Age Verification and Anonymity: What Changes for You

Additional resource for the lesson “Age Verification and Anonymity: What Is Changing” — Online Anonymity course

Age verification and anonymity can pull in opposite directions. A check that asks who you are, just to confirm that you are old enough, can tie your identity to a site you visit. New rules in the UK and the EU are making age checks more common, and some new methods try to keep those two things apart. This resource explains, as of November 2026, what changes for you, which designs keep them apart, and what is still uncertain.

A. Why this matters

In this course, privacy means deciding what others know about you; anonymity means being able to act without what you do being linked back to who you are. Age checks touch both; this resource looks at the second.

A check based on an identity document can change what a site knows. If the site, or the company running the check for it, records your name next to the page you were opening, a new link exists between your identity and your browsing.

That link is not a reason for alarm. It is a design choice: some checks never create it, others create it and keep it. Knowing the difference lets you choose where you can, and ask sensible questions where you cannot.

What the sources say

In the UK, Ofcom, the regulator for online safety, states that “As of 25 July 2025, all sites and apps that allow pornography will need to have strong age checks in place”. Ofcom adds that data protection is regulated and enforced by the Information Commissioner’s Office (ICO).

The European Data Protection Board (EDPB), which brings together the EU’s data protection authorities, adopted a statement on age assurance in February 2025. It says age checks “should not provide additional means for service providers to identify, locate, profile or track natural persons”, and that a service “may only need to know whether the user is over or under an age threshold.”

France’s data protection authority, the CNIL, put the risk plainly in 2022: when a site verifies age through identity, “knowledge of an individual’s identity can then be linked to their online activity.” It also found that “there is currently no solution that satisfactorily meets” its three requirements of reliability, coverage of the whole population, and privacy.

The European Commission describes its age verification app as giving the platform “an answer to the question of whether the user is over a certain age”, and expects the solution to “be available across the EU by the end of 2026.” In the United States, the Electronic Frontier Foundation (EFF), a digital rights organisation, warns that once age-check data is centralised, “it becomes an immediate target for leaks, hacks, and misuse.”

B. Key concepts: age verification and anonymity

Six ideas, from the problem to the designs that try to solve it.

Age checks and identity: where the link forms

An age check usually involves three parties: you, the site you want to use, and often a separate company that runs the check. Ofcom notes that a site “might do this check themselves or use another company to do the check.” The question for anonymity is simple: at the end, who knows your identity, and who knows which site you visited?

Why it matters to you: If one party knows both, the link between who you are and what you do exists somewhere, even if you never see it.

Proving age without proving identity

The EDPB’s point is that a service may only need a yes-or-no answer to an age threshold, such as “over 18”. There are several ways of getting that answer without a full identity; the Online Privacy resource below compares them, while this one looks at what each leaves linked.

Why it matters to you: A check that returns only “yes, over 18” gives the site nothing to attach your name to. That is the first thing to look for.

Double-blind age verification

A design sometimes described as double-blind keeps two kinds of knowledge in different hands. The company that checks your age knows who you are, but not which site you are going to. The site knows you passed the check, but not who you are. The CNIL describes a third party that knows “the identity of the Internet user” while the site “does not know their identity”, and adds mechanisms to stop the third party from learning which site you visit.

Why it matters to you: Neither side holds the full link on its own. The CNIL adds that this assumes the third parties are “completely independent of the publishers”.

Zero-knowledge age proofs

A zero-knowledge proof is a cryptographic technique that lets you prove a statement is true, such as “this person is over 18”, without revealing anything else, not even your date of birth. The EDPB mentions “cryptographic protocols such as zero-knowledge proofs” as a way to reduce what is shared, and the CNIL’s own 2022 demonstration used them.

Why it matters to you: A well-designed proof can also be made so that two uses cannot be connected. The Commission says that, with its app, “the different transactions by the same user are not linked”: showing your age to two sites should not let anyone tell it was you both times.

Europe’s approach: the age verification blueprint and the EUDI Wallet

The European Commission has published a blueprint, a set of technical specifications and open-source code that Member States can adapt into their own apps. Its steps are set out on the Commission’s page: you get a proof of age once, from a national eID, a passport or ID card, or another trusted source; then “the link between user and proof provider is cut”; and you later present an “anonymous proof of age” to a site. The Commission says the proof “doesn’t include any ID info to trace the user”, and that zero-knowledge proof technology is included.

