date of birth before allowing a customer to gamble. Age verification remains mandatory even where an anti-money laundering (AML) transaction threshold has not been reached or does not apply.

Suggested read: What Is KYC? A Complete Guide to Know Your Customer Verification

Who decides how age checks get built?

There is no single authority that determines how online age verification works. Age verification laws define age limits, covered services, and responsibilities differently depending on the local jurisdiction. Regulators interpret effectiveness, and data protection authorities limit the collection and use of information. Standards bodies, app stores, platforms, and vendors shape the technology, while courts police the boundaries of the law.

The result is a fast-changing patchwork of approaches:

• In the UK, the Online Safety Act requires “highly effective” age assurance to prevent children from normally encountering pornography and other harmful content. A March 2026 joint statement from Ofcom and the ICO stresses the importance of duties to both online safety and data protection.
• In the EU, the Digital Services Act requires platforms accessible to minors to provide a high level of privacy, safety, and security. The European Commission’s age verification blueprint became feature-ready in April 2026, allowing users to prove they are over 18 without sharing other personal information.
• In Australia, covered social media platforms have had to take reasonable steps to stop under-16s from creating or keeping accounts since December 10, 2025. 
• In the US, rules differ by state and use case. In 2025, the Supreme Court upheld a Texas requirement mandating age verification for certain websites that host material harmful to minors. State app store laws impose separate obligations, while COPPA governs data collected from children under 13 at a federal level.

Businesses thus need to be aware of how different jurisdictions approach age verification challenges.

How age estimation actually works

There are multiple approaches to age estimation that use software to analyze a user’s features or behaviors and return an age estimate. In facial age estimation, for example, software analyzes a photo or short video. The software detects a face, then applies a machine-learning model trained to associate visible patterns with age. It returns a predicted age, probability, or age band for comparison with the policy threshold.

Sumsub's Facial Age Estimation, for example, runs on in-house Liveness technology. The same check that estimates age also screens for spoofing attempts such as masks, deepfakes, and prerecorded footage. This makes it useful both for controlling access and for detecting teenage users attempting to evade an age restriction or parental consent requirement.

Because algorithms typically allow for a non-significant one- to two-year margin of error, providers commonly apply a "challenge age" buffer above the actual age limit rather than gating directly at the legal threshold. A user estimated above the buffer passes; someone below it is prompted to complete another method, such as ID verification. This reduces the risk of admitting older-looking minors, although it means some adults must complete an extra step.

The right buffer depends on the sector's risk tolerance:

• A three-year buffer for lower-risk use cases
• A seven-year buffer (e.g., a challenge age of 25 for an 18+ service) for a more balanced approach
• A 10-year buffer (e.g., a challenge age of 28 for an 18+ service) for higher-risk sectors requiring stronger protection

Account and behavioral signals can also be used to infer age with little friction. YouTube, for example, uses behavioral age estimation to reduce the likelihood that younger audiences access inappropriate material. These solutions involve profiling and are less suitable for a hard gate that entails a higher level of risk. In July 2026, Ofcom said services should replace or supplement inference unless they can prove it is highly effective and data protection compliant.

Where age estimation falls short

The main limitation of age estimation is in its name. It only produces an estimation, not a hard fact. Lighting, camera quality, pose, expression, glasses, makeup, facial hair, aging patterns, and the population represented in the training data can all affect the result.

The US National Institute of Standards and Technology (NIST) has found that performance of age estimation software varies by algorithm, image quality, sex, age, and region of birth. For controlled visa photographs, the mean absolute error improved from 4.3 years in 2014 to 3.1 years in 2023, but errors were still almost always higher for female faces. These errors can be particularly meaningful for close boundaries of 13, 16, 18, or 21.

Another core limitation is real-world deployment and effectiveness. Ofcom reported in July 2026 that only two of four dating services it analyzed had liveness detection at the time information was collected. In December 2025, 12% of UK online 15- to 17-year-olds still visited at least one of the three highest-reaching dating apps, unchanged from before the relevant child-safety duties took effect.

In July 2025, PC Gamer also reported that it passed a Discord facial age check using a realistic video game character, which shows how simple it can be to bypass poorly designed age verification processes.

How age verification actually works

Verification means testing an age claim against evidence. The platform can run that test itself or take the result from a specialist third-party provider.

The common methods:

• Document verification. Software checks a passport, driver's license, or identity card for authenticity, extracts the date of birth, and may compare the portrait with a live selfie.
• Video identification. The user joins a live video session in which an operator reviews the identity document, confirms the user's presence, and verifies identity and age.
• Authoritative database checks. Details are compared with government, electoral, or other reliable records where those exist.
• Bank account verification. Through open banking in supported jurisdictions, a provider connects to a verified bank account and uses reliable account holder information, including date of birth where available.
• Digital identity credentials. A trusted issuer verifies an age attribute through a digital wallet or a reusable identity service.

