Age Assurance: What Platforms Need to Know

Age assurance has moved from an optional feature to a regulatory expectation. Trust and safety teams are being asked to know, with some confidence, whether a user is a child. This is a hard problem with real tradeoffs between accuracy, fairness, privacy, and user friction. This piece lays out the landscape so policy and product teams can make grounded decisions.

The spectrum of methods

Age assurance is an umbrella term. The methods sit on a spectrum from weak to strong.

Self-declaration is the user typing a birth date or checking a box. It is frictionless and privacy-light, but trivially bypassed. Regulators no longer accept it as a primary control for higher-risk services.

Age estimation infers an age range from signals such as a face image, behavioral patterns, or account history. Facial age estimation returns a predicted age band without necessarily identifying the person. It is lower friction than full verification and can be tuned with a buffer, so a platform gating at 18 might require an estimate of 25 or older to pass without further checks.

Age verification establishes age from an authoritative source: a government ID check, a bank or mobile-network signal, or a reusable digital identity. It is the strongest form and also the most privacy-sensitive, because it usually involves identity documents.

The UK regulator Ofcom treats photo-ID matching, facial age estimation, mobile-network operator checks, credit-card checks, email-based estimation, and digital identity services as methods capable of being highly effective. It explicitly rules out self-declaration, general disclaimers, and contractual terms as sufficient on their own.

Why regulators are pushing

Three jurisdictions are setting the pace. In the UK, the Online Safety Act requires services that host pornography or other content harmful to children to use what Ofcom calls "highly effective age assurance." Ofcom's guidance defines this against four criteria: a method should be technically accurate, robust, reliable, and fair. Robust means it is stress-tested against people trying to circumvent it. Fair means it works across different demographic groups and does not entrench bias.

Australia has gone further with a minimum-age rule. From 10 December 2025, many social media platforms must take reasonable steps to prevent Australians under 16 from holding accounts. The eSafety Commissioner's guidance tells platforms to avoid relying on self-declaration alone and to use a "successive validation" or waterfall approach, layering methods so that a user who fails or declines one check is offered another.

The EU is moving in a similar direction through the Digital Services Act and related work on age verification. The common thread across all three is that a birth-date box is no longer enough for services that carry real risk to children.

Accuracy and bias tradeoffs

No method is perfect, and the errors matter differently depending on the context. Facial age estimation performs well near the middle of an age range but gets less certain close to a threshold, which is exactly where decisions are hardest. Accuracy can also vary across skin tone, gender, and age group, so a system that looks accurate in aggregate can still be unfair to specific populations. This is why Ofcom's fairness criterion is not a formality. If you deploy estimation, you should ask vendors for performance broken down by demographic group, not just a single headline accuracy number.

Australia's independent Age Assurance Technology Trial, run in 2025, tested age verification, estimation, inference, and successive validation with participants including major platforms. Its headline finding was that there are no significant technological barriers to deploying effective age assurance, and that these systems can be private, robust, and effective when implemented well and combined with other measures. The qualifier matters: the trial framed success as a matter of careful implementation and layering, not a single silver-bullet product.

Privacy and data minimization

Stronger age assurance often means handling more sensitive data, including identity documents and biometrics. That creates its own risk. The UK Information Commissioner's Office (ICO) is clear that age assurance must still respect data protection law. Personal information collected for age checks must be adequate, relevant, and limited to what is necessary. Data gathered to establish age should not be re-used for unrelated purposes such as profiling for advertising, and it should not be shared without a compelling reason.

In a March 2026 joint statement, Ofcom and the ICO underlined that effective age checks and strong privacy are meant to work together, not against each other. In practice this favors designs that reveal as little as possible. A check that returns only "over 18: yes or no" is better than one that stores a scan of a passport. Approaches that process a face image in the moment and discard it, or that use a third-party attribute provider so the platform never sees the underlying document, keep the sensitive data out of your systems entirely.

This is the same principle we apply to detection work at Polycreek: collect the minimum, keep it only as long as needed, and prefer designs where the raw sensitive input never has to be retained. Age assurance is a good place to hold that line, because the data involved is among the most sensitive a platform will ever touch.

Practical guidance

Match the strength of the method to the risk of the service. A general social feed and an adult-content site do not need the same level of assurance. Layer methods so a user who declines one has an alternative, and avoid making identity documents the only path. Ask vendors for accuracy figures broken down by demographic group and for evidence of circumvention testing. Minimize what you store, prefer boolean age results over retained documents, and document your data-protection reasoning so you can show a regulator how you balanced child safety against privacy.