In its FAQ of May 2026, the Commission names seven frontrunner countries working with it on national apps: Cyprus, Denmark, France, Greece, Ireland, Italy and Spain. It is designed to be compatible with the European Digital Identity Wallets (EUDI Wallets), apps on your phone for proving facts about yourself. The Commission says that “Member States will make wallets available to every citizen, resident and business by the end of 2026”, and that users “share only what is necessary”.

Why it matters to you: As of November 2026, the design the Commission describes is meant to keep age apart from identity. How well it does so in practice will depend on each national app.

A VPN changes the country, not the check

A VPN (virtual private network) sends your connection through a server elsewhere, so sites see a different IP address and often a different country. The CNIL notes that age checks can be sidestepped this way. That describes a limit of the rules, not advice: rules on using such tools vary by country, and a VPN does nothing to the identity link if you do go through a check.

Why it matters to you: “Age verification VPN” mixes two questions. Whether a check applies to you is one; what a check you complete reveals about you is another, and only the design of the check answers it.

C. A practical example: Elena’s two age checks

Elena is 35 and works in marketing, so she reads privacy notices with a professional eye. One week she meets two age checks: a film streaming service asks her to confirm she is over 18 before opening its section of adult-rated films, and an online wine shop asks the same before she can order.

The streaming service offers two routes: upload a photo of her identity card, which the service will check itself, or use an age verification app on her phone that sends back a yes-or-no answer. The wine shop only offers its own check, run by a company named in its privacy notice.

Elena notices that “what am I giving them?” is only half the picture. The other half is “who will know that it was me, here?” With the card upload, the streaming service would hold her name and her viewing in one place. With the app, it would learn only that someone over 18 had been let in.

What changed when Elena looked at the links

She did the exercise in section D that weekend, without urgency:

• For the streaming service, she chose the app. According to the app’s description, the site would receive a yes-or-no answer and the app would not learn which service she had used.
• For the wine shop, she read the notice: the checking company kept a record for a set period. She accepted that for an occasional order, and emailed the shop to ask whether the record included the site name.
• She noted that being signed in to her streaming account still linked her viewing to her. The check had not made her anonymous; it had simply not added a new link.

She did not try to avoid every check. Where a choice existed, she made sure the age question did not become an identity question too.

D. Try it yourself: trace the links in one age check (15 minutes)

Four short steps, on paper or in a note. You do not need to write down any real personal data.

Step 1 — Pick one check (3 minutes)

• Choose an age check you have met, or expect to meet on a service you use.
• If you have not met any, use the steps on the European Commission’s blueprint page in section E.
• Write down only the service and what it asked you to prove.

Step 2 — Draw three boxes (4 minutes)

• Label them “Me”, “The checker” (the company running the check, if any) and “The site”.
• In each box, write what that party learns: your identity, date of birth, a yes-or-no answer, or which site you visited.
• Draw a line between “my identity” and “the site I visited” wherever one party knows both.

Step 3 — Look for three answers (5 minutes)

• Who runs the check: the site itself, or another company?
• Does the site receive more than a yes-or-no answer about your age?
• Does the checker learn which site you visited, and does it keep a record? If the notice does not say, write “unknown”: that is an answer too.

Step 4 — Decide one rule for yourself (3 minutes)

Pick one option and write it as a sentence:

• Prefer the separated route: when offered a choice, choose the method where the site learns only your age and the checker does not learn the site.
• Ask first: when a notice does not say who learns what, send one question to the service before using it.
• Accept the link: decide that, for this service, the link is acceptable to you, and say why.

A rule you understand is worth more than a list of methods.

Already covered in the Online Privacy course

Online Age Verification: Prove Your Age, Share Less
It explains the main age check methods, what each asks of you, and how to pick the one that shares the least; this resource looks at which designs stop your identity being linked to the sites you visit.

E. Videos, articles and further resources

European sources first, then the UK and the United States. All in English.