All of that personal data raises the obvious question: is age verification safe? There's no universal answer, and treating privacy and safety as opposing forces gets you a bad one. A system that blocks underage access while creating avoidable exposure to identity theft, tracking, or a breach isn't safe. It's safe in one direction and dangerous in the other.

The real test is proportionality. Businesses need to weigh a method against the harm it addresses: data minimization, where processing happens, encryption, retention, vendor governance, resistance to spoofing, and whether the proof is actually bound to the person presenting it. A highly accurate check can still be the wrong call. Building a permanent identity database to protect a low-risk activity is a bad trade no matter how well the matching works.

Identity-linked checks and their risks

Identity-linked checks buy a high level of confidence, both that a person meets an age requirement and that the evidence belongs to them. For regulated activities such as financial services, gambling, and alcohol sales, that's usually the right level, especially where the business already has a lawful reason to run KYC or prevent identity fraud.

Businesses also adopt identity-linked checks voluntarily, without a legal mandate, to protect users, limit reputational risk, and build trust. Dating services are the clearest case: strong checks keep minors out of adult spaces and make it harder for adults to pose as children. Ofcom's finding that only two of four analyzed dating services had liveness detection shows how uneven that adoption still is.

But confirming age and establishing identity are not the same act. An identity document can carry a photograph, name, exact date of birth, document number, nationality, and address. A digital ID used for digital identity verification can either disclose a full identity or confirm a single attribute, such as whether the holder is over 18. When age is the only thing that matters, the attribute-level answer is the proportionate one.

Public support for the principle is strong. YouGov polling from March 2026 found 75% of Britons supported age verification requirements for websites containing pornographic, mature, or potentially harmful material.

Willingness to actually hand over documents is a different number. An Ipsos survey found only 19% of Britons would likely submit proof of age to a dating app, and 14% for a pornography website. Ofcom found that 96% of active adult-content users cited personal data concerns, either declining an age check or using a way to bypass one.

Seventy-five percent support the rule. Fourteen percent will comply with it at a porn site. That gap is the entire commercial and policy problem, and it's the thing a provider is really being chosen to close.

Suggested read: Digital IDs Are Here: How Reusable Identity Is Transforming Everyday Life

eIDs and reusable digital identities

An electronic ID, or eID, allows a user to rely on an identity that has already been established through a government or another trusted issuer. Depending on the scheme, the receiving service may verify the user’s date of birth or receive only an age-related answer, such as confirmation that the user is over 18. This can reduce the need for repeated document uploads while providing stronger evidence than self-declaration.

Verifiable credentials and zero-knowledge proof

Verifiable credentials provide a structured way to issue and present these claims. An issuer verifies the information and creates the credential, the holder stores it in an app or digital wallet, and a verifier checks the proof when the holder presents it. With selective disclosure, the holder can reveal only the information required for the transaction rather than the entire credential.

A zero-knowledge proof can go further by demonstrating that hidden information satisfies a condition without revealing the information itself. For example, it could prove that a verified date of birth makes someone over 18 without disclosing the date.

Device-based checks as a privacy path

Device-based age verification lets an operating system, app store, or digital wallet hand an app an age range or threshold, with no birth date, face scan, or ID attached. One age check or account setting can then serve several services, and no individual developer has to collect and defend identity data.

Apple’s Declared Age Range API, for instance, shares an age category rather than a child’s birth date, with parental sharing controls in many regions. Google’s Play Age Signals API provides apps with age range signals, and its terms prohibit advertising, marketing, profiling, or analytics use.

A facial-estimation model can also run locally and send only an age band. In 2026, Discord said its redesigned option would run entirely on-device.

Why blanket bans miss the real risk

Some services should clearly exclude children. However, the problem is making exclusion the default in the debate over age verification on social media and other mixed-use services that also support education, creativity, friendship, mental wellbeing, and community.

A blanket ban addresses only who may create an account, rather than the features that cause harm. It does not stop adults entering child-oriented spaces, predatory contact, addictive recommendations, or unsafe purchases. It also encourages the use of borrowed accounts, the use of disguised locations, or migration to less moderated services. When stronger age checks became enforceable in the UK in July 2025, checks rose sharply while VPN apps climbed download charts.

Some platforms use age inference based on behavioral signals captured through account analytics. Cookies may help associate activity with a returning browser, allowing the service to identify patterns that suggest a user may be a child. These signals can trigger safer defaults or a stronger age check, but they involve profiling and must have an appropriate lawful basis. They should not replace a highly effective check where a service must prevent underage access altogether. 

