Online Age Verification: Prove Your Age, Share Less

Additional resource for the lesson “Online Age Verification” — Online Privacy course

Some sites and apps now ask you to prove you are an adult before they show certain content. Online age verification is meant to protect children, but every check also asks something of you. This resource explains the main methods and how to choose the one that tells a site the least about you.

A. Why this matters

Age checks are now required for some services in the UK, and the European Union is preparing its own approach. When you meet one, the useful question is not only whether to pass it, but what you hand over.

This resource looks at age checks from your side, as an adult: what is known about you, by whom, and what you choose to let them know.

What the sources say

In the UK, Ofcom, the regulator for online safety, explains that all sites and apps that allow pornography must have strong age checks in place from 25 July 2025, and that it expects “the riskiest services” to use them too. Ofcom says strong checks can protect your privacy, but still advises users to “exercise a degree of caution and judgement” when giving personal information.

The Information Commissioner’s Office (ICO), which regulates data protection in the UK, expects organisations running age checks to collect “the minimum information required for the process” and not to keep it “for longer than is needed”.

The European Commission describes an EU solution that “allows users to prove they are over 18 without sharing any other personal information”, with roll-out in Member States planned by the end of 2026. In the United States, the Electronic Frontier Foundation (EFF), a digital rights organisation, warns that data collected for age checks “can easily be leaked, hacked, or misused.”

B. Key concepts

Four ideas for reading any age check calmly.

Verification, estimation, self-declaration

The ICO uses “age assurance” as the umbrella term. Age verification confirms your exact age or that you are over 18. Age estimation works out a likely age range, often by algorithm. Self-declaration simply asks you to state your age.

Why it matters to you: Knowing which kind you face tells you what the check really needs from you.

Methods you may be offered

Ofcom lists the methods a site might use: facial age estimation (a photo or video of your face is analysed), open banking (your bank confirms whether you are over 18), digital identity services, credit card checks, email-based age estimation, mobile network operator checks, and photo-ID matching (a document is compared with a photo of you). The site may run the check itself or use another company.

Why it matters to you: These methods ask for very different things. Some involve your face or an identity document; others only a confirmation from a body that already knows you.

Data minimisation

The principle that a check uses only the data it needs, and keeps it no longer than needed.

Why it matters to you: It gives you a simple test: does this ask for more than “over 18, yes or no”? If so, look for another option.

A yes-or-no proof

A design in which the site receives only the answer to the age question. The European Commission’s FAQ says that, with its app, the platform “doesn’t know the user’s identity”.

Why it matters to you: It shows that proving your age and revealing who you are can be separated.

C. A practical example: Marco meets an age check

Marco is 22 and a university student. One evening, a site he uses tells him that some sections now need an age check. Ofcom says sites should show a statement on the kinds of checks you can use and how they work, so Marco reads it first.

He is offered three routes: a passport and a selfie, an age estimate from a short video, or a check through his mobile network operator. His first instinct is the passport.

What changed the outcome

• He asked one question first: which route proves only that he is over 18?
• He noticed that the passport carries his name, date of birth and face, while the operator check only looks at whether his number has age restrictions.
• He checked who would run the check and read the privacy notice on what is kept, and for how long.
• He chose the operator check. It took a minute, and it shared far less about him than a passport and a selfie.

Where to find competent help

This resource does not give legal advice. These organisations can help, each within its own role.

United Kingdom

• Ofcom regulates online safety. Its page for users explains which services must use age checks and the methods allowed, and its complaints pages say it may be able to help you report issues with an online service.
• Information Commissioner’s Office (ICO) regulates data protection, and Ofcom may refer providers to it.

If you think an organisation mishandled your data during a check, the ICO’s complaint form asks for a copy of your complaint to that organisation first. The ICO can tell an organisation to do more, but cannot award compensation.

European Union

• European Commission: explains how the EU age verification app is meant to work.
• Your national data protection authority: the Commission explains that you can complain to it if you think your data protection rights have been breached, and that it reports back within three months.