European Union

European Commission — EU Age Verification Solution (FAQ)
What the platform learns, why separate uses are not linked, the frontrunner countries and the expected EU-wide timeline (updated May 2026).
https://digital-strategy.ec.europa.eu/en/faqs/eu-age-verification-solution

European Commission — Blueprint for an age verification solution to help protect minors online
The steps of the EU design and its status as of April 2026.
https://digital-strategy.ec.europa.eu/en/factpages/blueprint-age-verification-solution-help-protect-minors-online

European Commission — EU Age Verification Blueprint (technical portal)
The specifications and open-source code behind the EU design, for readers who want the technical detail.
https://ageverification.dev

European Commission — European Digital Identity
What the EU Digital Identity Wallets are, the end-of-2026 timeline, and how users choose what to share.
https://commission.europa.eu/topics/digital-economy-and-society/european-digital-identity_en

European Data Protection Board — Statement 1/2025 on Age Assurance
The data protection principles EU authorities expect age checks to follow, including no added tracking or profiling.
https://www.edpb.europa.eu/system/files/2025-04/edpb_statement_20250211ageassurance_v1-2_en.pdf

CNIL (France) — Online age verification: balancing privacy and the protection of minors
A 2022 analysis of the risks, of a third-party design that separates identity from the site, and of a demonstration using zero-knowledge proofs.
https://cnil.fr/en/online-age-verification-balancing-privacy-and-protection-minors

United Kingdom and United States

Ofcom — Age checks for online safety – what you need to know as a user
Which services must use age checks in the UK, how they may be run, and advice on sharing personal information.
https://www.ofcom.org.uk/agechecks

Electronic Frontier Foundation — Age Verification is a Privacy Nightmare
A digital rights view, from May 2026, of the risks of collecting and centralising age-check data.
https://www.eff.org/deeplinks/2026/05/age-verification-privacy-nightmare

Links checked in November 2026. If an address changes, searching for the title on the organisation’s site usually finds it.

F. The Cyber Welfare Framework: Skills, Awareness, Secure Behaviour

This resource sits on the Awareness pillar at level FL2 – Beginner: understanding who learns what in an age check before deciding how to respond.

Skills

• Identifying the parties in an age check: you, the site and, often, a separate checker.
• Finding in a privacy notice who runs a check and what it keeps.
• Telling a yes-or-no age proof apart from a full identity check.

Awareness

• Understanding that the risk for anonymity is one party knowing both who you are and where you went.
• Knowing that double-blind and zero-knowledge designs aim to stop that link forming, if built and run as described.
• Recognising that an age proof does not remove other links, such as being signed in.

Secure Behaviour

• Choosing the method where the site learns only your age, when a choice exists.
• Asking a service who learns what, when its notice does not say.
• Checking the current status of rules and apps where you live.

G. Questions to sit with

• Which services would you prefer never to have your name attached to?
• If an age check offered speed or separation, which would you choose, and would your answer change from one service to another?
• How would you explain to a friend the difference between proving your age and proving who you are?

H. What to do now

The recommendations (R) and security measures (MS) from the Cyber Welfare database that apply most directly here.

1. Before an age check

• No R or MS code fits age checks closely, so the advice here is in plain terms.
• When a check offers a choice, prefer the method where no single party learns both who you are and which site asked.
• If you live in the EU, keep an eye on whether your country’s age verification app or EUDI Wallet is available: as of November 2026, the Commission expects EU-wide availability by the end of the year.

Minimum commitment: the next time you meet an age check, ask yourself one question before you choose: will anyone know both who I am and that I was here?

2. After an age check

• Read the privacy notice to see whether the checker keeps a record, and for how long.
• Remember that an age proof does not change other links, such as an account you are signed in to.
• If a check seems to have gone wrong, the Online Privacy resource in the box above lists where to turn.

Minimum commitment: this month, trace the links in one age check you have already completed, using the three boxes from section D.

In short

• Age verification and anonymity meet at one point: whether someone ends up knowing both who you are and which site you visited.
• Double-blind and zero-knowledge designs aim to keep those two facts apart; Europe’s blueprint is built on them.
• As of November 2026, the EU app and wallets are still rolling out, and how well they separate the two will depend on each national version.
• An age proof does not make you anonymous: it simply avoids adding a new link.

Related resources in this course

• Mass Surveillance Explained: Who Collects Data and How
• Protest Surveillance: What It Means for Your Rights
• Internet Censorship Around the World: How Blocking Works

Discover more companion resources from the online courses of the Protect Your Digital Privacy programme.