Effective Age Verification: Going beyond reading a date of birth on an ID

profile picture Amba Karsondas 6 min read
Infographic displaying the stages of doing effective age verification with ID documents. Namely, Document authenticity check (low assurance) + Proof of ownership (medium assurance) + Liveness check (high assurance).

Regulators around the world are recognising that more needs to be done to protect children from harmful content online. From the Age Appropriate Design Code and the Digital Services Act to the Online Safety Act and California Age Appropriate Design Code, businesses are being required to have age-appropriate controls in place. But to do this, they need to know the age of those accessing their services. After all, if they don’t know someone’s age, they can’t protect them.

This raises some important questions. How should companies verify the ages of their users? How can they ensure age verification is effective? Should they just read the date of birth on an identity document?

 

Reading a date of birth is not effective age verification

It’s commonly thought that the best way to check age online is to ask people to use an identity document, like a passport or driving licence. Whilst this might sound like a sensible approach, simply reading the date of birth on a document isn’t effective as it doesn’t provide a high level of assurance. 

There are several reasons why this approach falls down:

  • A child could easily get hold of their parent’s driving licence and use this to pass an age check 
  • Someone could easily buy a fake ID on the internet
  • Someone might tamper with a real document and edit the date of birth
  • Someone might use a lost or stolen ID

Age verification against an identity document can give a high level of assurance, but only when it’s done effectively. This involves more than only reading the date of birth.

Here are some of the steps required for effective age verification using an identity document:

Infographic displaying the stages of doing effective age verification with ID documents. Namely, Document authenticity check (low assurance) + Proof of ownership (medium assurance) + Liveness check (high assurance).

Document authenticity checks

To verify someone’s age against an identity document, companies must conduct various checks on the document itself. These are known as ‘document authenticity checks’.

These determine if the document:

  • is a government-issued identity document
  • is valid 
  • is in date
  • has been tampered with
  • is a counterfeit
  • is a known lost or stolen document

Without this step, people could upload anything that looks vaguely like an identity document and it would be accepted. It’s relatively easy to buy a ‘novelty’ or fake document, tamper with a sample or genuine document, obtain a document from the dark web, or create a synthetic fraud.

Therefore, organisations must check various security features on documents when verifying someone’s age. On some passports, this could include checking that the information on the page matches the relevant data stored in the passport’s NFC chip. Checks can be done manually or by automated technology such as optical character recognition (OCR). This is a technology that can recognise text from a physical document, such as a passport, and make it readable electronically. There are differences in the quality of this technology though. Poor quality OCR software could misread a document. For instance, a misread date of birth can result in very high errors (such as misreading 5 as 6, 3 as 8 or 1 as 7).

In addition, some companies offer a manual review process depending on the use case and risk profile. To do this effectively, document reviewers must be continually up to date with the thousands of official documents used worldwide.

 

Face matching

Face matching is a very important step in the verification process. It assesses if the person presenting the document matches the photo of the person on the document. Without this step, a 10-year-old could very easily use their parent’s ID.

This step is done in the real world too. Whether it’s a bouncer at a nightclub, a bartender or a supermarket worker, someone checking an ID will look to see if the person in front of them is the one photographed on the document. It would be obvious to them if a 10-year-old was attempting to purchase alcohol with their parent’s ID.

Face matching can be done by automated technology or by trained experts known as super recognisers. Most people can match a selfie to a face in a very recent identity document. However, most individuals would struggle to correctly match a current selfie with a photo in a nine-year-old document. As such, super recognisers must undergo thorough screening and have access to continuous training. Companies should also undertake ongoing quality reviews and internal audits.

 

Liveness detection

Alongside face matching, businesses must be sure that the person presenting the document is a real person. This is known as a liveness check and is an essential part of an effective verification process. Without this step, someone could show a photo, video or AI-generated deepfake which matches the face on the identity document – despite it not being their own. 

There are several approaches to checking liveness, and their effectiveness and cost vary significantly. NIST provides a framework for testing performance levels of liveness. A good benchmark is NIST Level 2, which involves testing against specialist attacks such as latex face masks or 3D printers. To pass NIST Level 2, companies must detect 99% of attacks and limit false negatives to less than 15%.

 

So what does this all mean?

Effective online age verification is more complicated than simply asking someone to upload a document or reading the date of birth on an ID. Document authenticity checks, face matching and liveness are all needed to provide a much higher level of assurance. Without these checks, underage users could easily access age-restricted or inappropriate content using a fake or fraudulent document. Or adults could access spaces made exclusively for young people.

To find out more about effective age verification and how it may be useful for your business, please get in touch.

Keep reading

An image showing three icons, which represent face matching, multi-factor verification and document authenticity checks. These are three of the methods discussed in the article.

Strengthening existing age verification methods to meet modern challenges

In today’s digital landscape, effective age verification is key to helping us build a safer, more trusted online world. Whether it’s ensuring young people have age-appropriate experiences or preventing underage sales of age-restricted items, accurate age checks are crucial for safeguarding online users. We’re seeing a wave of age-related legislation come in around the world. With this, online services face the significant challenge of balancing user privacy with user safety. Alongside newer age-checking solutions, existing age verification methods still have their benefits. We look at how these methods can be strengthened for greater security, efficiency and user privacy.  

7 min read
An image showing a comparison between two age results on a mobile phone screen. On the left hand side is a screen showing an age result that has been verified with Yoti's facial age estimation. The right hand side shows a screen with a showable Digital ID card that has been verified with a UK driving licence. Both screens show an "18+" age result.

Age estimations in our Digital ID app

Digital ID users can have their age estimated in the app, and then anonymously share the age result. This gives them a secure, private and easy way to pass age checks. – With lots of legislation being introduced to improve online safety, including the UK Online Safety Act and the EU Digital Services Act, more businesses are looking at how to verify the age of users. People should have a choice in how they prove their age, so they can choose the method that works best for them. They might use their identity document, complete a facial age estimation

5 min read
An image of a man sitting in a darkened room and using his mobile phone.

France’s new age verification law: what it means for adult platforms and how to comply

Every month, 2.3 million minors in France access adult content online. In response, the French regulator Arcom has introduced strict new rules to ensure that only adults can access platforms with pornographic content. These measures, which come into full force on 11th April, aim to protect children while protecting the privacy of adults. In this blog, we answer some of the common questions about the new law and explore how our solutions can help platforms to comply.   What are the new rules from Arcom? In October 2024, Arcom, (Audiovisual and Digital Communication Regulatory Authority), announced new rules for

6 min read