What is age verification and how is it changing?

Age verification (or age assurance) means establishing a user's age before granting access to content or services. It is moving rapidly from self-declaration toward enforced checking.

What has changed the picture:

The UK Online Safety Act requires services likely to be accessed by children to protect them from harmful content, and imposes highly effective age assurance requirements for pornography and certain other content, enforced by Ofcom with substantial penalties.

The EU Digital Services Act imposes related obligations, and several jurisdictions including a number of US states and Australia have introduced their own requirements.

The methods, and each has trade-offs:

Self-declaration — entering a date of birth. Effectively no barrier, and no longer sufficient where the law requires effectiveness.

Credit card checks, which act as a proxy for adulthood and exclude adults without cards.

Photo ID upload, which is effective and requires handing identity documents to a service.

Facial age estimation — analysing a selfie to estimate age. Increasingly common because it needs no documents, though accuracy varies and is generally poorer near thresholds and reportedly less consistent across demographic groups.

Third-party providers and digital identity wallets, which check once and issue a token confirming age without revealing identity to the service. This is the approach privacy advocates generally favour.

Device or operating system level signals, and account age inference.

The genuine tensions:

Privacy. Effective verification means collecting sensitive data — identity documents or biometrics — creating databases that are attractive breach targets. A previous UK age verification scheme was abandoned partly over this.

Exclusion. Adults without ID, without a card, or unwilling to submit biometrics lose access to lawful content.

Circumvention. VPNs defeat geographic enforcement trivially, and usage of them rises measurably when requirements come into force.

Scope creep, from adult content toward broader categories.

Data minimisation and token-based checks are the direction of travel.