age-verification-methods
Age Verification and Estimation Methods
Overview
Age verification and age estimation are distinct but complementary approaches to determining whether a user is a child for the purpose of applying appropriate data protection safeguards. Age verification provides a definitive confirmation of age through documentary or transactional evidence. Age estimation provides a probabilistic assessment of age using technological methods such as facial analysis, behavioural analysis, or device signals. The selection of an appropriate method requires balancing accuracy, privacy impact, accessibility, and proportionality. This skill covers the full spectrum of available methods, their regulatory context under the GDPR, UK AADC, COPPA, and emerging legislation such as the EU Digital Services Act (DSA) and the UK Online Safety Act 2023, and provides implementation guidance based on ICO and CNIL recommendations.
Regulatory Context
GDPR Article 8(2)
"The controller shall make reasonable efforts to verify in such cases that consent is given or authorised by the holder of parental responsibility over the child, taking into consideration available technology."
The "reasonable efforts" standard is context-dependent. The EDPB has not prescribed specific technologies but expects controllers to adopt verification proportionate to the risk of the processing.
UK AADC Standard 3 — Age-Appropriate Application
"Take a risk-based approach to recognising the age of individual users and ensure you effectively apply the standards in this code to child users." The ICO guidance states that the level of certainty required depends on the risks to children from the processing. Higher risks demand more robust age assurance methods.