In today’s digital landscape, effective age verification is key to helping us build a safer, more trusted online world. Whether it’s ensuring young people have age-appropriate experiences or preventing underage sales of age-restricted items, accurate age checks are crucial for safeguarding online users.
We’re seeing a wave of age-related legislation come in around the world. With this, online services face the significant challenge of balancing user privacy with user safety.
Alongside newer age-checking solutions, existing age verification methods still have their benefits. We look at how these methods can be strengthened for greater security, efficiency and user privacy.
How do we strengthen existing age verification methods?
Existing age verification methods are important and still widely used across various industries. These methods include:
- One-off document verification requires users to upload a copy of a government-issued identity document each time they need to prove their age.
- Third-party database checks confirm if users hold certain products, like a credit card or mobile contract, to indicate they meet an age threshold.
But, to be reliable and effective in the digital era, these methods need to evolve.
Here’s how to strengthen existing age verification methods:
Move away from using self-declaration
One of the most common ways to check age is by asking users to manually input their date of birth when signing up for a service. While this seems like a simple solution, it’s far from foolproof. This is because a user can enter incorrect details to pass the age check.
Since self-declaration relies solely on the user’s honesty, it’s an unreliable method. Without additional verification steps, users can bypass age restrictions with little to no effort.
Regulators are increasingly recognising that self-declaration is not effective age assurance. Instead of using this method, we encourage businesses to offer a range of robust, privacy-preserving options to their users.
Establish exactly what data is needed
Accurate age verification is vital for ensuring that people have age-appropriate experiences. When deciding which age assurance methods to use, businesses should determine how definite they need to be about users’ ages. Does the platform need to know an exact date of birth? Or is it enough to just know whether they’re over or under a particular age threshold?
Establishing this should help businesses to work out what personal data they need to collect. A suitable balance will ensure age-appropriate experiences whilst protecting users’ privacy. Storing and processing less personal data also reduces the risk for businesses. Handling more data means businesses need to invest much more into ensuring they comply with data-related regulations in all relevant jurisdictions.
It makes sense that, where possible, services handle as little data as possible from the outset. When we securely perform age checks, either with an identity document or with facial age estimation, we only pass on the relevant age credential to businesses. This minimises the data platforms need to handle, as they only know the user’s age, their age range or that they’re over or under a required age threshold.
Introduce document authenticity checks
To establish their ages, platforms could ask users to upload a copy of their government-issued identity document. However, verifying age isn’t as simple as just checking the date of birth printed on the document. As technology has become more sophisticated, it’s now pretty easy to use photo-editing software to modify a document, change the date of birth or alter the image to make the person look older or younger than they really are.
Document authenticity checks are necessary to ensure that the uploaded document is valid, in date, has not been tampered with and is not counterfeit. Without this step, people could upload anything that looks vaguely like an identity document and it would be accepted.
For platforms to be inclusive, they should accept as many documents as possible. With this would need to come a team of document checkers who are able to recognise the thousands of documents that are issued globally by official organisations.
Opt for face matching and liveness detection
Document authenticity checks are in place to establish that documents are genuine. But businesses also need to be sure that the person uploading the document is the same person who owns it. Without this step, children could use a parent’s driving licence to pass an age check.
Face matching ensures that the face of the person on the document is the same as that of the person uploading it. Liveness detection makes sure the user in front of the camera isn’t displaying a photo, video or mask. Finally, injection attack detection confirms the user isn’t trying to bypass the liveness detection stage. It picks up if they’re attempting to replace the live camera feed with a synthetic image or video.
Combine manual document checks with automated technology
As your business grows and user bases expand, scalability can become challenging. Manually verifying identity documents at scale could cause delays and create friction for users. To help prevent this, platforms can choose to use automated checks to keep verification quick for their users.
This demands advanced technology that is capable of identifying all the different security features across thousands of documents from around the world. We believe automated checks should be supported by an expert team of document checkers and Super Recognisers who know exactly what to look for. Having human fallback helps with trickier submissions and lowers the risk of fraudsters passing the checks.
Consider using age tokens and Digital IDs
Platforms wanting to implement effective age verification need to balance protecting their users with avoiding too much friction. We know that, with the relevant checks, uploading an identity document gives platforms a high level of certainty of users’ ages. But asking users to dig out a passport each time they want to access age-restricted content can be inconvenient.
To avoid this, platforms can choose to accept age tokens. After users prove their age once, an age token can be added to their device or browser using passkey technology. The token tells each new site that the user meets the required age threshold, giving them continued access to age-restricted platforms for a fixed period of time. They eliminate the need for users to repeatedly verify their age on every site.
Alternatively, users can create a reusable Digital ID and add their age with either a government-issued document or facial age estimation. This would allow them to securely share only their verified age or age range, quickly and easily from their phone.
Add multi-factor verification
Third-party database checks are a useful tool for verifying age, but they’re only as accurate as the databases they rely on. For greater certainty, platforms can choose to implement multi-factor verification. This requires users to verify their age through more than one method. For instance, platforms could pair a database check with a secondary verification method, like facial age estimation or using a Digital ID.
This can improve reliability and reduce the chances of incorrect age verification due to outdated or incomplete data.
Adapting age verification for the digital era
As technology continues to evolve, existing age verification methods need to be adapted to be effective in our increasingly digital world.
By adopting advanced, secure and user-friendly age verification solutions, businesses can better protect users whilst complying with regulations. This helps to build trusted environments and safeguard users online.
If you’d like to know more about effective age verification, please get in touch.
