What Is Age Assurance? Methods, Trade-offs and What Regulators Now Expect

Almost every child online safety law now in force depends on one capability: knowing, with some degree of confidence, whether a user is a child. The UK Online Safety Act, the EU Digital Services Act, Australia's social media minimum age and Singapore's app store code all assume that services can tell children from adults. How they do it has become one of the most consequential and most contested design decisions a digital service makes.

That capability is called age assurance. It is often confused with age verification, and the confusion matters: regulators treat the methods differently, and each carries its own costs.

What is age assurance?

Age assurance is the umbrella term for any process that establishes a person's age or age range online, to a stated level of confidence. It covers age verification against a trusted record, age estimation from physical characteristics, and age inference from other data. Self-declaration is sometimes included, but most regulators no longer accept it alone.

Verification, estimation, inference and self-declaration

• Age verification confirms age against an authoritative source: a passport, driving licence, bank record or government digital identity. It gives the highest certainty and asks for the most personal data.
• Age estimation produces a likely age or age range from a characteristic of the person, most commonly a facial image analysed by a machine learning model. It does not identify the user, but its result is a probability with a margin of error, not a fact.
• Age inference draws a conclusion from other information the user or a third party already holds: that a person has a credit card, a mobile contract without adult content restrictions, or an email address with a long history of use at banks and utilities.
• Self-declaration asks the user to state their age or tick a box. It is cheap and private, and it stops almost nobody. Ofcom treats self-declaration used in isolation as incapable of being highly effective, and the European Commission's Article 28 guidelines do not consider it appropriate either.

The main methods and what each trades away

Every method has a cost. The honest comparison looks at accuracy, privacy, exclusion, bias and circumvention.

• Photo ID document checks. Robust when combined with a liveness check that the person presenting is the person on the document. They exclude people without documents, who are disproportionately young, poor, undocumented or displaced, and they create stores of identity documents that must be defended.
• Facial age estimation. Fast, requires no documents and need not identify anyone. It is least accurate close to the thresholds that matter most, such as 13, 16 and 18, which is why providers typically set a buffer or "challenge age" above the legal line and send borderline users to a second method. Error rates can vary across skin tones, sexes and ages, so demographic performance data is essential.
• Credit card and open banking checks. Useful as an adult signal where credit cards or bank accounts are only issued to adults. They say nothing about children's ages beyond "not an adult", exclude adults without banking access and raise understandable unease about linking financial data to online activity. Ofcom does not accept payment methods, such as debit cards, that do not require the holder to be 18.
• Mobile network operator checks. Confirm whether a phone account has had adult content restrictions removed. Low friction, but a family phone contract is often in a parent's name.
• Digital identity wallets and reusable age tokens. A trusted provider verifies age once and the user shares only a yes or no answer to "over 18?" with each service. Done well, this is the most privacy-preserving model available. Its reach depends on how many people hold a wallet.
• Email-based age estimation. Infers adulthood from where an email address has been used over time. Invisible to the user and low friction, which is also its weakness: it is hard for a wrongly assessed person to understand or contest.

Well-designed systems layer methods: a low-friction check first, with a stronger fallback for anyone who fails or objects, and a human route for those no automated method serves.

The standards

Two international standards now give buyers a common vocabulary. IEEE 2089.1-2024, the IEEE Standard for Online Age Verification, was published in 2024 and sets out a framework for designing, evaluating and deploying age assurance, including levels of confidence and requirements for privacy and data security. ISO/IEC 27566-1:2025, Age assurance systems, Part 1: Framework, was published in December 2025. It defines age assurance as spanning verification, estimation and inference, and describes core characteristics including functionality, performance, privacy, security and acceptability. Further parts on methods and on measurement are in development.

Certification against either standard is a useful signal, not a substitute for your own assessment.

What regulators now expect

United Kingdom. Under the Online Safety Act, services that allow pornography or other content harmful to children must use highly effective age assurance. Ofcom's guidance, first published in January 2025, sets four criteria: the method must be technically accurate, robust against circumvention, reliable and fair. Ofcom lists photo-ID matching, facial age estimation, open banking, mobile network operator checks, credit card checks, digital identity services and email-based age estimation as capable of meeting the bar. Self-declaration, debit card checks and contractual age limits in terms of service are not. The Protection of Children Codes have been in force since 25 July 2025. The wider duties are compared in the UK Online Safety Act versus the EU Digital Services Act.