For child safety online, instead of blanket bans, an age-aware approach can limit predatory adult messaging, location sharing, purchases, addictive or adult content, ceaseless bullying, and late-night notifications while preserving lower-risk functions that allow younger users to experience all the social and educational benefits of online life. Services can apply private defaults and safer recommendations to teenagers, requesting stronger age checks only for restricted spaces.

Building an age-aware layered approach

No age verification technology on its own is proportionate for every interaction. A layered model, however, escalates as potential harm, legal duty, or evidence of circumvention increases. It can reserve biometric age verification, such as document-to-selfie matching, for cases requiring greater certainty.

The layers need to work together for the best results. In practice, the escalation logic can be built into the verification flow itself. A workflow might begin with a low-friction signal, such as self-declared age, and then automatically escalate to facial age estimation, document verification, or another higher-assurance method when the result is borderline or a risk trigger is detected. 

Sumsub’s Workflow Builder allows businesses to configure this type of adaptive, risk-based routing so that low-risk users receive a simpler process while higher-risk users undergo additional checks. 

Liveness checks can make it harder to pass an age check using an adult’s photograph or prerecorded video, although the extra step may frustrate legitimate users or prevent some from completing the process. 

Reusable credentials allow users to prove their age without repeatedly disclosing the underlying personal information. 

Linking a credential to the person or device it was issued to can prevent it from being shared, but may require additional verification each time it is used. Ongoing analysis of account activity may help detect circumvention or fraud, but continuous monitoring can amount to profiling and require a lawful basis. 

The goal is not maximum assurance in every context, but enough assurance to address the specific risk. A platform may use a lower-confidence age signal to adjust recommendations for someone likely to be a teenager, whereas opening a gambling account requires much stronger evidence of age and identity. At the same time, a self-declared checkbox provides too little assurance to prevent children from accessing pornography.

Suggested read: Liveness Detection: A Complete Guide for Fraud Prevention and Compliance

What platforms should do next?

As more jurisdictions impose age verification requirements on social media and other online services, age assurance has to work as a system rather than a single gate:

1. Map the decisions. Identify the age threshold, the restricted feature, the jurisdictions, and what a false result costs in each direction.
2. Choose the minimum sufficient proof. Ask for an age band or threshold rather than an exact birth date unless the law requires more.
3. Assess privacy and child rights. Document necessity, proportionality, lawful basis, data flows, retention, automated decisions, and the risks the check itself creates.
4. Offer meaningful alternatives. Provide a comparably effective credential, mobile, banking, document, or assisted route, and account for accessibility and document coverage.
5. Test the whole process. Measure across demographic groups, cameras, and conditions, and against presentation attacks. Test liveness and the fallback paths, not just the happy path.
6. Provide redress. Explain decisions clearly, allow correction or a second method, and give human review for material automated decisions.
7. Apply protections after the check clears. Restrict risky contact, content, purchases, and design patterns. Parental controls complement platform safeguards and never replace them.
8. Monitor change and abuse. Reassess account transfers, restricted actions, conflicting evidence, legal changes, and newly discovered bypasses.

Trust comes from being specific in public: what's checked, who receives the data, what's retained, and how long the evidence exists – which leaves the tension nobody has resolved. Device-based checks are the most privacy-preserving option available, and they work by routing age signals through Apple and Google. That reduces how many companies hold identity data and increases how much two of them decide. How the industry balances privacy, effectiveness, and concentration of control will be one of the key questions as age assurance develops.

FAQ

• What is age verification?

  Checking a person's age, date of birth, age range, or eligibility for an age threshold against reliable evidence. It might use an identity document, a database, a verified financial or mobile relationship, or a digital credential. It can sit inside KYC, or it can run standalone as an attribute check that never reveals identity.

• How does age verification work?

  The user or their device provides evidence to a platform or a specialist provider. The system validates the evidence, checks that it belongs to the person presenting it where applicable, and returns an age result. Privacy-preserving systems return only the required answer, such as "over 18," and either delete the underlying document or image or never share the exact birth date.

• What is age assurance?

  The general category covering methods used to determine or infer age. It includes age verification, facial and other age estimation, account-based inference, self-declaration, and combinations of these.

• Is age verification safe?

  It can be, when it's proportionate to the risk, secure, tested against real-world conditions, transparent about what it collects, and designed to minimize data. The more of these safeguards an age-verification system lacks, the greater the potential risks to users.

• Can age verification be bypassed?

  Yes. However, a well-designed age verification system should withstand reasonable attempts at circumvention. Strong systems combine reliable evidence with measures such as liveness detection, challenge ages, biometric face matching, device or credential binding, and appropriate fallback checks. Suspicious, spoofed, or inconclusive attempts can then trigger rejection or a stronger verification method. No age-assurance method is completely foolproof, so providers should assess and monitor its effectiveness and resistance to circumvention.