United States

• Federal Trade Commission (FTC): held a workshop in January 2026 on age verification and estimation tools.
• Electronic Frontier Foundation (EFF): explains the privacy and security risks of age verification, including breaches at age verification providers.

A first conversation (5 minutes)

Take five minutes, alone or with someone you live with:

• Which sites or apps you use have asked, or might ask, you to prove your age?
• If you were offered three methods tomorrow, which would share the least?
• Where would you stop: a check that asks for more than your age, or one with no privacy notice you can find?

E. Videos, articles and further resources

UK first, then the European Union and the United States. All in English.

United Kingdom

Ofcom — Age checks for online safety – what you need to know as a user
Which services must use age checks, and how each method works.
https://www.ofcom.org.uk/online-safety/protecting-children/age-checks-for-online-safety–what-you-need-to-know-as-a-user

Information Commissioner’s Office (UK) — Age assurance for the Children’s code: 1. Age assurance
Definitions and the ICO’s data protection expectations.
https://ico.org.uk/about-the-ico/what-we-do/information-commissions-opinions/age-assurance-for-the-children-s-code/1-age-assurance/

Information Commissioner’s Office (UK) — Make a complaint about how an organisation has used your personal information
What you need before you complain.
https://ico.org.uk/make-a-complaint/data-protection-complaints/

European Union

European Commission — The EU approach to age verification
The EU solution and its timeline.
https://digital-strategy.ec.europa.eu/en/policies/eu-age-verification

European Commission — EU Age Verification Solution FAQ
What the platform does and does not learn.
https://digital-strategy.ec.europa.eu/en/faqs/eu-age-verification-solution

European Commission — Information for individuals
Your GDPR rights and how to complain.
https://commission.europa.eu/law/law-topic/data-protection/information-individuals_en

United States

Federal Trade Commission — Age Verification Workshop
The FTC’s January 2026 workshop.
https://www.ftc.gov/news-events/events/2026/01/age-verification-workshop

Electronic Frontier Foundation — Age Verification
A digital rights view of the risks.
https://www.eff.org/issues/age-verification

Links checked in October 2026. If an address changes, searching for the title on the organisation’s site usually finds it.

F. The Cyber Welfare Framework: Skills, Awareness, Secure Behaviour

This resource sits on the Awareness pillar at level FL2 – Beginner: knowing what a check asks before you answer.

Skills

• Telling verification, estimation and self-declaration apart.
• Reading a site’s statement on how its checks work.
• Finding who runs a check and what it keeps.

Awareness

• Knowing that a check usually needs one fact, not your identity.
• Recognising that methods differ in what they share.
• Knowing where to turn when a check goes wrong.

Secure Behaviour

• Choosing the method that shares the least, when you can.
• Pausing before uploading an ID document to an unfamiliar site.
• Raising a concern with the organisation first, then the regulator.

G. Questions to sit with

• When you last proved your age online, what did you hand over, and to whom?
• Would you know where to look for how long a check keeps your data?
• In a check, which matters more to you: speed, or how little it shares?

H. What to do now

No recommendation or security measure in the Cyber Welfare database fits this topic closely, so the advice stays here: when a check offers a choice, prefer the option that returns only “over 18, yes or no”.

Minimum commitment: the next time a site asks you to prove your age, read its statement on how the checks work before you choose.

In short

• Online age verification asks you to prove one fact: that you are old enough.
• Methods range from a simple confirmation to a passport and a selfie.
• The ICO expects checks to collect the minimum and keep it no longer than needed.
• Ofcom, the ICO, your national data protection authority and the EFF can help you understand or challenge a check.

Related resources in this course

• Parental Controls: Guiding Your Child Without Surveillance
• Sharenting: What Your Child’s Photos Can Reveal Online
• Helping Elderly Parents Online Without Taking Over

Discover more companion resources from the online courses of the Protect Your Digital Privacy programme.