Verifying Age: How Persona can help provide age assurance

An overview of Persona’s age assurance methods

1. Age estimation

• Selfie age estimation: Estimates age by analyzing facial features from a user’s selfie. Also checks for spoofing and presentation attacks.

2. Age inference

• Email-based age inference: Uses data points (e.g., email age, digital footprint) to assess the likelihood a user is over specified age thresholds (13, 16, 18).

3. Age verification

• Phone-based age verification: Verifies a user is over 18 by checking mobile network operator (ie MNO) records.
• Credit card-based age verification: Verifies card validity, leveraging the common legal requirement that cardholders are 18+.
• Government ID verification: Verifies a document’s authenticity and extracts the date of birth to confirm age. Can be combined with a selfie check to match the user to the ID.
• Database verification: Cross-references user information against authoritative and issuing databases (e.g., credit bureaus, public records) to confirm age.

4. Reusable age token

• Reusable Persona: Allows users to store and reuse their verified age attribute (e.g., 18+) for future access.

How it works

Your specific setup will vary based on regional regulations and your desired user experience. The steps below outline one example of layering multiple age assurance methods (known as successive validation, per ISO 27566).

1. Use existing information

• Infer or verify age using the email or phone provided at signup. We recommend confirming ownership with 2FA. This method helps meet compliance requirements with minimal user friction.

2. Estimate age

• If existing information is insufficient (e.g., a newly created email), use selfie age estimation as a fallback.

3. Government ID verification

• If the age estimate is ambiguous or near a threshold (e.g., estimated 18.1 for an 18+ gate), escalate to Government ID verification. This can be paired with a selfie check to confirm the user matches the ID document.

4. Simplify future verifications

• End users may setup a Reusable Persona. This enables simple re-verification using digital passkeys (e.g., FaceID) for sensitive actions, like updating login details.

Understanding Age Assurance: A Strategic Overview

Age assurance has evolved beyond a simple compliance self declared check. It is now a comprehensive operational framework designed to establish high-confidence assertions about a user’s age while balancing regulatory requirements, user experience, and privacy.

As global standards such as ISO/IEC 27566-1 mature, organizations are moving away from basic self-declaration, which is insufficient for mitigating risk and is easily circumvented, to higher age assurance methods.

1. Defining the Objective: Age Gating vs. Age-Appropriate Experiences

An effective age assurance strategy begins with clearly defining the intended outcome. Different objectives introduce distinct threat models and therefore require different technical approaches.

Age Gating (Age ≥ 18)

Objective
Prevent minors from accessing content or services intended exclusively for adults.

Common Use Cases

• Purchase of age-restricted goods
• Online gambling and wagering
• Adult or explicit digital content

Primary Risk
A minor successfully misrepresenting themselves as an adult.

Age-Appropriate Experiences (Age < 18)

Objective
Ensure that minors access environments designed to be safe, moderated, and developmentally appropriate.

Common Use Cases

• Multiplayer and social gaming platforms
• Chat and messaging features
• Youth-oriented online communities

Primary Risk
An adult misrepresenting themselves as a minor to gain access to child-focused environments.

2. Technology Evaluation Framework

When selecting an age assurance solution, product and compliance leaders should evaluate options across three core performance dimensions to identify the most appropriate approach for their risk profile.

Best Practice
No single technology provides perfect accuracy across all populations and use cases.

Organizations should provide users with a broad range of solutions and adopt a progressive (waterfall) verification strategy where:

1. Low-friction methods (e.g., selfie-based age estimation) are used initially
2. Higher-assurance methods (e.g., government-issued ID) are introduced only when necessary

3. Privacy and Data Stewardship

Modern age assurance programs must be privacy-by-design, particularly when processing data related to children. Regulatory expectations increasingly require organizations to demonstrate proportionality, necessity, and restraint in data handling.

Core Privacy Principles

• Age-Appropriate Controls
  Verification methods should be suitable for the user’s demographic (e.g., avoiding financial instruments for younger users).
• Risk-Proportionate Measures
  The strength of verification should align with the sensitivity and risk of the content or transaction.
• Data Minimization
  Collect and retain only the minimum data required to achieve the stated objective.
• Ephemeral Processing
  For privacy-forward approaches such as selfie-based age estimation, biometric data should be processed transiently and deleted immediately after an age determination is made.

By aligning clear objectives, appropriate technology choices, and rigorous privacy controls, organizations can implement age assurance strategies that are compliant, scalable, and trusted by users and regulators alike.