Age assurance

The checks used to decide whether someone is old enough for a product, from a birthday question to ID or facial age estimation.

how do we keep kids out of the appprove a user is old enoughthe are you over 18 checkonline age checkage gate with IDage verificationage estimationage asurance

What it is

Age assurance is the umbrella for deciding whether someone belongs above or below an age threshold. It ranges from self-declaration, to age estimation from a face or behavior, to verification with an identity document, payment card, mobile account, or trusted third party. The right strength depends on what a wrong answer would expose the person to.

Reach for it before showing age-restricted content, enabling risky social features, or collecting data in a service likely to attract children. Start with the least intrusive method that gives enough confidence, keep the result as a coarse fact such as 'over 18,' and provide a review path for people the system gets wrong. Ofcom's guidance under the UK Online Safety Act calls the strong end of this range 'highly effective age assurance,' and a self-declared birthday does not reach it.

Gotcha: proving age can create a more sensitive privacy problem than the one it solves. Copies of passports, selfies, biometric templates, and exact birth dates are valuable breach material. Do not keep the raw evidence when a signed yes-or-no age result will do, and do not pretend a checkbox is strong assurance simply because it blocks the next screen.

Ask AI for it

Design a risk-based age-assurance flow for the product below using Yoti Age Verification and Yoti Facial Age Estimation. Define each age threshold and the harm caused by a false pass, then assign self-declaration, facial age estimation, or document verification in increasing order of confidence. Request only a signed over-or-under result from Yoti, never store the selfie or identity document, set a short retention period for transaction metadata, encrypt the result, and prevent analytics from receiving birth dates. Include accessible failure states, a manual appeal path, parent routing for children, country-specific configuration, abuse tests, and a deletion job for expired evidence.

You might have meant

personal data piiprivacy by designdata minimizationprivacy policyterms of service