European Union. The Commission's guidelines on Article 28 of the Digital Services Act, published on 14 July 2025, ask for age assurance that is accurate, reliable, robust, non-intrusive and non-discriminatory, and proportionate to risk. They point to age verification for adult content such as pornography and gambling, or where national law sets a minimum age, and to age estimation for some lower-risk cases. The Commission released a blueprint for an EU age verification app on the same day, declared it feature-ready on 15 April 2026 and, on 29 April 2026, adopted a Recommendation encouraging Member States to make privacy-preserving age verification available to citizens by 31 December 2026. The app lets a user prove they are over a threshold without revealing their identity or exact age, and is built to the same specifications as the European Digital Identity Wallet.

Australia. Since 10 December 2025, age-restricted social media platforms must take reasonable steps to prevent under-16s from creating or keeping accounts. eSafety expects a layered approach and does not accept self-declaration as the sole or primary check. The law also says platforms cannot make government ID or an accredited digital ID the only option, and limits the use of information collected for age assurance. Related obligations are covered in Australia's children's online privacy code and duty of care.

Singapore. Under IMDA's Code of Practice for Online Safety for App Distribution Services, designated app stores, including those run by Apple, Google, Huawei, Samsung and Microsoft, have had to implement age assurance since 1 April 2026. The code allows both estimation and verification methods.

A child-rights view of age assurance

Age assurance is a safeguarding measure, and like any safeguarding measure it can cause harm of its own. The UN Convention on the Rights of the Child and General Comment 25 give children rights to protection, but also to privacy, information, participation and non-discrimination. Three principles follow.

1. Proportionality. The strength of the check should match the risk being gated. Demanding identity documents to join a homework forum is not proportionate; letting anyone into a pornography site on a tick box is not protective.
2. Data minimisation. The service should learn only what it needs, usually a yes or no against a threshold, and the data used to reach that answer should be deleted as soon as the check is done. Age assurance that builds a new database of children's faces or documents has created a new risk.
3. No locking children out of what is good for them. Age gates should restrict harmful content and features, not children's access to helplines, health information, education or peer support. A child wrongly judged to be older, or wrongly locked out, needs a clear and accessible route to challenge the decision.

Fairness belongs here too. A method that fails more often for children with darker skin, disabilities or no documents does not distribute protection evenly. A child rights impact assessment is the natural place to test a proposed approach against these principles before it launches.

What organisations should ask age assurance vendors

The procurement questions are similar whether you run a platform or commission an app for young people. An age assurance strategy should rest on clear answers to these:

• Accuracy. What are the error rates at our specific age thresholds, not on average, and how were they measured? Has an independent body tested them?
• Fairness. How does performance vary by age, sex, skin tone and disability? Will you share the data?
• Privacy. What data is collected, where is it processed, how long is it kept and who can access it? Is the image or document deleted immediately after the check?
• Circumvention. What liveness detection and anti-spoofing measures are in place? How do you respond to new bypass techniques?
• Alternatives and appeals. What happens to a user who cannot or will not use the primary method? How can a wrongly assessed child or adult challenge the result?
• Standards and certification. Is the system certified against IEEE 2089.1 or ISO/IEC 27566-1, and by whom?

Where facial estimation or other machine learning is involved, the vendor's model deserves the same scrutiny as any AI system affecting children. And the answers should be written into your safeguarding and data protection policies, so that the decision, its reasons and its review date are on record.

Frequently asked questions

Is age assurance the same as age verification? No. Age verification is one form of age assurance, confirming age against an authoritative record. Age assurance also includes age estimation and age inference, which give a likely age rather than a confirmed one.

Does age assurance mean users have to upload ID? Not necessarily. Facial age estimation, mobile operator checks, email-based estimation and reusable digital age tokens can all work without a document being shared with the service. Australia's minimum age law specifically requires an alternative to government ID.

Is facial age estimation accurate enough to protect children? It can be accurate enough for some purposes, but it is least precise near the age thresholds that matter. Services typically use a buffer above the legal age and a second method for borderline cases.

Does a tick box asking users to confirm they are over 18 count? Not for higher-risk services. Ofcom does not accept self-declaration alone as highly effective, the European Commission does not consider it appropriate under Article 28, and eSafety will not accept it as the sole or primary check.

Does age assurance apply to organisations that are not platforms? Directly, usually not. But schools, NGOs and companies that run apps, forums or chat services for young people may find that their own services are in scope, and those that reach children through platforms are affected by the checks those platforms introduce.

Regulatory details cited here are accurate as of September 2026 and should be checked against Ofcom, the European Commission, eSafety and IMDA before being relied on in a compliance decision.